Lineage timeline

The single most decisive fact in a lineage question is which repository existed first. This is why the timeline is rendered as a first-class part of every report.

The rules, in code

1. A target whose earliest commit predates the origin's cannot have been derived from it. Every origin-to-target explanation is ruled out, whatever the similarity scores say.
2. A target that appeared only after the origin matured is *permissive*, not evidentiary. Two unrelated projects started a year apart look identical, so this signal is capped and cannot carry a verdict alone.
3. A signal whose first occurrence predates the target's first commit is directional evidence. The reverse is not.

These rules run in Python, not in model prose. A model cannot argue its way past them.

Reading the timeline

Each commit marker is real: a SHA, a timestamp, an author and a message from the repository itself. Where a defect was introduced and later fixed is visible, because Bug DNA reads code at specific points in history rather than only at HEAD.