Effort-aware review-budget ranking from prior security fixes and change entropy (replicated per line reviewed on openssl)

Open
  • Is something wrong?
#7,834 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
data, security

Research direction

Read the EA-H1..H5 results in temporal-crucible#53, especially docs/HYPOTHESES.md and docs/ea_openssl.md, then inspect the prerequisites in gitgalaxy#7818. The issue describes a ranked review list with prior fix counts, change entropy, line counts, and a line budget, but leaves the fix-history input and scoring details open pending replication. Done means those decisions are resolved and the feature can report a review ranking with its budget cutoff.

Written by the indexing model from the issue text.

Description

enhancement

What this asks for. An effort-aware "review budget" ranking that orders a repository's files for review by prior security fixes (file recidivism) and change entropy (file_data.change_entropy, HCM1_LD_30), rather than by any per-file structural score. No score weight yet: a further unseen-repo replication is registered first, per temporal-crucible's decision rule.

The evidence (temporal-crucible, pre-registered EA-H1..H5, scored on openssl, which was unseen):

  • Setup: 110 quarterly snapshots, 252 security fixes on master.
  • Measure: recall of the files fixed in the next 180 days when reviewing 20% of the snapshot's C lines, in the ranking's order.
  • Bar: a claim had to beat both size baselines at α = 0.002.
ranking recall@20% of lines
prior security fixes 0.451 (supported)
change entropy 0.343 (supported)
churn 0.321 (not supported)
recency 0.304 (not supported)
largest files first 0.271
smallest files first 0.128

Under plain AUC, size still ranks first (0.816 pooled). So this is specifically a "per line read" result. It's consistent with RW-H2 (prior fixes beat LOC at recall@20%LOC on curl and nDPI).

Prerequisites, already in gitgalaxy#7818:

  • As-of-HEAD history mode.
  • The persisted change_entropy column.
  • The UTF-8 fix to the git-log reader. Without it, one non-UTF-8 byte silently truncated history; the gate caught it on openssl 2014.

Suggested shape:

  • Brief / report: a ranked "review first" list, with each file's prior fix count, change entropy and line count, plus a budget cut-off (e.g. 20% of lines).
  • Where the data comes from: prior fixes need a per-repo fix history, so this is an opt-in input (a fix-commit list such as temporal-crucible's events/*.json, or a commit-message rule). Change entropy needs only the scan.
  • Status: descriptive until the replication lands.

Results and code: squid-protocol/temporal-crucible#53 (docs/HYPOTHESES.md EA sections, docs/ea_openssl.md).

🤖 Generated with Claude Code

Dominant language
Python
Stars
57
Forks
11
Avg merge
1h 35m
Merged PRs (30d)
975

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from squid-protocol/gitgalaxy

All issues in squid-protocol/gitgalaxy

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.