Reconstructing a chain of title over a codebase: stages and deadlines
Reconstructing a chain of title over a codebase means proving, contributor by contributor, that every line of code sits with the company that claims to own it. In practice the work runs six to twelve weeks per repository, longer where former contributors do not answer. The stages are fixed; the calendar depends on how many gaps surface.
Why a gap in the chain matters
A codebase with no clean chain of title is not unusable — it is unpriced. A financing round, an acquisition, or a licensing deal all stall at the same point: the buyer's lawyers ask who owns the code, and the answer takes weeks to assemble instead of minutes. The delay itself becomes leverage for the other side.
The default rule that automatically vests rights in an employer does not extend to freelance contributors, open-source contributors working outside a contract, or agencies that subcontracted the work further down the chain. Each of those relationships needs its own paper trail, and the trail is usually incomplete rather than absent — a few contributors are covered, a few are not, and nobody has ever listed which is which.
What to do
The reconstruction moves through the same six steps regardless of the size of the codebase. The person running the audit should own each step; splitting them across departments is where most files stall.
| Stage | What happens | Typical duration | Who signs off |
|---|---|---|---|
| Inventory | List every repository, branch and dependency | 2–5 days | Engineering lead |
| Contributor mapping | Match every commit to a named individual or entity | 1–2 weeks | Audit lead |
| Paperwork pull | Collect employment, freelance and vendor agreements | 1–3 weeks | Legal or HR |
| Gap flagging | Mark contributors with no assignment on file | 2–3 days | Audit lead |
| Remediation | Send retrospective assignments or licences for signature | 2–6 weeks | Counsel, per contributor |
| Logging | Record signed, refused or unreachable against each name | ongoing | Audit lead |
- Inventory the codebase. The engineering lead lists every repository, fork and dependency before anyone talks to a contributor — a gap found after paperwork starts is far harder to place in context.
- Map every contributor. Cross-check commit history against payroll and vendor records; the audit lead treats an unmatched name as a gap, not an oversight to skip.
- Pull the assignment paperwork. One folder per contributor, holding the employment contract, the freelance agreement, or the addendum that actually transfers rights.
- Flag the gaps. A contributor with no signed transfer on file is a gap even if they are still on the payroll; silence in the file is what a later buyer will see.
- Remediate each gap. Counsel drafts a retrospective assignment or licence and sends it to the contributor for signature, one document per name, not a blanket letter.
- Log the outcome. Signed, refused, or unreachable — this log, not the original contracts, is the document a counterparty's lawyers will actually read.
Who decides
No public registry records authorship of code, so there is no office to file the reconstructed chain with. A dispute over who owns a given line of code, if it reaches that stage, is decided by the civil court with jurisdiction over the underlying contract — usually the contract with the contributor in question, not the company's general terms. The file assembled during remediation is the evidence that court will see; a missing signature cannot be supplied after the claim is filed.
Where the file usually forks
If a contributor is unreachable, the gap does not close on its own. The company documents the attempt to contact them and treats the code as encumbered until either a signature arrives or the code is rewritten.
If the contributor was an employee rather than a freelancer, the gap is often smaller than it looks — but "employee" needs to be checked against the actual contract, not the job title, before anyone relies on it.
If the codebase already sits inside a financing arrangement, the situation resembles what happens when A security addendum arrives with the order form technology: the paperwork surfaces after the commercial terms are already agreed, not before, and the reconstruction has to run against a clock someone else set.
If the codebase underlies a product that has already been tokenised, the same pressure resurfaces as in The deadline that matters in this situation for token issuance: ownership gaps in the underlying code become visible exactly when the market is watching most closely.
The point of no return
Once a retrospective assignment has been sent for signature, the contributor knows the company is checking its own title. A refusal at that point is harder to walk back than silence before the request was sent. This is the stage where a scoping conversation before the letters go out saves more time than any step that follows.
Sources and limits
This page sets out the procedure and the calendar; it does not price the codebase itself or the company that holds it. That valuation work sits in a separate report, ordered once the portfolio is defined: Asset report before a portfolio is bought and its.
Nor does it establish whether a named contributor or counterparty is solvent enough to be worth chasing for a signature. That question is answered separately, in Debtor in Lithuania explained.
This page does not cover the underlying database rights sitting alongside the code — a compiled dataset can carry its own ownership questions independent of the software. A related audit, covering that layer rather than the code itself, is set out in Database rights audit ownership of results.
FAQ
How long does reconstructing a chain of title over a codebase take in practice?
Six to twelve weeks for a single repository with a moderate number of contributors. Multiple repositories, unreachable former contractors, or contracts held only on paper each add several weeks.
Which documents are needed to start?
A full list of repositories and contributors, plus every employment contract, freelance agreement, and assignment addendum that can be located. Missing documents are noted as gaps rather than assumed to be lost.
What happens if the other side does not respond?
The company documents the attempts to reach them and treats that part of the codebase as encumbered. In some cases the affected code is rewritten rather than left waiting on a signature that may never arrive.
A scoping call is a shorter first step than a full audit, and it usually clarifies which repositories actually carry risk before any paperwork is requested.