Scope
- Platform: dbt
- Scope: dbt project canot_lab: adapter snowflake, dbt 1.12.6, manifest of 2026-10-17
- Privilege level: 1 (inventory, volumes, consumption)
- SQL mode: no SQL issued (files read)
- Reads: 2 done out of 3
- Content read: 8 tables, 23 objects, 0 query families
- Versions: canot X, duckdb X, sqlglot X
Capabilities
This report is an inventory: inventoried, neither exported nor replayed.
| Level | This report | Canot on dbt |
|---|---|---|
| Inventory | done by this scan (level 1) | full, level 1 |
| Export | not done by this scan | iceberg, with canot drill |
| Evidence | not done by this scan | P1 data parity; P2 query replay; P3 pipeline replay, with canot drill dbt://PROJECT DESTINATION (read-only, with the dbt profile's credentials) |
dbt connector: tested; recorded test: 2026-10-19: canot scan dbt://lab/dbt (test bench dbt project, dbt 1.12.6 manifest, Snowflake adapter); canot drill dbt://lab/dbt --target snowflake on the Snowflake trial account: 8 relations copied and identical, 8 models replayed (docs/scan.md); BigQuery and Databricks profiles written, untested.
What Canot cannot prove here: P1 covers the sources, seeds, snapshots and table or incremental models found in the warehouse; P3 covers the SQL models that DuckDB replays and whose original table is in the copy; views are replayed without comparison; Python models, incremental models and models to rebuild (F13) are counted, not proven.
Observed costs
Not read: project files: no credits and no billed bytes; the scan of the target platform measures them.
Movements
0 frozen, 4 live, 0 recreated, 4 not determined.
recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read. Based on: B02.
| Table | Type | Volume | Movement | Evidence |
|---|---|---|---|---|
| CANOT_LAB.DBT_dbt_mart.dbt_customer_ltv | TABLE | not read | live | last write on 2026-10-17 |
| CANOT_LAB.DBT_dbt_mart.dbt_daily_revenue | TABLE | not read | live | last write on 2026-10-17 |
| CANOT_LAB.DBT_dbt_mart.dbt_fct_orders | TABLE | not read | live | last write on 2026-10-17 |
| CANOT_LAB.DBT_dbt_mart.int_order_totals | TABLE | not read | live | last write on 2026-10-17 |
| CANOT_LAB.RAW.customers | TABLE | not read | not determined | writes not read |
| CANOT_LAB.RAW.order_lines | TABLE | not read | not determined | writes not read |
| CANOT_LAB.RAW.orders | TABLE | not read | not determined | writes not read |
| CANOT_LAB.RAW.products | TABLE | not read | not determined | writes not read |
What does not leave with the copy
Objects to rebuild or describe
| Type | Count | Examples |
|---|---|---|
| DAG | 1 | dbt:canot_lab |
| dbt model | 8 | model.canot_lab.dbt_customer_ltv, model.canot_lab.dbt_daily_revenue, model.canot_lab.dbt_fct_orders, model.canot_lab.int_order_totals, model.canot_lab.stg_customers … |
| dbt package | 2 | paquet:dbt, paquet:dbt_snowflake |
| dbt source | 4 | source.canot_lab.raw.customers, source.canot_lab.raw.order_lines, source.canot_lab.raw.orders, source.canot_lab.raw.products |
| dbt test | 8 | test.canot_lab.not_null_dbt_customer_ltv_customer_id.187864d35c, test.canot_lab.not_null_dbt_fct_orders_order_id.42b5497576, test.canot_lab.not_null_stg_customers_customer_id.e2cfb1f9aa, test.canot_lab.not_null_stg_orders_order_id.81cfe2fe64, test.canot_lab.unique_dbt_customer_ltv_customer_id.d86203d0a3 … |
Columns with a platform-specific type (0)
None.
Exit map
Portability declared by collection for each object read. "Exported" is not "portable": an archive in the vendor's format can only be used with that vendor.
| Portability | Object family | Objects |
|---|---|---|
| portable as is | data | 4 |
| translatable (open text, replay possible) | scheduling | 1 |
| translatable (open text, replay possible) | processing | 16 |
Dependencies
No external dependency observed in the reads done.
Query replayability
| Category | Meaning | Families | Executions | Weight |
|---|---|---|---|---|
| C0 | translated and accepted by DuckDB | 0 | not read | not read |
| C1 | not parseable | 0 | not read | not read |
| C2 | command, not analyzed | 0 | not read | not read |
| C3 | translation impossible | 0 | not read | not read |
| C4 | DuckDB parse error | 0 | not read | not read |
| C5 | binding error (platform-specific object or function) | 0 | not read | not read |
| C6 | variable | 0 | not read | not read |
| C7 | DDL, COPY, MERGE, metadata queries: counted separately | 0 | not read | not read |
| Item | Value | Nature and basis |
|---|---|---|
| C0 rate, by families | Not estimated: catalog.json not read: DuckDB EXPLAIN not run. | not estimated |
| C0 rate, by executions | Not estimated: not applicable: dbt files carry no per-query history. | not estimated |
| C0 rate, weighted | Not read: credits and bytes not read (dbt files). | not read |
Based on: 0/0 models tested, 8 not tested, SQL of the manifest models and snapshots, sqlglot X, duckdb X.
accepted ≠ identical result. Translated to DuckDB, not compared.
8 families not tested.
Most executed families (normalized forms)
None.
Ranges
Planning estimates: each range carries its assumptions. A canot drill replaces the assumed throughput with a measurement.
| Item | Value | Nature and basis |
|---|---|---|
| Volume to copy | Not read: catalog.json not read. | not read |
| Copy read time | Not estimated: volume not read. | not estimated |
| Copy read cost | Not estimated: depends on the platform that hosts the tables, not read here. | not estimated |
| Rework | 0.0 d
| estimated, low confidence objects × days per object + columns × days per column |
Findings
Each finding is labeled "To review", with no severity level. It states what is observed and what is not.
F11 · Scheduled chain and its failuresTo review
1 finding
| Target | Observed |
|---|---|
| object dbt:canot_lab | DAG, schedule not read (orchestrator outside the dbt files), state last invocation: build; 1 run, 0 failures, last on 2026-10-17. |
F12 · Incomplete readTo review
1 finding
| Target | Observed |
|---|---|
| read B03 | target/catalog.json not read (absent or not exposed); limits: columns, types and volumes of relations; replayability not tested by DuckDB EXPLAIN. |
No finding for: F01, F02, F03, F04, F05, F06, F07, F08, F09, F10, F13, F14, F15, F16. An absence of findings only holds for the reads done (see F12 and the method).
What this report does not quantify
- Platform consumption: not read: project files: no credits and no billed bytes; the scan of the target platform measures them.
- Volume to copy: catalog.json not read.
- Copy read time: volume not read.
- Copy read cost: depends on the platform that hosts the tables, not read here.
- Billed history: project files: no credits and no billed bytes; the scan of the target platform measures them.
- Your contract rate: your contract price not read.
- Destination storage, running both platforms in parallel, operations after the exit: depend on your contract and your architecture.
- Identical results of translated queries: accepted ≠ identical result: translated to DuckDB, not compared; a canot drill compares the results.
- Cost projections provided by the platform: not used: they cannot be verified from the scan.
Using this report for your regulatory work (GDPR, DORA, NIS2, Data Act, SecNumCloud, EBA)
These elements can support your own work on GDPR, DORA, NIS2, the Data Act, SecNumCloud or the EBA outsourcing guidelines. They are evidence, not a finding: this report is not a certification, it is not legal advice, and it does not say whether your contracts or your organization meet any regulation.
| Framework | What it asks, in short | What this report gives you | What it does not cover |
|---|---|---|---|
| DORA (Regulation (EU) 2022/2554) | Art. 28(8) and 30(3)(f): a realistic transition, with an adequate period. | Measured throughput and a recovery time range from the exercise; a copy duration range (estimated) in the scan. | Excludes human validation and the cutover of your applications. |
| DORA (Regulation (EU) 2022/2554) | Art. 28: knowing what depends on the ICT provider. | What does not move as is: views, routines, tasks, policies, external dependencies, with the evidence behind each finding. | An inventory of the platform, not of your contracts or of the applications connected to it. |
| Data Act (Regulation (EU) 2023/2854) | Art. 29: switching charges are withdrawn from 12 January 2027. | The effort that remains yours: read cost, copy duration and rework estimates, each marked measured, computed or estimated. | Says nothing about charges your provider may still apply before that date. Prices are dated catalogue figures, not your contract. |
| GDPR (Regulation (EU) 2016/679) | Chapter V (transfers) and Art. 32 (security of processing). | Where the copy is hosted, and which security objects do not move with it (masking and row policies, tags). | The hosting location is the destination you chose. The legal assessment of a transfer is yours. |
| GDPR (Regulation (EU) 2016/679) | Art. 5(1)(c): data minimisation. | The scan reads metadata and execution history, not table contents. SQL text is masked and identities are pseudonymised. | Applies to the scan only: an exit exercise (drill) reads the data it copies. |
| NIS2 (Directive (EU) 2022/2555) | Art. 21(2)(d): security of the supply chain, including your relationship with each direct service provider. | What ties you to this provider: external dependencies and objects that do not move as is, with the evidence behind each finding. | Does not assess the provider's security measures. |
| EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) | Exit strategies: documented, realistic, sufficiently tested and reviewed periodically for the outsourcing the guidelines target. | The exit exercise (drill) and the inventory of what does not move (scan), as test evidence in your exit file. | One exercise. Alternative providers, the business side and the periodic review are yours. Check which text applies to you alongside DORA. |
References as of 2026-10-19. Check the current texts: they evolve, and their application depends on your situation.
Method
2 reads done out of 3. Each read is recorded with its status and its reason; a value that was not read stays empty, never 0.
| Id | View | Status | Reason | Rows | Window | Latency |
|---|---|---|---|---|---|---|
| B03 | target/catalog.json | not read | absent or not exposed; limits: columns, types and volumes of relations; replayability not tested by DuckDB EXPLAIN | not read | ||
| B01 | target/manifest.json | read | 583 | |||
| B02 | target/run_results.json | read | 16 | from 2026-10-17 to 2026-10-17 |
Privileges used
Level 1: read the manifest.json, run_results.json and catalog.json files in the target/ folder. Never requested: the scan opens no connection to the warehouse and runs no dbt command (no parse, compile or run).
Cost of the scan
| Item | Value | Nature and basis |
|---|---|---|
| Queries sent | 0 queries | measured |
| Read time | 0 s | measured |
Safeguards
- No connection: Canot reads the project's JSON files, with no network and no command; no query is sent.
- Query users and roles pseudonymized with HMAC, using a salt drawn for this scan and never written; tag values hashed; locations reduced to the bucket.
- Raw SQL text is never written: only normalized forms, with literals masked, leave collection.
Rules
- Movement: recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read.
- Storage with no read: actual window of the view read, compared with 365 days; the blind spots of each view are listed in the finding.
- Copy time: assumed throughput of 20 to 80 MB/s.
- List prices are dated and sourced; they do not replace your contract price.
Next steps
This report describes your platform; it recommends neither leaving nor staying.
To measure an exit on a chosen scope: canot drill copies to Apache Iceberg, compares source and copy, and signs an evidence report.
To go further, the q4o assessment, from €22,000 excl. VAT: your contract rate, actual execution, scenarios, the steps to follow. canot.io