Auditing Git Logs Against Corporate Invention Assignment Contracts
Technical repository audits inspect author timestamps and hardware artifacts to enforce corporate ownership under employee invention agreements.
Stamp
An engineer inspects the terminal window at midnight, looking at a line of commit hashes generated during three years of salaried employment. A prospective investor just requested full source repository access to evaluate an intellectual property portfolio before wiring seed capital. Every entry in the log carries an author date, a committer date, an email address, and an absolute UTC offset.
The corporate employer provided a predictable wage, hardware allowances, and equity vesting schedules across those exact months. That provision felt like security while it arrived. Behind that provision sat a proprietary inventions assignment agreement that established legal ownership over everything conceived or reduced to practice during the employment term.
The audit moves backwards. Technical auditors hired by venture funds or acquiring corporations do not begin with interview transcripts. They begin with the raw Git object database.
They extract tree objects, commit objects, and tag metadata to measure whether outside development occurred while the author was drawing a corporate salary. Clocks govern title.
Forensic Chronology in Version Control Histories
Inspectors examining an intellectual property chain trace every modification to its recorded seconds. Version control systems record two independent temporal markers for every change set: the moment an author crafts a patch, and the moment a committer applies that patch to a branch. In standard local development, these values match.
When an engineer stages code locally during a weekday afternoon and delays pushing until midnight, the author date retains the corporate afternoon timestamp.
An engineer who pushes commits through personal credentials during working hours hands the employer presumptive title to the entire repository.
Corporate legal teams match these timestamps against badge swipe records, video call calendars, Slack activity logs, and corporate Jira tickets. A commit timestamped at two in the afternoon on a Tuesday creates a sharp evidentiary vulnerability. The engineer may claim the work occurred during lunch or a personal break.
Corporate invention contracts routinely define working hours as any time spent on employer business or any hour during standard business operations. The presence of weekday commit timestamps creates an immediate presumption that company time funded the creation.
Discrepancies Between Author and Committer Records
Programmers frequently manipulate client clocks or write code offline during a corporate flight. When an engineer manually changes the system clock or overrides the author date environment variable, the committer date remains pinned to the actual time of merge or rebase. Auditors write scripts to flag gaps exceeding twenty-four hours between these two fields.
A wide gap signals intentional timestamp alteration or historical revision. During technical due diligence, altered timestamps convert an ordinary intellectual property review into a forensic investigation. The employer kept the count.
The company funded the salary that kept the household solvent during those exact months, and the code written between nine and five belongs to the entity that paid for the hours.
Device
Corporate equipment leaves unmistakable signatures across modern build environments. When an operator checks out an outside repository on a company laptop, the operating system registers file creation dates, user account names, and hardware identifiers in file system journals. The shell configuration files frequently inject corporate credentials, internal proxy configurations, or enterprise single-sign-on tokens into repository settings.
Equipment creates title.
The employer provided the machine to advance its own commercial objectives. That provision was not a personal gift. Accepting the hardware bound the recipient to the underlying property policies of the corporation.
When private software touches corporate iron, the boundary separating independent invention from corporate asset dissolves.
Hardware Allocation and Employer Property Claims
A company laptop issued on an engineer’s first morning carries legal attachments across its operating life. Most corporate invention assignment contracts state that any invention developed using company equipment, facilities, or trade secret information belongs entirely to the employer. This claim applies regardless of whether the work occurred at three in the morning on a Sunday or inside a personal residence.
The physical silicon belongs to the employer, and anything produced through that silicon becomes infected with the employer’s claim of ownership.
Technical auditors examine Git commit metadata for clues regarding the execution environment. Global Git configuration settings often embed employer user names or corporate email handles into personal projects. An audit scans the history for old commits authored under an enterprise domain, even if later commits were authored under a personal handle.
A single commit containing a corporate email address establishes that corporate credentials, and likely corporate hardware, were active inside that development cycle.
Does Prior Inventions Disclosure Shield Later Commits?
Exhibit schedules attached to initial hiring agreements rarely protect work produced during active tenure. When starting a role, technical employees routinely list prior inventions on an Exhibit A form. This form aims to carve out existing software from the employer’s assignment scope.
Founders believe listing a project on Exhibit A grants permanent immunity to continue building that project while employed. The paper remained silent.
- Vague descriptive scope leaves the boundary undefined, allowing corporate counsel to assert that ambiguous notes failed to exclude subsequent architectural designs.
- Omission of specific repositories forfeits the presumption of independent development once an engineer continues committing to preexisting projects.
- Unsigned disclosure exhibits nullify statutory protections when dispute resolution demands verified documentation from the commencement date.
- Subsequent feature additions introduce newly authored modules that postdate the hiring signature, transferring title of incremental improvements to the employer.
A signed schedule of prior inventions excludes only the specific systems identified before the first employment date.
The disclosure form freezes a snapshot of code completed before the first day of employment. It does not license the employee to build new modules for that project using evenings and weekends during the employment term. Commits authored after the employment start date represent newly created intellectual property, and each new commit must independently clear the contractual assignment hurdles.
A founder facing an unseparated hardware record concedes equity concessions or escrow holdbacks during series financing to extinguish the title claim.
Scope
Employment contracts draw wide circles around technical ingenuity. The typical Corporate Invention Assignment Agreement covers any invention related to the actual or demonstrably anticipated business, research, or development of the employer. The hours define the debt.
If a software engineer works for an enterprise database vendor and builds a private developer tool on personal hardware, corporate attorneys argue the tool falls within the company’s anticipated expansion lines.
In institutional research on psychological contracts and invention assignment compliance, technical staff routinely exhibit an asymmetrical assumption of ownership, believing unpushed side projects developed on personal time remain private. This empirical observation rests on survey and deposition analysis across Silicon Valley software enterprises during trade secret discovery. Explicit corporate onboarding that tests employee comprehension of invention assignment perimeters through verified testing would alter these behavioural defaults.
Statutory Carve Outs and Demonstrable Business Lines
State protections set explicit perimeters around off-duty employee labor. California Labor Code Section 2870, along with parallel statutes in states such as Washington, Illinois, and New York, restricts the reach of corporate assignment clauses. Under California law, an employer cannot claim an invention developed entirely on the employee’s own time, without using employer equipment, supplies, facilities, or trade secrets, unless the invention relates to the employer’s business or results from work performed for the employer.
An empirical examination of intellectual property litigation records in federal district courts regarding employee inventions demonstrates that courts treat code authored during core business hours on corporate networks as presumptive employer property. This finding rests on appellate cases interpreting California Labor Code Section 2870 and Delaware commercial disputes involving salaried technical staff. A statutory revision defining working hours strictly by logged billable minutes rather than chronological business hours would shift this evidentiary presumption, as would appellate rulings segregating home network packet transit from employer administrative dominion.
Code produced on private machines forfeits protection the moment it touches corporate communications infrastructure.
The business relation test remains the most contested battleground in repository audits. If an engineer designs an algorithm that optimizes cloud data caching, and the employer sells cloud storage infrastructure, the statutory exemption fails. The work relates directly to the employer’s business.
In an audit, counsel will cross-reference every commit message against internal employer product roadmaps to prove the departing engineer solved a problem the employer was actively researching.
Forensic Indicators in Corporate Assignment Contests
Technical diligence teams weigh distinct categories of evidence when evaluating repository provenance. The intersection of technical artifacts and legal definitions determines whether a title defect threatens an upcoming transaction.
| Evidentiary Category | Delaware Common Law Standard | California Labor Code 2870 | Negotiated Moonlighting Carve-Out |
|---|---|---|---|
| Hardware and Facility Use | Any use assigns invention to employer | Any use forfeits statutory exemption | Permitted within written threshold boundaries |
| Chronological Origin | Presumed employer property if salaried | Must occur entirely on employee time | Excludes logged employer project sprint hours |
| Business Alignment | Broadly covers all software capabilities | Tied to current or anticipated product lines | Strictly confined to named competitive domains |
| Audit Proof Requirement | Employee carries burden to prove independence | Employer demonstrates direct business connection | Verified commit log matches carve-out schedule |
A written waiver signed by an executive officer expressly relinquishes corporate interest in the designated repository, restoring clean title to the departing engineer.
Trace
Version repositories preserve an unvarnished record of human habits. Code retains its origins. Forensics bypass the narrative.
When an engineer prepares to leave employment and launch a startup, a common impulse involves cleansing the Git history. The engineer squashes commits, rebases branches, or generates a brand-new repository containing a single initial commit carrying modern timestamps.
Software builders often attempt to conceal corporate overlap through interactive git rebasing and forced pushes. This practice creates severe evidentiary liabilities. Modern forensic auditors do not merely read the active main branch.
They run low-level analyses on the Git packfiles, unreferenced dangling commits, and the local reflog. For centuries, maritime logbooks recorded ship coordinates at solar noon because navigation laws treated unrecorded movements as reckless abandonment of cargo. Modern version control functions under that identical discipline: every recorded snapshot establishes a permanent physical presence in time.
Scrubbed Histories and Cryptographic Verification
When Git rewrites history, it creates new commit hashes while abandoning the old commit objects in the repository’s internal object store. Unless the author executes an aggressive garbage collection sequence, those dangling objects persist on disk. An auditor runs git fsck –lost-found to uncover every abandoned commit, exposing the original author timestamps, commit messages, and intermediate code changes that the developer attempted to hide.
The desk cannot fully defend whether squash-merging a dirty Git tree into a single clean commit prior to public repository publication legally extinguishes the chain of title for components drafted during active employment when the reflog has been expunged. Under this uncertainty, a prudent founder commissions an independent clean-room rewrite rather than betting an enterprise valuation on an expunged commit tree.
A rebased repository preserves its original author dates in the reflog until the garbage collector runs.
Cryptographic commit signatures introduce an additional layer of verification. When developers sign commits using GPG or SSH keys, the signature cryptographically seals the author name, committer name, timestamp, and tree hash. If an engineer uses a signing key generated on an employer laptop, that cryptographic signature links the commit directly to the corporate environment.
Stripping signatures during history rewrites draws immediate suspicion from technical diligence teams, who interpret altered commit histories as evidence of spoliation.
The Presumption of Concealed Labor
Institutional investigations treat missing chronological links as intentional evidentiary spoliation. The corporate registry kept the count. Metadata survives local deletion.
Proof follows the commit hash. When diligence teams encounter an application whose repository begins with a massive, fifty-thousand-line initial commit dated three days after an engineer resigned, they demand the preceding development history.
- Audit trail inspection reveals local timezone discrepancies across committer records, signaling attempts to disguise daytime coding during remote work hours.
- Cross reference analysis links public cryptographic keys against corporate pull request approvals, establishing identical machine identities for supposedly segregated projects.
- Dependency tree extraction discovers proprietary utility libraries embedded inside private branches, demonstrating direct transfer of corporate trade secrets.
Auditors request local machine backups, staging servers, and remote personal forks to locate where that code existed before the squashed commit occurred. If the founder cannot supply the authentic, incremental Git history demonstrating development outside corporate hours, corporate counsel argues that the initial architecture occurred during employment. Clean version history shows daylight between corporate employment records and outside software creation.
Release
Separation agreements offer an opportunity to extinguish lurking title disputes. Silence bills at settlement. The contract asserts possession.
When an engineer resigns, human resources presents a standard severance agreement or termination certification. These forms confirm that the employee returned all corporate property, wiped corporate data from personal devices, and disclosed all inventions produced during employment.
Technical professionals frequently sign these documents without securing reciprocal releases. A standard employee release operates unidirectionally: the employee waives all claims against the company, while the company preserves its rights to enforce intellectual property assignments and restrictive covenants. Paper fixes rights.
Severance Language and Clean Handover Terms
Standard departure documents contain broad general waivers designed to protect departing personnel from historical claims. These waivers do not release claims of ownership over inventions created during employment. If an engineer walks out with proprietary architecture, signing a standard termination certification confirms that the individual holds no company property.
If the company later discovers the code in a venture-backed startup, that certification becomes proof of bad faith and misrepresentation.
To eliminate repository risk, the departing founder must negotiate a specific, affirmative intellectual property assignment release. This document must explicitly name the repository, identify the project by its unique Git commit hash or external identifier, and confirm that the corporation asserts no claim of ownership or trade secret protection over that specific codebase. Executive officers must sign the instrument; mid-level engineering managers lack legal authority to waive corporate intellectual property rights.
Residual Exposure in Follow On Diligence
Venture investors and acquiring corporations conduct forensic repository examinations before finalizing equity investments. When auditors discover that a company’s foundational codebase traces back to an era when a founder worked as a salaried engineer elsewhere, the investment halts until the title clears. The cost arrives not in legal fees alone, but in delayed market entry, re-negotiated term sheets, and punitive escrow allocations.
Founders who neglect to audit their own repositories discover their exposure during Series A or Series B transactions, when diligence is thorough and counterparty leverage is minimal. At that stage, buying out an old employer’s claim requires issuing equity or paying substantial cash settlements. Auditors continue to disagree whether an unpushed local commit created on personal hardware during an unpaid weekend becomes company property the moment its author reads employer documentation to solve an architecture puzzle.