Skip to content

review: give a finding an ORIGIN (pre-existing vs introduced-by <fix sha>) #333

Description

@pdbethke

Measured on 2026-09-12: of round three's 13 findings, 5 (38%) were created by round two's own fix commit, and those five were 3 high / 2 medium / 0 low — more severe than the 8 pre-existing ones.

I computed that by hand with git blame. It should not need a person.

corral_findings already carries file, line and commit_sha, so the origin is derivable from the record: blame the finding's site at the commit the round reviewed, and compare the authoring commit against the set of prior fix commits.

Why it matters beyond bookkeeping: corral's rule is that the auditor never builds, so the fix step has no seat, no grading and no record — and that is precisely where the churn lives. An origin field puts a number on it without handing the auditor a builder. It also makes the stopping rule enforceable: if a round's churn share exceeds the previous round's, stop fixing in batches.

Then the ratio is a GROUP BY on the public branch like everything else, and models rank gains a companion that grades fix batches rather than only model seats.

Evidence: docs/design/adversarial-review.md, "Is the loop converging?"

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions