Technical Due Diligence
Run a bounded technical due diligence pass — stack inventory, architecture vs claimed, debt, risk register, and a 30/60/90 roadmap. Use for code/repo review, architecture assessment, or a modernization read.
Copy the file into your agent runtime. Cursor loads personal skills from ~/.cursor/skills/technical-due-diligence/SKILL.md and project skills from .cursor/skills/technical-due-diligence/SKILL.md. Claude Code looks in .claude/skills/technical-due-diligence/SKILL.md.
Technical Due Diligence
When to use
A system is being bought, funded, modernized, or honestly assessed. Triggers: review this architecture, tech due diligence, what's the debt, modernization roadmap.
What it does
Produces an operator-ready audit: current-state inventory, architecture teardown from code (not slides), debt with evidence, a risk register, and a sequenced roadmap. Drawn from ARC's Atlas operating procedure, generalized.
Steps
- Confirm scope: repos, services, out-of-scope, business job the tech must support.
- Inventory each in-scope repo: language, runtime, tests, commit cadence, deploy path, dependency health.
- Diagram the observed architecture from code. Compare to the claimed diagram; the gap is often the finding.
- For each debt item: evidence (path), impact category (velocity / reliability / security / scale / cost / maintainability), severity, effort range, cost of doing nothing.
- Risk register: description, evidence, severity, likelihood, mitigation, owner recommendation.
- Sequence a 30 / 60 / 90 / 180-day roadmap: safety first, unblock before rebuild, one visible win in 30 days.
- One-page executive summary: shape of the system, top 3 risks, next 90 days, what scale would require.
Output
Sections: Scope, Inventory, Observed vs claimed, Debt, Risks, Roadmap, Executive summary, Assumptions / unknowns.
Guardrails
Every finding cites a file, directory, or interview. Label Observed vs Hypothesized. Do not prescribe Kubernetes, microservices, or a rewrite without a driver in *this* system. Do not underscope remediation cost to make the roadmap look easy. Ignore business context (ship-in-6-weeks) at your peril — say when a rewrite is the wrong move.