Replication package for "Score provenance and commit timing"

Replication package for the manuscript “Score provenance and commit timing”. The package contains frozen analytical inputs, analysis scripts, aggregate outputs, tables and figures supporting the main manuscript and Supplementary Tables S1–S18. It implements 30 documented reproduction steps in Python 3.11.15, including paired NVD–CNA CVSS analyses, provider-composition and selection diagnostics, provider-level inference, restricted wild cluster bootstrap, and external threshold sensitivity analyses. The package includes author-created analytical inputs and aggregate outputs. Code is licensed under MIT. Author-created analytical data and aggregate outputs are released under CC BY 4.0. Third-party datasets remain subject to their original terms. The Liu et al. record-level source file is not redistributed because its redistribution licence could not be verified. See README.md, DATA_DICTIONARY.md, LICENSE-MIT.txt, LICENSE-DATA.txt and RESULTS_CROSSWALK_v17.csv.