CITATION.cff

cff-version: 1.2.0
message: "If you use conemass or the concentration-of-reach metric (working name ORACLE in the registered studies), please cite it as below."
title: "conemass: ranking dependency graphs by concentration of reach"
authors:
  - family-names: "Brink"
    given-names: "Chris"
date-released: 2026-09-02
doi: "10.5281/zenodo.22261985"
url: "https://github.com/thefalsework/conemass"
repository-code: "https://github.com/thefalsework/conemass"
license: Apache-2.0
keywords:
  - concentration of reach
  - conemass metric
  - ORACLE metric (working name)
  - harmonic cone-membership mass
  - dependency graph
  - supply-chain security
  - software criticality
abstract: >-
  conemass ranks the packages of a dependency graph by conemass(x) =
  sum over packages u whose truncated dependency cone contains x of
  1/|cone(u)| — harmonic cone-membership mass, "concentration of
  reach." Computed on the last Debian release before the xz backdoor
  was disclosed, the metric ranked liblzma5 #8 of 63,436 packages
  (against #173 by dependent count), twenty-one months before
  disclosure. On the 2022 crates.io snapshot it ranks unicode-ident
  #2 of 84,439 (six direct dependents). The functional was first
  derived and registered — under its working name ORACLE, which the
  frozen study records retain — on 2026-09-01 as the complete
  mechanism of a synthetic growth effect (thefalsework/papers,
  accretion-study/05-oracle.mjs); it was repurposed as a criticality
  signal and published with dated rankings on 2026-09-02, and renamed
  conemass throughout the public artifacts on 2026-09-05.
references:
  - type: article
    title: "The Critical-Projects List Contains Kubernetes and Misses zlib: Dependency concentration as a criticality signal"
    authors:
      - family-names: "Brink"
        given-names: "Chris"
    url: "https://github.com/thefalsework/conemass/blob/main/paper/quiet-criticality.md"
    year: 2026