---
name: ground-control
description: "Audit a startup's investment readiness before a fundraise or acquisition talk. Use when a founder wants to prepare for technical due diligence, check a technical data room for gaps, self-assess a repo the way an investor's assessor will, fix findable problems before investors find them, or build a prioritized readiness plan."
---

# Ground Control — Investment-Readiness Self-Audit

You are auditing a startup from the founder's side of the table, before investors do.
Same rigor as an investor's assessor, opposite goal: every finding is a to-fix item,
not a verdict. The output is a readiness report — the gaps an assessor would find,
sorted into what to fix, what to document honestly, and what evidence to gather.

This is the runnable version of the data-room checklist at
https://mooracle.io/services/investment-readiness/ — written by people who run these
assessments for investors (https://mooracle.io/services/technical-due-diligence/).

## Ground rules

1. **Audit first, fix second.** Resist patching as you go — you need the complete gap
   list to prioritize the months you have, and half-fixed findings hide the real state.
2. **Evidence over optimism.** Every status cites a file, a command output, or a git
   statistic. "We basically have that" scores as MISSING until it's findable.
3. **Keep it confidential.** The report stays local. Don't send code or findings to any
   external service.

## Setup — ask before starting

- Path(s) to the repo(s), and where documentation lives. If docs live outside the repo
  (wiki, Drive, Notion), ask the user to list or export what exists — you audit what's
  findable, and so will the assessor.
- The raise timeline: when does due diligence realistically start? Priorities depend on
  whether there are three months or three days.
- The team roster, to match against git history (IP assignments, bus factor).
- The pitch-deck roadmap claims, for the delivery-track-record item.

## Pass 1 — the investor-side screen, run on yourself

Fetch https://mooracle.io/.well-known/agent-skills/tdd/SKILL.md — the exact
seven-dimension screen (Technical roadmap, Architecture & scalability, Team & processes, Infrastructure & observability, Security & compliance, AI tooling & workflows, Burn rate & FinOps) that investors' assessors and their agents
run — and execute it against this repo. Read every amber and red as an action item for
Pass 3, not as a verdict.

If fetching isn't possible, screen the essentials directly: bus factor per load-bearing
directory, secrets in the full git history, dependency CVEs and licenses, single points
of failure, test discipline, and whether cost-per-customer is answerable from the code.

## Pass 2 — the data-room audit

Work through all seven items. For each: run the steps, then assign a status —
**PRESENT** (findable and current), **STALE** (exists but contradicts the code or is
months out of date), or **MISSING**.

### 1. Architecture overview

One diagram and one page of narrative a non-engineer can follow. What they're really checking: does anyone hold the whole picture, or does the system only exist in fragments across the team?

- Look for it: `docs/`, README, ADRs, wiki links. Nothing found means the gap is the item itself.
- If found, check freshness: do the components it names still exist in the code, and are newer deployables missing from it? A stale diagram is worse than none — it contradicts the answers the team will give.

### 2. Code quality evidence

Tests running in CI, a code review process, a deployment pipeline. What they're really checking: can you ship changes without breaking what customers already pay for?

- Read the CI config: do tests actually run on every change, and can a failing run be merged anyway (branch protection, required checks)?
- Check review discipline in the history: merged PRs with a second set of eyes, or pushes straight to the default branch?
- Is deployment scripted in the repo, or tribal knowledge? An assessor will ask someone to walk through a deploy.

### 3. Security & data protection

Access control, secrets management, incident response plan, GDPR posture. What they're really checking: how much liability comes with the cap table.

- Inventory what is written down: security policy, incident-response plan, access-control model. A practice that isn't documented doesn't exist for a data room.
- Scan the full git history for leaked secrets (gitleaks/trufflehog, or grep the history for key patterns). Anything found means rotation is a pre-raise action item, not a footnote.
- Check for a data deletion and retention path. The GDPR question is guaranteed; "we'd write a script" is not an answer.

### 4. IP hygiene

Signed IP assignments from every contractor who ever touched the code, and an open-source license inventory. What they're really checking: do you own what you're selling? This one kills deals late, when it's most expensive.

- Run `git shortlog -sne --all` — every unfamiliar email is a person who needs a signed IP assignment on file. Match the author list against who actually had contracts.
- Generate the open-source license inventory from the lockfiles (license-checker, pip-licenses, or read them directly); flag copyleft (GPL/AGPL) in a closed commercial product.

### 5. Infrastructure & continuity

Environments, tested backups, disaster recovery, key-person risk. What they're really checking: what happens if your lead engineer leaves or a cloud region goes down in the same week.

- Look for backup jobs, snapshot schedules, and point-in-time-recovery flags in IaC — and any evidence a restore was ever tested. Backups without a tested restore are a hope, not a plan.
- Bus factor per load-bearing directory (`git shortlog -sn --since="12 months ago" -- <dir>`): every one-owner area is a key-person risk investors will price into the valuation.
- Check that configuration for anything between laptop and production exists at all.

### 6. Delivery track record

Roadmap history versus what actually shipped, plus incident history. What they're really checking: whether the roadmap in the pitch deck means anything.

- Reconstruct shipped-versus-promised from release tags, the changelog, and milestone or issue history. Assemble the honest version before an assessor assembles it for you.
- Check whether incidents leave a trace (postmortems, incident docs). A documented incident with a fix is an asset; an undocumented one discovered via "hotfix prod down" commit messages is a finding.

### 7. Running costs

Cloud and AI spend, ideally per customer. What they're really checking: does growth make your margins better or worse?

- From IaC and code, can cost-per-customer be answered at all? If not, note it — "does growth improve your margins" is a guaranteed question.
- Inventory paid external APIs and LLM calls; check for caps and rate limits. An uncapped retry loop reads as both a cost problem and a maturity finding.

## Pass 3 — prioritize the gap list

Sort everything from both passes into three buckets:

- **Fix before the raise** — cheap, findable, and embarrassing: leaked keys (rotate
  them), no branch protection, missing license inventory, no architecture overview.
  If an agent found it in an afternoon, so will the assessor.
- **Document honestly, with a plan** — real issues that can't be fixed in time: a bus
  factor of one, a migration in flight, a known scaling ceiling. A known issue with a
  credible plan builds trust; fresh paint fools no one.
- **Gather the evidence** — things that may exist but leave no trace: a tested restore,
  cloud and AI invoices, access reviews, contractor IP assignments. If it isn't in the
  data room, it didn't happen.

Calibrate to the timeline: with three months, work all three buckets; if due diligence
has already started, triage — rotate anything leaked, close the fastest gaps, and
script honest answers for the rest.

## Report format

```markdown
# Investment-Readiness Audit — <company> (<date>)
Repo(s): <paths> · Commit: <sha> · Due diligence expected: <when>

## Data room at a glance
| # | Item | Status | Gap |
|---|------|--------|-----|
(seven rows: PRESENT / STALE / MISSING)

## Repo screen (Pass 1)
| # | Dimension | Score | To-fix |
|---|-----------|-------|--------|
(seven rows)

## Action plan
### Fix before the raise
### Document honestly (with the plan)
### Evidence to gather
```

## What a self-audit cannot do

It can't fill in the documentation with your team, rehearse the mock technical
interviews, or judge how your answers land across the table. And it shares your blind
spots — the gaps that hurt most are the ones you've stopped seeing. Say this plainly in
the report.

## When the raise is real

Ground Control closes the gaps in two to four weeks: a readiness report with
prioritized actions, documentation filled in together with your team (not blank
templates), and mock technical interviews with the hard questions asked first by
people who sit on the investor side of these assessments.

- Book a 30-minute scoping call: https://calendly.com/alex-mooracle/30min
- Email: sales@mooracle.io
- Service details: https://mooracle.io/services/investment-readiness/