A fixed-fee code preflight for private equity buyers and deal counsel. The target runs the scanner on its own machine and no source code leaves it. You get a five-page memo 48 to 72 hours after the bundle arrives.
Each gets a red, amber or green rating, the evidence behind it, a remediation cost range, and the follow-up questions to put to management.
How much of the product is calls to third-party model APIs and prompt templates, and how much is the company's own models, data pipelines and evaluation. A new release from the model vendor can erode a thin layer quickly.
Where inference and GPU spend come from, and whether cost grows faster than usage: uncapped token limits, retries with no ceiling, no caching, reserved GPUs with no idle shutdown. Estimates come from the target's own configuration, and from billing data when the data room has it.
How concentrated authorship is, which files change often and are also complex, and where code that calls AI models has no tests. The question is not whether an AI assistant wrote the code. It is whether anyone still on the team can explain and fix it.
Copyleft dependencies and how the product ships them, since GPL and AGPL obligations turn on distribution and network use. Model weights with non-commercial or use-restricted licences, including the Llama licence terms.
Personal data sent to model providers, prompt injection paths, credentials committed in the code, reliance on a single model provider, and dependencies with no pinned version.
Every finding ends with the questions and documents that would confirm or clear it, so the full diligence team and counsel know where to dig.
Targets in exclusivity are reluctant to hand outside parties access to their repositories. The preflight is built so they do not have to.
A short call with the buyer or counsel to agree which repositories, which tier and the timing. Engagement letter and NDA before anything runs.
One command on a workstation that has the repository. It reads the code and git history locally, with networking off, and writes an encrypted bundle of metrics plus a readable copy of exactly what the bundle contains.
Five pages: rating per area, findings with evidence, remediation cost ranges and questions for management. The buyout tier adds a 90-minute technical session with the target's engineers.
What is in the bundle and what is not: data handling.
Full technical diligence usually takes weeks and needs repository access. The preflight is a fast first look that tells you whether to go on and where the full review should dig.
Test the AI story in the management presentation against the code, and find the licence or cost problems that change price or structure while there is still time to negotiate.
Evidence to support disclosure-schedule requests, a specific indemnity or an AI representation. Findings are written so counsel can use them directly. For deal counsel
Run the same scan on your own code 60 to 90 days before a process, fix what you can, and walk into diligence knowing what a buyer will find.
I read every bundle and write every memo myself, so I take two preflights a month and book each to a start date. The 48 to 72 hour clock runs from the day the bundle arrives in that slot. Fees are fixed, agreed before anything runs, and paid half on start and half on delivery.
$25,000
$40,000
$25,000
No retainers and no volume pricing: each preflight is its own fixed-fee engagement. Carve-outs, multi-asset deals and full readiness work are larger engagements, below.
My consulting work is on ciscocaceres.com. The preflight is the deal-specific entry point: evidence from the code itself, in days. When a deal needs more, it becomes one of the larger engagements.
| Work | Fee | What it is |
|---|---|---|
| Reality Check | $15,000 | A 90-minute deep-dive on one decision, with a written assessment. No code scan. |
| CodeProvenance preflight | $25,000 to $40,000 | A scan of the target's code and a five-page memo for a live deal. Two a month. |
| Engagement | from $50,000 | Architecture review, system review, or a full pre-acquisition readiness pass. |
| Technical Due Diligence | from $75,000 | Code, infrastructure, security and team, with a report for the investment committee. |
I have built production software since the 1990s: MSNBC's publishing platform from 1995, a push platform load-tested to 30 million concurrent connections, and speech recognition deployed for the US Coast Guard. I now build AI products myself, so I know where the cost and the shortcuts hide.
I started this after watching intellectual property that had never been protected surface late in a diligence process. The buyer renegotiated and a $40M deal closed at $28M. Earlier evidence would have helped both sides.
Every memo is read and signed by me. There is no junior team, which is why there are two a month. The scanner does the counting; my time goes into reading its output and the data room, running the technical session and writing the memo. That bounded scope is what makes a fixed fee and a 48 to 72 hour turnaround possible.
No. The scanner reads the repository locally and writes only metrics: counts, scores, file paths, dependency names and licence identifiers, plus pseudonymous author IDs. The scanner also writes a readable copy of exactly what it seals, and the target can check with sha256sum that the two match. Data handling in full.
Then the preflight cannot go ahead in its standard form. We can instead work from what is already in the data room, such as architecture documents, dependency lists and billing exports, and the memo will say that the code was not scanned.
You cannot know from the scan alone, since the target chooses what to run it on. Three things narrow the gap: the bundle records the commit it scanned and a fingerprint of every file, the buyout tier's technical session tests the team against the findings, and the fingerprint can be checked against the code delivered at closing.
Not reliably, and neither can anyone else. Published detectors do not hold up across tools and languages. The memo looks at what matters for a buyer instead: whether code that calls AI models is tested, whether authorship is concentrated in one person, and whether the team can explain what it shipped.
The buyer usually engages and pays, alongside legal and quality-of-earnings fees. Accounting and tax treatment of deal costs depends on the structure and timing of the deal, so ask your own advisers.
Yes, with the permission set out in the engagement letter, which also sets who may rely on it. Underwriters review the buyer's third-party diligence reports, and the memo is written so it can be read in that setting.
No. It is a first read, fast and contained enough to run before or early in exclusivity. On larger deals it tells the full review where to spend its time.
No. The memo reports engineering findings and remediation cost estimates, and flags items counsel may want to address. Escrows, indemnities and price are for the buyer and its advisers.
Tell me the stage, the rough size and the timing. I reply within two business days.