Code & architecture audit
Before deciding on a rewrite, a refactoring or a freeze, know what you have.
We read the codebase and measure what slows you down. You get evidence, and a clear decision to make.
When an audit makes sense
A rewrite, a major refactoring, a freeze: each option is defensible, each one is expensive. The choice deserves evidence.
Technical due diligence on a product or a vendor. Our recent audits span industry, energy markets, sports federations and public education.
Regressions keep coming back and every change costs more than the last one, yet nobody inside the team can say exactly why: the system has drifted beyond what anyone holds in their head.
What we look at
The code alone never explains everything. We investigate three perimeters.
module boundaries, dependency cycles, coupling hotspots, drift between domain concepts and the code.
design, testing strategy, code reviews, definition of done.
reliability, observability, deployability, security. Is the system production-ready?
How we work
Two kinds of investigation, one rule: facts and inferences never mix.
The quantitative side runs on our own tooling. Codegraph extracts a dependency model from your sources without compiling them, then mines the git history for hotspots and co-change patterns, so that every claim in the report stays traceable to a source line.
The qualitative side is interviews with the people who live with the system: developers, ops, support, security. The code tells us what the system is. The people tell us why.
We diagnose against public references such as ISO 25000 for software quality and production-readiness criteria for the run. Not against our taste.
What you get
where you stand. Four axes (architecture and design, build, test, run), three levels per axis, each level defined by observable criteria. A decision-maker reads it in a minute; every rating is backed by the report.
why we say it. Dependency graphs, metrics, git hotspots, interview findings.
what to do first. Each recommendation comes with its rationale and its implementation risks.
What happens next
The maturity assessment is a baseline. Re-run it after a remediation or a coaching engagement and you measure progress instead of guessing it.
An audit is also how a remediation starts.