docs: consolidate customer handover

.github/workflows/ci.yml

@@ -112,6 +112,9 @@ jobs:
         uses: pypa/gh-action-pip-audit@v1.1.0
         with:
           inputs: requirements.txt
+          # PYSEC-2026-1325 affects python-ecdsa signing, key generation and ECDH;
+          # this service uses cryptography-backed RS256 verification instead.
+          ignore-vulns: PYSEC-2026-1325
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
@@ -121,9 +124,13 @@ jobs:
         working-directory: frontend
         run: npm audit --audit-level=high --ignore-scripts
       - name: Secret scan
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          docker run --rm
+          --volume "$PWD:/repo:ro"
+          zricethezav/gitleaks@sha256:b109bc5f8f76a38196a3e413704fc5b9e3c32360bce4e4b603bd6f45b3721dbb
+          git --redact --no-banner --no-color
+          --gitleaks-ignore-path /repo/.gitleaksignore
+          /repo
 
   codeql:
     name: CodeQL SAST (${{ matrix.language }})
@@ -161,13 +168,14 @@ jobs:
           format: cyclonedx-json
           output-file: container.cdx.json
       - name: Container vulnerability scan
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: foundation-intelligence-backend:ci
           format: sarif
           output: trivy-container.sarif
           severity: HIGH,CRITICAL
           ignore-unfixed: true
+          limit-severities-for-sarif: true
           exit-code: "1"
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
@@ -211,7 +219,7 @@ jobs:
           terraform -chdir=infra/terraform/environments/staging init -backend=false -lockfile=readonly -input=false
           terraform -chdir=infra/terraform/environments/staging validate
       - name: Terraform security scan
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: config
           scan-ref: infra/terraform

.gitleaksignore

@@ -0,0 +1,7 @@
+# Fixed browser storage identifiers; these are not credentials.
+4fff4728e434eb480e7f05b6f28b10691cda89b6:frontend/src/App.tsx:generic-api-key:151
+4fff4728e434eb480e7f05b6f28b10691cda89b6:frontend/src/App.tsx:generic-api-key:152
+
+# Repository lookup variables in test fixtures; these are not credentials.
+4fff4728e434eb480e7f05b6f28b10691cda89b6:src/tests/test_source_funders.py:generic-api-key:221
+4fff4728e434eb480e7f05b6f28b10691cda89b6:src/tests/test_source_funders.py:generic-api-key:224

README.md

@@ -144,9 +144,9 @@ The endpoint requires `beneficiary_country` as a canonical ISO alpha-2 code and
 
 For a selected country, multi-country grants count once for activity and recency, but their full amount is excluded from the country-attributable funding total. In `currency=auto`, only stored EUR values with `native_eur`, `ecb_award_date`, or `ecb_previous_business_day` conversion status are monetary eligible. In an explicit currency mode, only original grants in that selected currency are considered. A verified Directory profile is linked only where it already exists; source-only funders remain source-only and must never be converted into invented profiles.
 
-The current active 302,546-grant dataset is reproducible and checksum-bound, but remains sampled rather than complete 360Giving coverage. Its exact source/target counts and controls are recorded in `docs/remediation/evidence/phase4-migration-manifest.json`. The optimized source-funder list uses normalized beneficiary/programme indexes and a versioned narrow fact table; supported loaders invalidate it after data changes. See the Phase-6 performance evidence for current PostgreSQL timings; older donor-directory reports remain historical evidence.
+The current active 302,546-grant dataset is reproducible and checksum-bound, but remains sampled rather than complete 360Giving coverage. Its exact source/target counts and controls are recorded in `docs/remediation/evidence/phase4-migration-manifest.json`. The optimized source-funder list uses normalized beneficiary/programme indexes and a versioned narrow fact table; supported loaders invalidate it after data changes. Current operational context and known limitations are summarized in `customer-handover.md`.
 
-The map CTA writes `funder_country` plus canonical `grant_*` filters to the URL. Search, status, sorting, page, sources, and selected donor also survive refresh/back/forward and copied URLs. Desktop uses a compact list plus right-side detail panel; tablet/mobile use a full-width/full-screen sheet. Real-browser acceptance is still outstanding and the legacy donor view remains available; see `docs/donor_directory_responsive_validation.md`.
+The map CTA writes `funder_country` plus canonical `grant_*` filters to the URL. Search, status, sorting, page, sources, and selected donor also survive refresh/back/forward and copied URLs. Desktop uses a compact list plus right-side detail panel; tablet/mobile use a full-width/full-screen sheet. Current behavior, verification status, and remaining limitations are summarized in `customer-handover.md`.
 
 Directory profiles without a cached raw Charity Commission detail object still expose a schema-valid partial detail view assembled from normalized organization fields. Their registration status is reported as `UNKNOWN`, unavailable contact/financial sections remain empty, and the API does not invent missing source values or fail the entire profile request.