Provenance: the 48-hour AI-codebase diligence acquirers run before they wire the money

The problem

Acquirers are repricing software on AI-authorship risk: Bain's vibecoding test — rebuilding a target's product with AI to test defensibility — has already killed at least one bid, and founders are warned that untraceable AI-generated code gets priced into the deal. But today's diligence cannot see the risk: human reviews take 3-4 weeks and $22k-$50k yet still sample by hand, while CAST, CodeScene and Black Duck predate the agent-written-codebase era and measure none of it.

The idea

Why now

October made automated provenance diligence buildable: CodeDiver RC1 (Oct 17) gives machine understanding of AI-written codebases, Graaph (Oct 15) supplies code knowledge graphs over MCP, CLiF (Oct 16) shows trajectories distill into profiles — the same trick mines a repo's commit history into an agent-vs-human build signature — and Liquid's d1-ultra (Oct 16) makes per-module risk verdicts cost fractions of a cent. Meanwhile the June 2026 Bain/FT revelation turned AI-authorship into a deal-breaker dimension that no existing diligence tool measures.

What it combines

Collides five radar-tracked capabilities: CodeDiver RC1 (codediver-rc1-desktop-app-mcp-server-for-understanding-ai-written-codebases) for machine understanding of AI-written code; Graaph (graaph-code-knowledge-graphs-plus-free-mcp-for-ai-coding-assistants) for dependency and ownership mapping; CLiF (copilotkit-clif-continual-learning-that-turns-agent-trajectories-into-skills) — trajectory-distillation repurposed to mine commit history into an agent-vs-human build signature; Liquid d1-ultra (liquid-ai-d1-ultra-sota-decision-model-with-zero-output-tokens) for per-module risk verdicts at fractions of a cent; Jev 1.14 (jev-1-14-0-typesafe-s-judgment-layer-update) for the typed final deal verdict. Code graphs map what exists, trajectory mining reveals how it was built, decision models price the risk — no single tool writes a diligence memo.

MVP

Weekend MVP: a CLI that takes a read-only repo snapshot, builds the knowledge graph, mines commit history for agent-authored bursts, runs license and secret scans, and emits a 10-page PDF memo with per-dimension verdicts (security, maintainability, bus factor, license, replicability) plus a remediation cost band. Deliberately skip: dynamic analysis, founder interviews, the outside-in vibecode-replication test, and the white-label portal.

How it makes money

The moat

Human DD firms (Dextra, MEV, Big Four practices) monetize weeks of partner hours; a $2k automated pre-screen cannibalizes the $22k-$50k comprehensive engagement, so they can only adopt it as a white-label feed — which is the distribution channel, not competition. CAST Highlight and Black Duck sell via enterprise contracts to CIOs for portfolio governance; their architecture and sales motion cannot serve a 48-hour self-serve deal screen to a PE deal partner mid-deal, and AI-provenance detection plus verdict memos is a new detection surface and a new buyer, not a feature they can bolt on in a quarter. The compounding moat is the calibration dataset: every report paired with post-close outcomes (predicted risk vs actual rewrite cost) makes the next verdict sharper, and no incumbent owns deal-outcome data.

Distribution

B2B2C: (1) boutique tech-DD and M&A advisory firms white-label the 48-hour pre-screen as the top of their funnel — it feeds their $22k comprehensive engagements rather than competing with them; (2) acquisition marketplaces embed a one-click Provenance report on every listing, where buyers cannot afford a $5k manual review. Direct motion: PE/VC deal teams and corp-dev running LOI-stage screens.

Why it wins

CAST Highlight scores portfolios for CIOs; CodeScene coaches engineering teams; Black Duck finds license CVEs. None measures AI-authorship provenance or answers the deal question Bain now asks — 'could an AI rebuild this?' — and none delivers a priced risk memo in 48 hours at roughly $2k.

Risks

Biggest risk is misattributing human code as AI-written and torpedoing a fair deal. De-risk by reporting provenance as confidence-banded evidence (commit burst patterns, test coverage deltas) rather than accusations, and by requiring a human DD partner's sign-off before any red verdict ships. Second risk: sellers refusing repo access pre-LOI — de-risk with the no-access tier that runs the outside-in replicability test from public artifacts only.

Build it with

• CodeDiver RC1: desktop app + MCP server for understanding AI-written codebasesMachine understanding of AI-written codebases — the analysis primitive for provenance detection.
• Graaph — code knowledge graphs plus free MCP for AI coding assistantsCode knowledge graphs for dependency and ownership mapping across the target repo.
• CopilotKit CLiF: continual learning that turns agent trajectories into skillsTrajectory-distillation technique repurposed to mine commit history into an agent-vs-human build signature.
• Liquid AI d1-ultra: SOTA decision model with zero output tokensZero-output-token decision model: per-module risk verdicts at fractions of a cent.
• Jev 1.14.0 — TypeSafe's judgment layer updateTyped judgments as the decision layer for the final red/amber/green deal verdict.
• AI Engineering Fluency: Strava-style analytics for how you code with AITeam velocity and authorship analytics signal for the build-signature profile.

Repo to start from

provenance-dd — Repo snapshot in, priced risk memo out: AI-authorship provenance, time-bomb inventory, and per-dimension red/amber/green verdicts for software acquisitions.

Evidence

• Vibecoding is becoming a deal-breaker test for software acquisitions (The Decoder, Jun 2026)
• Why AI-Generated Code Hurts Your Exit (The Bootstrapped Founder)
• Technical Due Diligence Cost: Pricing and What to Expect (Dextra Labs)
• Taking Over an AI / Vibe-Coded Production App: 8 Risks to Check First
• Tech Diligence in M&A: The 9 Systems Buyers Audit Before Signing (ModelStack)
• Buyer Guide: Best Due Diligence Software Tools — CAST Highlight, Black Duck, CodeScene