Introducing Ghost Architect Partner™ -- Profile-Driven Codebase Audits for Consultants

Ghost Architect Partner™ ships in v5.0.0 as a Pro-tier feature. It's the consultant edition of Ghost -- a profile system that loads your firm's methodology, billing rates, and branding into every scan, so the report comes out looking and reading like work you actually did, not work a tool generated.

If you're an independent consultant or boutique agency running codebase audits for a living, this post is for you. If you're not, the rest of this is going to feel like inside baseball -- feel free to skip to the v5.0.0 launch post for the broader release news.

---

The Problem Ghost Partner Solves

Ghost Architect produces good reports. Senior-architect-quality findings, severity-scored, with effort estimates and dollar amounts. The PDF is branded, the Markdown is structured, and the TXT is developer-ready. Out of the box, it's a usable deliverable.

But for a consultant, "usable deliverable" isn't quite enough. Your firm has a methodology. You have specific billing rates that are different from defaults. You have branding that needs to be on every client-facing document. You probably have a particular framework you run audits against -- OWASP Top 10, SANS Top 25, your own internal checklist, an industry-specific compliance standard.

Before v5.0.0, getting a Ghost report into a client-deliverable shape meant manually editing the output: re-skinning the PDF in your design tool, recalculating dollar estimates against your actual rates, prefixing the executive summary with your firm's name and methodology framing. Doable, but it added 30 to 60 minutes of finishing work to every scan. For a consultant who runs three audits a week, that's a meaningful chunk of billable time spent on document polish.

Ghost Partner removes the polish step. The profile loads at scan time, and the output is shaped by your firm's parameters from the first finding to the final summary.

How a Partner Profile Works

A partner profile is a YAML file. You write it once, save it somewhere in your home directory or a private repo, and tell Ghost to use it on every scan. The profile defines four things: identity, methodology, billing, and output styling.

// Identity

The basic facts about your firm. Name, contact, methodology framework name. This is what shows up in the executive summary as "Audit prepared by [Your Firm]." It also drives metadata in the PDF and Markdown headers.

// Methodology

This is the substantive layer. The profile lets you define how your firm classifies findings -- what counts as Critical for you, what your severity weighting framework is, which categories you emphasize. If you run every audit through OWASP Top 10, you can declare that, and Ghost's narrator will frame findings against OWASP categories where they apply. If you have your own internal checklist (let's say "auth, data, integrations, performance, ops"), you declare those categories and Ghost groups findings into them in the output.

You can also inject methodology-specific guidance into the executive summary. "All findings have been evaluated against [Firm Name]'s [Framework] criteria" or similar -- the language is yours, the placement is automatic.

// Billing rates

Ghost's default remediation cost table uses tiered rates: $85 / hr (junior), $125 / hr (mid-level), $200 / hr (senior architect). These are reasonable defaults for the broad market. They're also probably wrong for your firm.

Partner profiles let you override those numbers. If your firm bills at $150 / $225 / $350 across the three tiers, you set that in the profile, and every dollar estimate in every scan reflects your actual rates. The remediation cost table comes out client-ready, no manual recalculation. If a finding takes 6 hours of senior work, the report says $2,100, not $1,200.

You can also adjust complexity-to-tier mapping. Maybe your firm always sends senior architects on Critical findings regardless of complexity. Set that in the profile, and Critical findings always price out at senior rates.

// Output styling

Pro-tier Partner profiles control the methodology and billing. Enterprise-tier profiles add white-label PDF output -- your firm's logo on the PDF header, your color palette, your typography. The header that says "Ghost Architect" becomes "[Your Firm] Codebase Audit, powered by Ghost Architect." The "Ghost Architect" attribution is preserved in a discreet footer per the licensing terms, but the document reads as your firm's work product.

What a Profile Looks Like

The profile format is straightforward YAML. Here's a complete example for a fictional firm:

You save that file, then run Ghost with the profile flag:

From that point forward, the scan output reflects your firm. Findings get grouped under your category names. The remediation cost table uses your billing rates. The executive summary opens with your methodology framing.

Who Ghost Partner Is For

If your business model fits any of these, Ghost Partner was designed for you:

Independent consultants doing codebase audits. You're billing $250+ per hour. Your audits go to enterprise clients who expect deliverables that match their procurement standards. Your time on document polish is expensive billable time. Profile loading turns the polish into a one-time configuration.

Boutique agencies (3-15 people) with a defined methodology. Your firm has internalized a way of doing audits -- categories you always cover, frameworks you always reference, output formats clients expect. The profile codifies that methodology and applies it consistently across every audit your team runs.

Fractional CTOs running pre-engagement assessments. You walk into engagements where the deliverable is a written assessment of the codebase you're inheriting. Profile-driven scans let you produce that assessment faster, with billing-rate accuracy that makes the cost estimates immediately credible to the new client.

Audit specialists working under specific compliance frameworks. If your firm specializes in PCI, HIPAA, SOC 2, or industry-specific compliance audits, the methodology layer of the profile lets you bake the framework into Ghost's output. Findings come pre-categorized against your compliance categories.

What Ghost Partner Is Not

It's worth being clear about the boundary.

Ghost Partner is not a managed service. There's no Ghost-side review of your profile, no certification process, no approved-partner program. You write a profile, you use it, the output is what it is. Anthropic's API generates the underlying findings, Ghost's verifier grounds them in your source code, and your profile shapes the framing. The findings are still produced by an AI system, with all the qualifications that implies.

Ghost Partner is also not an attribution-stripping tool. Even with white-label PDF output (Enterprise tier), the Ghost Architect attribution is preserved in a discrete footer. You can't ship a Partner-output PDF as if it were a fully manual audit done by your firm. The output is "your firm's audit, generated using Ghost Architect" -- not "your firm's audit, full stop."

And Ghost Partner doesn't replace your judgment. The profile shapes the output. The output is still a starting point -- a sized engagement plan, a prioritized list, a costed remediation table -- that your firm reviews, validates against your direct experience with the codebase, and signs off on before delivering to the client. Ghost finds things faster than reading by hand. Your firm decides what to do about them.

Pricing and Availability

Profile loading and per-profile billing rate overrides ship with Ghost Pro ($99/mo) and above. White-label PDF output is Enterprise-only ($1,200/mo, custom seats).

If you're already on Pro or Team, Ghost Partner is included in your subscription as of v5.0.0 -- no upgrade needed. Just write a profile and pass it on the command line.

If you're new to Ghost, the path is: try Open free first, run a few scans on codebases you know, and once you're confident the tool produces output you'd want to deliver to clients, upgrade to Pro and start writing your firm's profile.

What's Coming Next

v5.0.0 ships the profile loading and billing rate overrides. The next round of Ghost Partner work focuses on three areas:

Methodology templates. Pre-built profile starters for OWASP Top 10, SANS Top 25, Mage-OS audit standards, and a generic "boutique consulting firm" template. You'll be able to start from a template instead of writing the profile from scratch.

Profile validation. A ghost --validate-profile command that checks your YAML for typos, conflicting values, and rate-tier inconsistencies before you use it on a real client scan.

Multi-profile support. Some firms have different methodology frameworks for different client types -- enterprise vs. SMB, regulated industries vs. unregulated, etc. The roadmap includes loading multiple profiles at once and choosing the active one per-scan.

If your firm has specific methodology requirements that current Ghost Partner doesn't cover, I want to hear about it. The profile schema is going to evolve based on real usage from real consultants -- email [email protected] with what your firm needs and the profile schema will get there faster.

---