Technical diligence dossier
Meridian Systems (synthetic demo company)
- Subject
meridian-systems/meridian-platform @ 5df5415bdef5- Produced by
- acquicode-engine 0.1.0, rules 2026.09.1
- Digest
c9f52a1b6dbe7ac7474f1c5a3bfb2a6fe27e15a50900861e9b0798b19489d655- Reproduce
- The same commits always give this digest. Hosted dossiers are also signed; anyone can verify one.
Meridian Systems does not exist. Its repository is generated by a script with deliberately planted problems (contractors without agreements, a live-looking key, copyleft dependencies, contradictory AI attribution, a vulnerable CI workflow) and then analysed by the same engine customers use.
BLOCKED
4 findings must be resolved before close; 29 further material findings and 5 material unknowns remain.
- Strong copyleft (GPL-family) licenses in production dependencies
- Network copyleft (AGPL-family) licenses in production dependencies
- Credentials in the current code (2)
The level says how completely the evidence answers the diligence questions, not whether the software is good, secure or free of legal risk. AcquiCode does not run or test the code, audit its design, inspect infrastructure or data handling, or give legal advice, and it sees only the repositories listed under Scope.
4blocking
29material
12minor
1info
5material unknowns
How every claim is graded
Each finding, answer and piece of evidence carries one of these states. The readiness above can never be more certain than the weakest state it rests on.
- Verified
- Observed and independently checked
- Observed
- Read directly from the repository or a named source
- Derived
- Computed deterministically from observed facts
- Company-asserted
- Stated by the company; not proof
- Inferred
- Heuristic reading; raises questions, never blocks
- Conflicting
- Sources disagree
- Unknown
- No evidence either way
71 evidence items. Extracts are short structured values, never source code or secrets.
- Observed
package-lock.json— graph-weaver: BUSL-1.1 · lockfile.license · licenses.metadata@1 - Observed direct
commit 58d65e3e4738— Co-authored-by: Claude <noreply@anthropic.com> · commit.ai_signal · ai.commit_signal@1 - Observed
third_party/fastjson· vendored.package · dependencies.vendored@1 - Inferred inference
commit 81de5601f559— Add reporting module · commit.bulk_unattributed · ai.bulk_unattributed@1 - Observed
package-lock.json— graph-weaver@1.3.2 · lockfile.entry · dependencies.parse@1 - Observed
package-lock.json— pdf-render-kit: AGPL-3.0-only · lockfile.license · licenses.metadata@1 - Observed
Dockerfile:1— node:latest · container.base_image · reproducibility.docker@1 - Observed
src/ai/summarize.ts— api.openai.com · code.ai_endpoint · ai_dependency.endpoint@1 - Observed corroborating
CLAUDE.md @ 293d4b4b1730— claude-code · repo.agent_config · ai.agent_config@1 - Observed direct
src/ai/summarize.ts @ 58d65e3e4738— git-ai authorship/3.0.0 · provenance.git_ai_note · ai.git_ai_note@1 - Unverifiable
.agent-trace/traces.jsonl#2— src/billing/tax.ts: revision not found in the analysed history · provenance.parse_problem · ai.agent_trace@1 - Company-asserted direct
src/search/index.ts @ d0bc1462d623— agent-trace 0.1.0 · provenance.agent_trace · ai.agent_trace@1 - Observed
package-lock.json— express@4.18.2 · lockfile.entry · dependencies.parse@1 - Observed
src/lib/parse.ts:2— Adapted from https://github.com/example/csv-lite/blob/main/parse.c · file.copied_from · thirdparty.copied_from@1 - Observed
config/.env.production· file.env · secrets.env_file@1 - Observed
package-lock.json— readable-stream@2.3.8 · lockfile.entry · dependencies.parse@1 - Observed
ml/requirements.txt— scikit-learn@* · manifest.entry · dependencies.parse@1 - Unverifiable
.agent-trace/traces.jsonl#3— src/ai/summarize.ts: ranges exceed the file's 50 lines at that revision · provenance.parse_problem · ai.agent_trace@1 - Company-asserted
meridian-systems/meridian-platform:acquicode.yml— src/billing/** → human: Billing rules were written by hand by the core team · declaration.origin · declaration.origin@1 - Inferred inference
package-lock.json— loadash ≈ lodash · dependency.near_miss · supplychain.typosquat@1 - Observed
config/.env.production:1— Stripe live key: sk_l… (31 chars) · secret.match · secrets.stripe-live-key@1 - Observed corroborating
.cursor/rules/style.mdc @ 293d4b4b1730— cursor · repo.agent_config · ai.agent_config@1 - Observed
src/lib/parse.ts:1— GPL-2.0-only · file.spdx_identifier · licenses.spdx_header@1 - Observed
bin/legacy-export.exe— executable · file.binary · inventory.binary@1 - Observed
vendor/tinycrypt· vendored.package · dependencies.vendored@1 - Observed
src/config.ts:3— AWS access key ID: AKIA… (20 chars) · secret.match · secrets.aws-access-key@1 - Observed
package-lock.json— pdf-render-kit@2.1.0 · lockfile.entry · dependencies.parse@1 - Observed
package-lock.json— gpl-helpers: GPL-3.0-or-later · lockfile.license · licenses.metadata@1 - Company-asserted
meridian-systems/meridian-platform:acquicode.yml— 3 register entries · declaration.ip_register · ownership.register@1 - Observed direct
commit 5f8ec9d222c4— aider: · commit.ai_signal · ai.commit_signal@1 - Observed
package-lock.json— gpl-helpers@0.4.0 · lockfile.entry · dependencies.parse@1 - Observed
package.json— UNLICENSED · manifest.license · licenses.metadata@1 - Observed
src/ai/summarize.ts— gpt-4o-2024-08-06 · code.model_id · ai_dependency.model_id@1 - Observed
package-lock.json— lodash: MIT · lockfile.license · licenses.metadata@1 - Observed
package-lock.json— loadash@1.0.0 · lockfile.entry · dependencies.parse@1 - Observed direct
commit 4c9a23cdf304— Co-authored-by: Cursor Agent <cursoragent@cursor.com> · commit.ai_signal · ai.commit_signal@1 - Observed
package-lock.json— readable-stream: MIT · lockfile.license · licenses.metadata@1 - Observed
package-lock.json— openai@4.52.7 · lockfile.entry · dependencies.parse@1 - Observed
.github/workflows/ci.yml:13— some-org/deploy-action@v2 · ci.unpinned_action · ci.github_actions@1 - Observed
ml/requirements.txt· manifest.no_lockfile · reproducibility.lockfile@1 - Unverifiable direct
src/billing/tax.ts @ deadbeefdead— agent-trace 0.1.0 · provenance.agent_trace · ai.agent_trace@1 - Company-asserted direct
src/ai/summarize.ts @ 58d65e3e4738— agent-trace 0.1.0 · provenance.agent_trace · ai.agent_trace@1 - Observed
dist· repo.build_output · inventory.build_output@1 - Observed
package-lock.json— lodash@4.17.20 · lockfile.entry · dependencies.parse@1 - Observed
.github/workflows/ci.yml:12— pull_request_target + checkout of PR head · ci.pr_target_checkout · ci.github_actions@1 - Observed
scripts/deploy.sh— GitHub token: ghp_… (40 chars) · secret.history_match · secrets.github-token@1 - Observed
models/churn.onnx· file.model_artifact · ai.model_artifact@1 - Observed
package-lock.json— typescript: Apache-2.0 · lockfile.license · licenses.metadata@1 - Observed
package-lock.json— bcrypt: MIT · lockfile.license · licenses.metadata@1 - Observed
src/utils/retry.ts:2— https://stackoverflow.com/questions/38213668/promise-retry-design-patterns · file.stackoverflow_reference · thirdparty.stackoverflow@1 - Observed
package-lock.json— meridian-auth@0.9.4 · lockfile.entry · dependencies.parse@1 - Observed direct
commit d0bc1462d623— Copilot <198982749+Copilot@users.noreply.github.com> · commit.ai_signal · ai.commit_signal@1 - Observed
package-lock.json— bcrypt@5.1.1 · lockfile.entry · dependencies.parse@1 - Unverifiable direct
src/ai/summarize.ts @ 58d65e3e4738— agent-trace 0.1.0 · provenance.agent_trace · ai.agent_trace@1 - Inferred
config/.env.production:2— Database URL with password: Pr0d… (13 chars) · secret.match · secrets.database-url@1 - Observed
package-lock.json— typescript@5.4.5 · lockfile.entry · dependencies.parse@1 - Observed corroborating
src/ai/helpers.ts— generated by ChatGPT · file.ai_marker · ai.file_header@1 - Observed
package-lock.json— express: MIT · lockfile.license · licenses.metadata@1 - Observed direct
commit 70ee954046d1— Co-authored-by: Claude <noreply@anthropic.com> · commit.ai_signal · ai.commit_signal@1 - Observed
package-lock.json— openai: Apache-2.0 · lockfile.license · licenses.metadata@1 - Observed
Dockerfile:5— python:3.12-slim · container.base_image · reproducibility.docker@1 - Observed
ml/requirements.txt— numpy@>=1.26 · manifest.entry · dependencies.parse@1 - Observed
src/lib/geo.ts:2— Copyright 2014 GeoCorp Ltd · file.copyright_notice · thirdparty.copyright@1 - Observed
.github/workflows/ci.yml:17— curl -sL https://get.example-cdn.io/setup.sh | bash · ci.pipe_to_shell · ci.pipe_to_shell@1 - Observed
third_party/fastjson/LICENSE— MIT · vendored.license_file · licenses.vendored@1 - Observed
package-lock.json— zod · lockfile.drift · reproducibility.drift@1 - Observed
ml/requirements.txt— meridian-features@0.3.1 · manifest.entry · dependencies.parse@1 - Observed
.github/workflows/ci.yml:16— ${{ github.event.pull_request.title }} · ci.script_injection · ci.github_actions@1 - Observed
ml/requirements.txt— --extra-index-url https://pypi.meridian.internal/simple · config.extra_index_url · supplychain.extra_index@1 - Observed
vendor/tinycrypt· vendored.no_license · licenses.vendored@1 - Inferred
test/billing.test.ts:3— Hard-coded credential: test… (17 chars) · secret.match · secrets.generic-secret@1