The assignment is signed

Before you pay to own the source code, check whose work you're actually buying.

Take a company with a development-agency agreement and a signed IP assignment. In the repository, a contributor identity appears on work you cannot connect to that agency from the supplied records.

That gives the review somewhere specific to look.

Git history is useful here because it was not created for due diligence. It records changes and the identities attached to them. Those identities still need corroboration.

A pull request can lead to a Jira ticket. The ticket can place the work in an agency project. An old invoice may help connect that project to the engagement.

Each record gives you another connection to check.

Suppose the trail stops at the project. The work is visible, but the supplied records still do not establish the contributor's relationship to the agency.

The review now has a specific open item: connect that contribution to the agency covered by the agreement. Its scope is the work you traced and the records you received. Ownership remains a separate question.

The assignment is signed.

The link to that contribution is still missing.