Effort-aware review-budget ranking from prior security fixes and change entropy (replicated per line reviewed on openssl)

Abierto
  • ¿Algo no está bien?
#7,834 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
data, security

Línea de trabajo

Read the EA-H1..H5 results in temporal-crucible#53, especially docs/HYPOTHESES.md and docs/ea_openssl.md, then inspect the prerequisites in gitgalaxy#7818. The issue describes a ranked review list with prior fix counts, change entropy, line counts, and a line budget, but leaves the fix-history input and scoring details open pending replication. Done means those decisions are resolved and the feature can report a review ranking with its budget cutoff.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

What this asks for. An effort-aware "review budget" ranking that orders a repository's files for review by prior security fixes (file recidivism) and change entropy (file_data.change_entropy, HCM1_LD_30), rather than by any per-file structural score. No score weight yet: a further unseen-repo replication is registered first, per temporal-crucible's decision rule.

The evidence (temporal-crucible, pre-registered EA-H1..H5, scored on openssl, which was unseen):

  • Setup: 110 quarterly snapshots, 252 security fixes on master.
  • Measure: recall of the files fixed in the next 180 days when reviewing 20% of the snapshot's C lines, in the ranking's order.
  • Bar: a claim had to beat both size baselines at α = 0.002.
ranking recall@20% of lines
prior security fixes 0.451 (supported)
change entropy 0.343 (supported)
churn 0.321 (not supported)
recency 0.304 (not supported)
largest files first 0.271
smallest files first 0.128

Under plain AUC, size still ranks first (0.816 pooled). So this is specifically a "per line read" result. It's consistent with RW-H2 (prior fixes beat LOC at recall@20%LOC on curl and nDPI).

Prerequisites, already in gitgalaxy#7818:

  • As-of-HEAD history mode.
  • The persisted change_entropy column.
  • The UTF-8 fix to the git-log reader. Without it, one non-UTF-8 byte silently truncated history; the gate caught it on openssl 2014.

Suggested shape:

  • Brief / report: a ranked "review first" list, with each file's prior fix count, change entropy and line count, plus a budget cut-off (e.g. 20% of lines).
  • Where the data comes from: prior fixes need a per-repo fix history, so this is an opt-in input (a fix-commit list such as temporal-crucible's events/*.json, or a commit-message rule). Change entropy needs only the scan.
  • Status: descriptive until the replication lands.

Results and code: squid-protocol/temporal-crucible#53 (docs/HYPOTHESES.md EA sections, docs/ea_openssl.md).

🤖 Generated with Claude Code

Lenguaje dominante
Python
Estrellas
57
Forks
11
Merge medio
1 h 35 min
PR fusionados (30 d)
975

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de squid-protocol/gitgalaxy

Todos los issues de squid-protocol/gitgalaxy

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.