Codebase takeover checklist

Every rule in the codebase takeover playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. An Expert can check it for you.

Triage

• Required TKO-1 Take control of every account before touching the code
• Required TKO-2 Rotate every secret the previous team could read
• Required TKO-3 Take a backup and restore it before the first change
• Recommended TKO-4 Run it from a clean checkout
• Recommended TKO-5 Map the system before changing it
• Recommended TKO-6 Measure a baseline before the first fix
• Recommended TKO-7 Fix in risk order

Characterization tests

• Recommended TKO-8 Pin today's behaviour before changing code
• Recommended TKO-9 Keep known bugs pinned until their own fix
• Recommended TKO-10 Cut a seam before testing hard code

Rewrite or refactor

• Recommended TKO-11 Refactor in shipped steps by default
• Recommended TKO-12 Rewrite a part only when written conditions hold
• Recommended TKO-14 Rewrite behind the old interface
• Avoid TKO-13 Freezing the old system for a big-bang rewrite

Leaving an AI builder

• Required TKO-16 Give each table one writer during the move
• Recommended TKO-15 Put a router in front and move one route at a time
• Recommended TKO-17 Compare old and new answers before switching a route
• Recommended TKO-18 Move users without resetting their passwords
• Recommended TKO-19 Switch off the builder app on a set date

Major upgrades

• Required TKO-20 Keep one list of support end dates
• Recommended TKO-21 Upgrade one major version at a time
• Recommended TKO-22 Run codemods in their own commit
• Optional TKO-23 Test both versions during an upgrade

Technical debt

• Recommended TKO-24 Keep a debt register in the repository
• Recommended TKO-25 Spend a set share of each cycle on debt
• Recommended TKO-26 Record a shortcut when you take it

Due diligence

• Required TKO-27 Build the product from the company's own repository
• Required TKO-31 Scan the whole history for secrets
• Required TKO-32 Test the access rules on the running product
• Recommended TKO-28 Find every part that depends on one person or one tool
• Recommended TKO-29 List the licences of the code and every dependency
• Recommended TKO-30 Ask the team to explain the critical paths without AI
• Recommended TKO-33 Check how the team reviews AI-written code
• Recommended TKO-34 Measure cost per customer over the last 12 months
• Recommended TKO-35 List what must be rebuilt to grow
• Recommended TKO-36 Check how personal data is handled
• Recommended TKO-37 Tie every finding to a rule ID and evidence
• Recommended TKO-38 Never sign a review of code you have changed
• Recommended TKO-39 Work from read-only access and delete copies afterwards

Show the badge on your project

When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.

<a href="https://agentwranglers.se/playbook/codebase-takeover/checklist"><img src="https://agentwranglers.se/badge.svg" alt="Checked against the Agent Wranglers codebase takeover playbook" width="214" height="20"></a>

[![Checked against the Agent Wranglers codebase takeover playbook](https://agentwranglers.se/badge.svg)](https://agentwranglers.se/playbook/codebase-takeover/checklist)