You commissioned an app. The demo looks great, the invoice is due, and somewhere in the back of your mind is the question you feel underqualified to ask: how do I know this is actually finished? This guide is for the non-technical side of that handover. No jargon beyond what gets defined, and nothing here requires you to read code.
A demo proves the software runs on the builder’s machine, today, on the happy path they chose to show you. It does not prove that anyone else can run it, that the parts you did not see work, or that the project can survive the builder becoming unavailable. Those are the properties you are actually buying, and none of them is visible from a screen share.
This gap is wider than it used to be, because much of today’s contract work is built with AI coding agents. That is not a problem in itself; it is how modern software gets built at modern prices. But it means large parts of your codebase may never have been read line-by-line by a human, and independent research has repeatedly found that AI-generated code contains security-relevant weaknesses at meaningful rates, which is why bodies like Georgetown’s Center for Security and Emerging Technology treat unreviewed generated code as a risk category of its own. The practical conclusion for you is simple: claims about AI-built software need evidence, not confidence.
First: can someone else run this? Ask the builder to show the software installed and working from a clean start, not on the machine it was built on. The written setup steps should have been executed by someone, recently, with the result recorded.
Second: what was actually tested? Every project has automated checks or it has none. You are entitled to know which, and to see the results of the last run, with a date.
Third: what is unfinished? Every real project has loose ends. A builder who hands you a written list of known gaps is protecting you; one who says everything is done is asking you to discover the list yourself, in production, after the engagement ends.
Fourth: what do I now own, and can I get into it? The code repository, the hosting account, the domain, the database, every third-party service. You should log into each one yourself before final payment, while the builder is still around to fix access.
Fifth: if we disagree later about what was delivered, what do we point at? This is the question the rest of this page answers.
The most useful thing you can request from your builder is a handover document where every statement says how it was established. The vocabulary worth knowing has three levels. Verified means a machine executed the thing and it worked: the strongest label. Shown in the code means the repository itself demonstrates it, which is solid but weaker. Reported by the AI means the coding agent said so during the build and nobody has independently confirmed it: treat those as leads, not facts. A document that does not distinguish these levels is marketing with a table of contents.
Mantyl generates exactly this kind of document. It is called a project passport: the builder runs a free tool that reads the project and its AI history, executes the setup and tests in a clean sandbox, and produces a report where every line carries one of those labels, including the uncomfortable ones. When something the AI claimed does not match what the code shows, the passport says contradicted, in so many words. You can look at a complete example to see what you would receive. Asking your builder for one costs them about ten minutes; the tool is free.
Here is the part that makes a passport different from a nicely formatted promise: you can check it without trusting anyone. If you have the delivered project on a computer with Node installed (a free, standard developer runtime; any technical acquaintance can set it up in minutes), one command compares the delivery against the passport:
If a single file was changed after the passport was generated, the command names the file. If the delivered code cannot reproduce its own recorded checks, you find out now, not in month three. The fuller walkthrough, written for someone in your seat, is on the recipients page. For deliveries where you want the proof to come from neither you nor the builder, a Mantyl Verified run re-executes everything on independent infrastructure and signs the result; it costs the builder £19 to £49, once.
If the software handles payments, personal data or anything regulated, evidence-checking is the floor, not the ceiling: pay a professional for a human security review as well, and give them the passport so their hours go on expert judgement rather than setup archaeology. And if you are reading this because a delivery has already gone wrong, start with before you hire someone to fix your AI-built app before you sign a rescue quote.