Effort-aware review-budget ranking from prior security fixes and change entropy (replicated per line reviewed on openssl)

オープン
  • 何か問題がありますか？
#7,834 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
python
領域
data, security

調査の方向性

Read the EA-H1..H5 results in temporal-crucible#53, especially docs/HYPOTHESES.md and docs/ea_openssl.md, then inspect the prerequisites in gitgalaxy#7818. The issue describes a ranked review list with prior fix counts, change entropy, line counts, and a line budget, but leaves the fix-history input and scoring details open pending replication. Done means those decisions are resolved and the feature can report a review ranking with its budget cutoff.

索引モデルが issue の本文から書いたものです。

説明

enhancement

What this asks for. An effort-aware "review budget" ranking that orders a repository's files for review by prior security fixes (file recidivism) and change entropy (file_data.change_entropy, HCM1_LD_30), rather than by any per-file structural score. No score weight yet: a further unseen-repo replication is registered first, per temporal-crucible's decision rule.

The evidence (temporal-crucible, pre-registered EA-H1..H5, scored on openssl, which was unseen):

  • Setup: 110 quarterly snapshots, 252 security fixes on master.
  • Measure: recall of the files fixed in the next 180 days when reviewing 20% of the snapshot's C lines, in the ranking's order.
  • Bar: a claim had to beat both size baselines at α = 0.002.
ranking recall@20% of lines
prior security fixes 0.451 (supported)
change entropy 0.343 (supported)
churn 0.321 (not supported)
recency 0.304 (not supported)
largest files first 0.271
smallest files first 0.128

Under plain AUC, size still ranks first (0.816 pooled). So this is specifically a "per line read" result. It's consistent with RW-H2 (prior fixes beat LOC at recall@20%LOC on curl and nDPI).

Prerequisites, already in gitgalaxy#7818:

  • As-of-HEAD history mode.
  • The persisted change_entropy column.
  • The UTF-8 fix to the git-log reader. Without it, one non-UTF-8 byte silently truncated history; the gate caught it on openssl 2014.

Suggested shape:

  • Brief / report: a ranked "review first" list, with each file's prior fix count, change entropy and line count, plus a budget cut-off (e.g. 20% of lines).
  • Where the data comes from: prior fixes need a per-repo fix history, so this is an opt-in input (a fix-commit list such as temporal-crucible's events/*.json, or a commit-message rule). Change entropy needs only the scan.
  • Status: descriptive until the replication lands.

Results and code: squid-protocol/temporal-crucible#53 (docs/HYPOTHESES.md EA sections, docs/ea_openssl.md).

🤖 Generated with Claude Code

主要言語
Python
スター
57
フォーク
11
平均マージ
1時間 35分
マージ済み PR（30日）
975

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

squid-protocol/gitgalaxy のほかの issue

squid-protocol/gitgalaxy の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。