Effort-aware review-budget ranking from prior security fixes and change entropy (replicated per line reviewed on openssl)

Aperta
  • Qualcosa non va?
#7,834 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
data, security

Direzione di ricerca

Read the EA-H1..H5 results in temporal-crucible#53, especially docs/HYPOTHESES.md and docs/ea_openssl.md, then inspect the prerequisites in gitgalaxy#7818. The issue describes a ranked review list with prior fix counts, change entropy, line counts, and a line budget, but leaves the fix-history input and scoring details open pending replication. Done means those decisions are resolved and the feature can report a review ranking with its budget cutoff.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

What this asks for. An effort-aware "review budget" ranking that orders a repository's files for review by prior security fixes (file recidivism) and change entropy (file_data.change_entropy, HCM1_LD_30), rather than by any per-file structural score. No score weight yet: a further unseen-repo replication is registered first, per temporal-crucible's decision rule.

The evidence (temporal-crucible, pre-registered EA-H1..H5, scored on openssl, which was unseen):

  • Setup: 110 quarterly snapshots, 252 security fixes on master.
  • Measure: recall of the files fixed in the next 180 days when reviewing 20% of the snapshot's C lines, in the ranking's order.
  • Bar: a claim had to beat both size baselines at α = 0.002.
ranking recall@20% of lines
prior security fixes 0.451 (supported)
change entropy 0.343 (supported)
churn 0.321 (not supported)
recency 0.304 (not supported)
largest files first 0.271
smallest files first 0.128

Under plain AUC, size still ranks first (0.816 pooled). So this is specifically a "per line read" result. It's consistent with RW-H2 (prior fixes beat LOC at recall@20%LOC on curl and nDPI).

Prerequisites, already in gitgalaxy#7818:

  • As-of-HEAD history mode.
  • The persisted change_entropy column.
  • The UTF-8 fix to the git-log reader. Without it, one non-UTF-8 byte silently truncated history; the gate caught it on openssl 2014.

Suggested shape:

  • Brief / report: a ranked "review first" list, with each file's prior fix count, change entropy and line count, plus a budget cut-off (e.g. 20% of lines).
  • Where the data comes from: prior fixes need a per-repo fix history, so this is an opt-in input (a fix-commit list such as temporal-crucible's events/*.json, or a commit-message rule). Change entropy needs only the scan.
  • Status: descriptive until the replication lands.

Results and code: squid-protocol/temporal-crucible#53 (docs/HYPOTHESES.md EA sections, docs/ea_openssl.md).

🤖 Generated with Claude Code

Lingua principale
Python
Stelle
57
Fork
11
Merge medio
1h 35m
PR unite (30g)
975

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di squid-protocol/gitgalaxy

Tutte le issue di squid-protocol/gitgalaxy

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.