The first rung of the ladder — a short, honest assessment of whether your AI-assisted codebase has a problem worth solving.
Before you commit to an audit, you should know whether you need one. Many teams using AI agents to write code suspect something is off — tests that always pass, dependencies they did not knowingly add, agents whose permissions no one can fully account for — but cannot tell whether the unease is real or imagined. The Diagnostic exists for exactly that moment. It is the cheapest, lowest-commitment way to find out whether the next rungs of the ladder are warranted, or whether your practice is already healthy enough to leave alone.
A Guild Diagnostic is not an audit. It is the conversation that decides whether an audit is justified.
A practitioner-grade checklist for the surface scan a Guild Diagnostic performs — how AI is actually being used, obvious risk surfaces, agent and tool configuration, structural smell tests, and tooling reality checks. Use it to self-screen before booking a Diagnostic, or as a discussion guide with your own team.
A Diagnostic is a short, focused engagement — typically a single working session with a Guild practitioner, plus a surface scan of the relevant parts of your codebase and agent setup. It is deliberately limited in scope. We do not open every drawer. We look at the drawers most likely to contain the things you would not want a customer, a regulator, or an acquirer to find first.
At the end you receive a candid written summary: what we saw, what concerned us, what did not, and whether we believe a full audit, an optimization pass, or a continuous assurance relationship is warranted. If the answer is "you are fine — keep doing what you are doing," that is the answer we give. The Diagnostic ends with an honest verdict, not a sales pitch for the next rung.
Breadth over depth. The goal is to surface the signals that tell us where deeper work would matter — not to do that deeper work itself.
Before examining code quality, agents, or structure, we assess how efficiently your team is spending tokens. Token spending is a primary concern in its own right — not a footnote to code review. Every unnecessary token is a future tax on every interaction: compounding cost, compounding latency, compounding context pollution. We look at prompt design, context window discipline, model selection relative to task complexity, and whether AI is being invoked where simpler tools would suffice. Wasteful token patterns are often the earliest and clearest signal that an AI-assisted practice has drifted from craft to cargo cult.
Which agents, which models, which workflows, what proportion of the code is AI-authored, and what review discipline sits between generation and merge. We map the real practice, not the policy on paper.
A targeted scan for the failure modes most common in AI-assisted codebases: hallucinated dependencies, over-permissioned agents, test suites that confirm rather than challenge, and security defaults the agent never thought to harden.
A quick read of the prompts, tools, and permissions granted to any agents in your system. Over-permissioning and runaway autonomy are the cheapest risks to spot and the most expensive to ignore.
A whole-system glance for the telltale signs of incremental agent assistance accumulating without an architectural hand on the tiller: contradictory patterns, redundant abstractions, dead code, drifting conventions.
If you already own security or governance tooling, we sample whether it is configured to enforce anything meaningful or simply producing reassuring dashboards. A surprising amount of "we are covered" turns out to be unverified on inspection.
The deliverable. A short written summary stating whether further work is warranted, which rung of the ladder we would recommend, and — just as importantly — which rungs we would not.
You have a nagging sense that the AI-assisted parts of your codebase are healthier on the dashboard than in reality — but you cannot articulate the concern sharply enough to justify a full audit. The Diagnostic sharpens it.
A full audit is an investment. The Diagnostic gives leadership a defensible, independent answer to "do we actually need this?" before committing the budget.
Your team has begun using agents seriously and you want an experienced outside eye on the practice before patterns harden into habits that are expensive to unlearn.
Before a deeper due-diligence audit, a Diagnostic tells you whether the codebase is in the rough shape its sellers or previous owners describe — and whether the full audit is going to find one problem or fifty.
Your tooling vendor, your internal team, or your last consultant has said the practice is healthy. The Guild is the party with nothing to sell except the accuracy of the second opinion.
An Audit is comprehensive: every relevant surface examined, every finding documented, every recommendation justified. A Diagnostic is targeted: a small number of high-signal probes designed to tell us — and you — whether the comprehensive examination is justified.
Put differently: an audit answers "what is wrong with this codebase?" A Diagnostic answers "is something likely wrong enough that we should ask the first question?" Both are useful. They are not substitutes for each other, and we will tell you plainly which one you need.
The Diagnostic is the only Guild service whose ideal outcome is "you do not need any more of our services."
That is by design. The cheapest rung of the ladder exists so that no one climbs the rest of it unnecessarily. If your AI-assisted practice is already in good shape, we will say so — and we will tell you what to keep doing. Honest answers at the bottom of the ladder are how the rest of the ladder earns its credibility.
If the Diagnostic surfaces work worth doing, here is where it leads.
Comprehensive, candid review of an AI-assisted codebase for correctness, security, and structural integrity.
Eliminate the waste, dead weight, and structural debt the audit surfaced.
A standing, vendor-neutral relationship verifying your AI-assisted code and agent behaviour continue to meet open security standards.
See the full ladder and decide where to step on.