cli-jaw 0.1.6 → 0.1.8

package/skills_ref/security-ownership-map/scripts/build_ownership_map.py

@@ -1,956 +0,0 @@
-#!/usr/bin/env python3
-"""Build a security ownership map from git history."""
-
-from __future__ import annotations
-
-import argparse
-import csv
-import datetime as dt
-import fnmatch
-import json
-import math
-import os
-import re
-import subprocess
-import sys
-from collections import defaultdict
-from pathlib import Path
-from typing import Iterable
-
-DEFAULT_SENSITIVE_RULES: list[tuple[str, str, float]] = [
-    ("**/auth/**", "auth", 1.0),
-    ("**/oauth/**", "auth", 1.0),
-    ("**/rbac/**", "auth", 1.0),
-    ("**/session/**", "auth", 1.0),
-    ("**/token/**", "auth", 1.0),
-    ("**/crypto/**", "crypto", 1.0),
-    ("**/tls/**", "crypto", 1.0),
-    ("**/ssl/**", "crypto", 1.0),
-    ("**/secrets/**", "secrets", 1.0),
-    ("**/keys/**", "secrets", 1.0),
-    ("**/*.pem", "secrets", 1.0),
-    ("**/*.key", "secrets", 1.0),
-    ("**/*.p12", "secrets", 1.0),
-    ("**/*.pfx", "secrets", 1.0),
-    ("**/iam/**", "auth", 1.0),
-    ("**/sso/**", "auth", 1.0),
-]
-
-DEFAULT_AUTHOR_EXCLUDE_REGEXES = [
-    "dependabot",
-]
-
-DEFAULT_COCHANGE_EXCLUDES = [
-    "**/Cargo.lock",
-    "**/Cargo.toml",
-    "**/package-lock.json",
-    "**/yarn.lock",
-    "**/pnpm-lock.yaml",
-    "**/go.sum",
-    "**/go.mod",
-    "**/Gemfile.lock",
-    "**/Pipfile.lock",
-    "**/poetry.lock",
-    "**/composer.lock",
-    "**/.github/**",
-    "**/.gitignore",
-    "**/.gitattributes",
-    "**/.gitmodules",
-    "**/.editorconfig",
-    "**/.vscode/**",
-    "**/.idea/**",
-]
-
-
-def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(
-        description="Build ownership graphs and security ownership summaries from git history."
-    )
-    parser.add_argument("--repo", default=".", help="Path to the git repo (default: .)")
-    parser.add_argument(
-        "--out",
-        default="ownership-map-out",
-        help="Output directory for graph artifacts",
-    )
-    parser.add_argument("--since", default=None, help="Limit git log to commits since date")
-    parser.add_argument("--until", default=None, help="Limit git log to commits until date")
-    parser.add_argument(
-        "--identity",
-        choices=("author", "committer"),
-        default="author",
-        help="Identity to attribute touches to",
-    )
-    parser.add_argument(
-        "--date-field",
-        choices=("author", "committer"),
-        default="author",
-        help="Date field to use for recency and bucketing",
-    )
-    parser.add_argument(
-        "--include-merges",
-        action="store_true",
-        help="Include merge commits (excluded by default)",
-    )
-    parser.add_argument(
-        "--half-life-days",
-        type=float,
-        default=180.0,
-        help="Half life for recency weighting",
-    )
-    parser.add_argument(
-        "--sensitive-config",
-        default=None,
-        help="CSV file with pattern,tag,weight for sensitive paths",
-    )
-    parser.add_argument(
-        "--owner-threshold",
-        type=float,
-        default=0.5,
-        help="Share threshold for hidden owner detection",
-    )
-    parser.add_argument(
-        "--bus-factor-threshold",
-        type=int,
-        default=1,
-        help="Bus factor threshold for hotspots",
-    )
-    parser.add_argument(
-        "--stale-days",
-        type=int,
-        default=365,
-        help="Days since last touch to consider stale",
-    )
-    parser.add_argument(
-        "--min-touches",
-        type=int,
-        default=1,
-        help="Minimum touches to keep an edge",
-    )
-    parser.add_argument(
-        "--emit-commits",
-        action="store_true",
-        help="Write commit list to commits.jsonl",
-    )
-    parser.add_argument(
-        "--author-exclude-regex",
-        action="append",
-        default=[],
-        help="Regex for author name/email to exclude (repeatable)",
-    )
-    parser.add_argument(
-        "--no-default-author-excludes",
-        action="store_true",
-        help="Disable default author excludes (dependabot)",
-    )
-    parser.add_argument(
-        "--no-cochange",
-        action="store_true",
-        help="Disable co-change graph output",
-    )
-    parser.add_argument(
-        "--cochange-max-files",
-        type=int,
-        default=50,
-        help="Ignore commits touching more than this many files for co-change graph",
-    )
-    parser.add_argument(
-        "--cochange-min-count",
-        type=int,
-        default=2,
-        help="Minimum co-change count to keep file-file edge",
-    )
-    parser.add_argument(
-        "--cochange-min-jaccard",
-        type=float,
-        default=0.05,
-        help="Minimum Jaccard similarity to keep file-file edge",
-    )
-    parser.add_argument(
-        "--cochange-exclude",
-        action="append",
-        default=[],
-        help="Glob to exclude from co-change graph (repeatable)",
-    )
-    parser.add_argument(
-        "--no-default-cochange-excludes",
-        action="store_true",
-        help="Disable default co-change excludes (lockfiles, .github, editor config)",
-    )
-    parser.add_argument(
-        "--no-communities",
-        dest="communities",
-        action="store_false",
-        help="Disable community detection (enabled by default, requires networkx)",
-    )
-    parser.add_argument(
-        "--graphml",
-        action="store_true",
-        help="Emit ownership.graphml (requires networkx)",
-    )
-    parser.add_argument(
-        "--max-community-files",
-        type=int,
-        default=50,
-        help="Max files listed per community",
-    )
-    parser.add_argument(
-        "--community-top-owners",
-        type=int,
-        default=5,
-        help="Top maintainers saved per community",
-    )
-    parser.set_defaults(communities=True)
-    return parser.parse_args()
-
-
-def load_sensitive_rules(path: str | None) -> list[tuple[str, str, float]]:
-    if not path:
-        return list(DEFAULT_SENSITIVE_RULES)
-    rules: list[tuple[str, str, float]] = []
-    with open(path, "r", encoding="utf-8") as handle:
-        for raw in handle:
-            line = raw.strip()
-            if not line or line.startswith("#"):
-                continue
-            parts = [part.strip() for part in line.split(",")]
-            if not parts:
-                continue
-            pattern = parts[0]
-            tag = parts[1] if len(parts) > 1 and parts[1] else "sensitive"
-            weight = float(parts[2]) if len(parts) > 2 and parts[2] else 1.0
-            rules.append((pattern, tag, weight))
-    return rules
-
-
-def parse_date(value: str) -> dt.datetime:
-    parsed = dt.datetime.fromisoformat(value)
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=dt.timezone.utc)
-    return parsed
-
-
-def offset_minutes(timestamp: dt.datetime) -> int | None:
-    offset = timestamp.utcoffset()
-    if offset is None:
-        return None
-    return int(offset.total_seconds() / 60)
-
-
-def format_offset(minutes: int) -> str:
-    sign = "+" if minutes >= 0 else "-"
-    minutes = abs(minutes)
-    return f"{sign}{minutes // 60:02d}:{minutes % 60:02d}"
-
-
-def recency_weighted(now: dt.datetime, when: dt.datetime, half_life_days: float) -> float:
-    if half_life_days <= 0:
-        return 1.0
-    age_days = max(0.0, (now - when).total_seconds() / 86400.0)
-    return math.exp(-math.log(2) * age_days / half_life_days)
-
-
-def match_sensitive(path: str, rules: Iterable[tuple[str, str, float]]) -> dict[str, float]:
-    tags: dict[str, float] = defaultdict(float)
-    posix = path.replace("\\", "/")
-    for pattern, tag, weight in rules:
-        patterns = [pattern]
-        if pattern.startswith("**/"):
-            patterns.append(pattern[3:])
-        for candidate in patterns:
-            if fnmatch.fnmatchcase(posix, candidate):
-                tags[tag] += weight
-                break
-    return tags
-
-
-def matches_glob(path: str, pattern: str) -> bool:
-    posix = path.replace("\\", "/")
-    patterns = [pattern]
-    if pattern.startswith("**/"):
-        patterns.append(pattern[3:])
-    return any(fnmatch.fnmatchcase(posix, candidate) for candidate in patterns)
-
-
-def is_excluded(path: str, patterns: Iterable[str]) -> bool:
-    return any(matches_glob(path, pattern) for pattern in patterns)
-
-
-def author_excluded(name: str, email: str, patterns: Iterable[re.Pattern[str]]) -> bool:
-    if not patterns:
-        return False
-    haystack = f"{name} {email}".strip()
-    return any(pattern.search(haystack) for pattern in patterns)
-
-
-def compute_community_owners(
-    community_files: Iterable[str],
-    people: dict[str, dict[str, object]],
-    file_people_touches: dict[str, dict[str, int]],
-    file_people_recency: dict[str, dict[str, float]],
-    file_people_sensitive: dict[str, dict[str, float]],
-    top_n: int,
-) -> dict[str, object]:
-    touches_by_person: dict[str, int] = defaultdict(int)
-    recency_by_person: dict[str, float] = defaultdict(float)
-    sensitive_by_person: dict[str, float] = defaultdict(float)
-
-    for path in community_files:
-        for person, touches in file_people_touches.get(path, {}).items():
-            touches_by_person[person] += touches
-        for person, recency in file_people_recency.get(path, {}).items():
-            recency_by_person[person] += recency
-        for person, weight in file_people_sensitive.get(path, {}).items():
-            sensitive_by_person[person] += weight
-
-    total_touches = sum(touches_by_person.values())
-    total_recency = sum(recency_by_person.values())
-    total_sensitive = sum(sensitive_by_person.values())
-
-    ranked = sorted(touches_by_person.items(), key=lambda item: item[1], reverse=True)
-    owners = []
-    for person_id, touches in ranked[:top_n]:
-        recency = recency_by_person.get(person_id, 0.0)
-        sensitive = sensitive_by_person.get(person_id, 0.0)
-        owners.append(
-            {
-                "person_id": person_id,
-                "name": people.get(person_id, {}).get("name", person_id),
-                "touches": touches,
-                "touch_share": round(touches / total_touches, 4) if total_touches else 0.0,
-                "recency_share": round(recency / total_recency, 4) if total_recency else 0.0,
-                "sensitive_share": round(sensitive / total_sensitive, 4)
-                if total_sensitive
-                else 0.0,
-                "primary_tz_offset": people.get(person_id, {}).get("primary_tz_offset", ""),
-            }
-        )
-
-    return {
-        "bus_factor": len(touches_by_person),
-        "owner_count": len(touches_by_person),
-        "totals": {
-            "touches": total_touches,
-            "recency_weight": round(total_recency, 6),
-            "sensitive_weight": round(total_sensitive, 2),
-        },
-        "top_maintainers": owners,
-    }
-
-
-def run_git_log(
-    repo: str, since: str | None, until: str | None, include_merges: bool
-) -> Iterable[list[str]]:
-    cmd = [
-        "git",
-        "-C",
-        repo,
-        "log",
-        "--name-only",
-        "--no-renames",
-        "--date=iso-strict",
-        "--format=---%n%H%n%P%n%an%n%ae%n%ad%n%cn%n%ce%n%cd",
-    ]
-    if not include_merges:
-        cmd.append("--no-merges")
-    if since:
-        cmd.extend(["--since", since])
-    if until:
-        cmd.extend(["--until", until])
-
-    proc = subprocess.Popen(
-        cmd,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        text=True,
-    )
-    assert proc.stdout is not None
-
-    batch: list[str] = []
-    for line in proc.stdout:
-        batch.append(line.rstrip("\n"))
-        if line.rstrip("\n") == "---" and len(batch) > 1:
-            yield batch[:-1]
-            batch = ["---"]
-
-    if batch:
-        yield batch
-
-    stderr = proc.stderr.read() if proc.stderr else ""
-    exit_code = proc.wait()
-    if exit_code != 0:
-        raise RuntimeError(stderr.strip() or "git log failed")
-
-
-def iter_commits(lines: Iterable[list[str]]) -> Iterable[tuple[dict[str, object], list[str]]]:
-    for chunk in lines:
-        if not chunk or chunk[0] != "---":
-            continue
-        header = chunk[1:9]
-        if len(header) < 8:
-            continue
-        parents = [entry for entry in header[1].split(" ") if entry]
-        commit = {
-            "hash": header[0],
-            "parents": parents,
-            "is_merge": len(parents) > 1,
-            "author_name": header[2],
-            "author_email": header[3],
-            "author_date": header[4],
-            "committer_name": header[5],
-            "committer_email": header[6],
-            "committer_date": header[7],
-        }
-        files = [line for line in chunk[9:] if line.strip()]
-        yield commit, files
-
-
-def ensure_out_dir(path: str) -> Path:
-    out_dir = Path(path)
-    out_dir.mkdir(parents=True, exist_ok=True)
-    return out_dir
-
-
-def write_csv(path: Path, header: list[str], rows: Iterable[list[str]]) -> None:
-    with path.open("w", encoding="utf-8", newline="") as handle:
-        writer = csv.writer(handle)
-        writer.writerow(header)
-        for row in rows:
-            writer.writerow(row)
-
-
-def build_ownership_map(args: argparse.Namespace) -> Path:
-    now = dt.datetime.now(dt.timezone.utc)
-    rules = load_sensitive_rules(args.sensitive_config)
-    out_dir = ensure_out_dir(args.out)
-
-    people: dict[str, dict[str, object]] = {}
-    files: dict[str, dict[str, object]] = {}
-    edges: dict[tuple[str, str], dict[str, object]] = {}
-    file_people_touches: dict[str, dict[str, int]] = defaultdict(lambda: defaultdict(int))
-    file_people_recency: dict[str, dict[str, float]] = defaultdict(lambda: defaultdict(float))
-    file_people_sensitive: dict[str, dict[str, float]] = defaultdict(lambda: defaultdict(float))
-    tag_totals: dict[str, float] = defaultdict(float)
-    tag_person_totals: dict[str, dict[str, float]] = defaultdict(lambda: defaultdict(float))
-    person_timezone_counts: dict[str, dict[int, int]] = defaultdict(lambda: defaultdict(int))
-    cochange_counts: dict[tuple[str, str], int] = defaultdict(int)
-    cochange_file_commits: dict[str, int] = defaultdict(int)
-    cochange_commits_used = 0
-    cochange_commits_skipped = 0
-    cochange_commits_filtered = 0
-    cochange_files_excluded = 0
-
-    commits_path = out_dir / "commits.jsonl"
-    commit_handle = None
-    if args.emit_commits:
-        commit_handle = commits_path.open("w", encoding="utf-8")
-
-    total_commits_seen = 0
-    total_commits_included = 0
-    commits_excluded_identities = 0
-    commits_excluded_merges = 0
-    total_edges = 0
-
-    author_exclude_regexes = []
-    if not args.no_default_author_excludes:
-        author_exclude_regexes.extend(DEFAULT_AUTHOR_EXCLUDE_REGEXES)
-    author_exclude_regexes.extend(args.author_exclude_regex)
-    author_exclude_patterns = [
-        re.compile(pattern, re.IGNORECASE) for pattern in author_exclude_regexes
-    ]
-
-    cochange_excludes = []
-    if not args.no_default_cochange_excludes:
-        cochange_excludes.extend(DEFAULT_COCHANGE_EXCLUDES)
-    cochange_excludes.extend(args.cochange_exclude)
-
-    log_lines = run_git_log(args.repo, args.since, args.until, args.include_merges)
-    for commit, touched_files in iter_commits(log_lines):
-        total_commits_seen += 1
-
-        if commit.get("is_merge") and not args.include_merges:
-            commits_excluded_merges += 1
-            continue
-
-        identity_name = commit.get(f"{args.identity}_name", "")
-        identity_email = commit.get(f"{args.identity}_email", "")
-        if author_excluded(
-            identity_name,
-            identity_email,
-            author_exclude_patterns,
-        ):
-            commits_excluded_identities += 1
-            continue
-
-        if not touched_files:
-            continue
-
-        total_commits_included += 1
-        if commit_handle:
-            commit_handle.write(json.dumps({**commit, "files": touched_files}) + "\n")
-
-        identity_name = commit.get(f"{args.identity}_name", "")
-        identity_email = commit.get(f"{args.identity}_email", "") or identity_name
-        commit_date = parse_date(commit.get(f"{args.date_field}_date", ""))
-        recency = recency_weighted(now, commit_date, args.half_life_days)
-        tz_minutes = offset_minutes(commit_date)
-        if tz_minutes is not None:
-            person_timezone_counts[identity_email][tz_minutes] += 1
-        unique_files = sorted(set(touched_files))
-        if not args.no_cochange and len(unique_files) > 1:
-            if len(unique_files) > args.cochange_max_files:
-                cochange_commits_skipped += 1
-            else:
-                filtered_files = [
-                    path for path in unique_files if not is_excluded(path, cochange_excludes)
-                ]
-                excluded = len(unique_files) - len(filtered_files)
-                if excluded:
-                    cochange_files_excluded += excluded
-                if len(filtered_files) < 2:
-                    cochange_commits_filtered += 1
-                if filtered_files:
-                    for path in filtered_files:
-                        cochange_file_commits[path] += 1
-                if len(filtered_files) >= 2:
-                    cochange_commits_used += 1
-                    for idx, path in enumerate(filtered_files):
-                        for other in filtered_files[idx + 1 :]:
-                            cochange_counts[(path, other)] += 1
-
-        person = people.setdefault(
-            identity_email,
-            {
-                "name": identity_name,
-                "email": identity_email,
-                "first_seen": commit_date,
-                "last_seen": commit_date,
-                "commit_count": 0,
-                "touches": 0,
-                "sensitive_touches": 0.0,
-            },
-        )
-        person["commit_count"] = int(person["commit_count"]) + 1
-        person["first_seen"] = min(person["first_seen"], commit_date)
-        person["last_seen"] = max(person["last_seen"], commit_date)
-
-        for path in touched_files:
-            file_entry = files.setdefault(
-                path,
-                {
-                    "path": path,
-                    "first_seen": commit_date,
-                    "last_seen": commit_date,
-                    "commit_count": 0,
-                    "touches": 0,
-                    "authors": set(),
-                    "sensitive_tags": {},
-                },
-            )
-            file_entry["commit_count"] = int(file_entry["commit_count"]) + 1
-            file_entry["first_seen"] = min(file_entry["first_seen"], commit_date)
-            file_entry["last_seen"] = max(file_entry["last_seen"], commit_date)
-            file_entry["touches"] = int(file_entry["touches"]) + 1
-            file_entry["authors"].add(identity_email)
-
-            edge = edges.setdefault(
-                (identity_email, path),
-                {
-                    "touches": 0,
-                    "first_seen": commit_date,
-                    "last_seen": commit_date,
-                    "recency_weight": 0.0,
-                    "sensitive_weight": 0.0,
-                },
-            )
-            edge["touches"] = int(edge["touches"]) + 1
-            edge["first_seen"] = min(edge["first_seen"], commit_date)
-            edge["last_seen"] = max(edge["last_seen"], commit_date)
-            edge["recency_weight"] = float(edge["recency_weight"]) + recency
-
-            tags = match_sensitive(path, rules)
-            if tags:
-                file_entry["sensitive_tags"] = tags
-                sensitive_weight = sum(tags.values())
-                edge["sensitive_weight"] = float(edge["sensitive_weight"]) + sensitive_weight
-                person["sensitive_touches"] = float(person["sensitive_touches"]) + sensitive_weight
-                file_people_sensitive[path][identity_email] += sensitive_weight
-                for tag, weight in tags.items():
-                    tag_totals[tag] += weight
-                    tag_person_totals[tag][identity_email] += weight
-
-            person["touches"] = int(person["touches"]) + 1
-            file_people_touches[path][identity_email] += 1
-            file_people_recency[path][identity_email] += recency
-            total_edges += 1
-
-    if commit_handle:
-        commit_handle.close()
-
-    people_rows = []
-    for email, person in sorted(people.items()):
-        tz_counts = person_timezone_counts.get(email, {})
-        primary_tz_offset = ""
-        primary_tz_minutes = ""
-        timezone_offsets = ""
-        if tz_counts:
-            primary_tz_minutes_value = max(tz_counts.items(), key=lambda item: (item[1], item[0]))[
-                0
-            ]
-            primary_tz_offset = format_offset(primary_tz_minutes_value)
-            primary_tz_minutes = str(primary_tz_minutes_value)
-            timezone_offsets = ";".join(
-                f"{format_offset(minutes)}:{count}"
-                for minutes, count in sorted(tz_counts.items(), key=lambda item: item[0])
-            )
-            person["primary_tz_offset"] = primary_tz_offset
-        people_rows.append(
-            [
-                email,
-                str(person["name"]),
-                email,
-                person["first_seen"].isoformat(),
-                person["last_seen"].isoformat(),
-                str(person["commit_count"]),
-                str(person["touches"]),
-                f"{person['sensitive_touches']:.2f}",
-                primary_tz_offset,
-                primary_tz_minutes,
-                timezone_offsets,
-            ]
-        )
-
-    file_rows = []
-    for path, file_entry in sorted(files.items()):
-        authors = file_entry["authors"]
-        bus_factor = len(authors)
-        tags = file_entry["sensitive_tags"]
-        tag_list = ";".join(sorted(tags.keys()))
-        sensitivity_score = sum(tags.values()) if tags else 0.0
-        file_rows.append(
-            [
-                path,
-                path,
-                file_entry["first_seen"].isoformat(),
-                file_entry["last_seen"].isoformat(),
-                str(file_entry["commit_count"]),
-                str(file_entry["touches"]),
-                str(bus_factor),
-                f"{sensitivity_score:.2f}",
-                tag_list,
-            ]
-        )
-
-    edge_rows = []
-    for (email, path), edge in edges.items():
-        if int(edge["touches"]) < args.min_touches:
-            continue
-        edge_rows.append(
-            [
-                email,
-                path,
-                str(edge["touches"]),
-                f"{edge['recency_weight']:.6f}",
-                edge["first_seen"].isoformat(),
-                edge["last_seen"].isoformat(),
-                f"{edge['sensitive_weight']:.2f}",
-            ]
-        )
-
-    cochange_rows: list[list[str]] = []
-    if not args.no_cochange:
-        for (file_a, file_b), count in cochange_counts.items():
-            if count < args.cochange_min_count:
-                continue
-            commits_a = cochange_file_commits.get(file_a, 0)
-            commits_b = cochange_file_commits.get(file_b, 0)
-            denom = commits_a + commits_b - count
-            if denom <= 0:
-                continue
-            jaccard = count / denom
-            if jaccard < args.cochange_min_jaccard:
-                continue
-            cochange_rows.append([file_a, file_b, str(count), f"{jaccard:.6f}"])
-
-    write_csv(
-        out_dir / "people.csv",
-        [
-            "person_id",
-            "name",
-            "email",
-            "first_seen",
-            "last_seen",
-            "commit_count",
-            "touches",
-            "sensitive_touches",
-            "primary_tz_offset",
-            "primary_tz_minutes",
-            "timezone_offsets",
-        ],
-        people_rows,
-    )
-    write_csv(
-        out_dir / "files.csv",
-        [
-            "file_id",
-            "path",
-            "first_seen",
-            "last_seen",
-            "commit_count",
-            "touches",
-            "bus_factor",
-            "sensitivity_score",
-            "sensitivity_tags",
-        ],
-        file_rows,
-    )
-    write_csv(
-        out_dir / "edges.csv",
-        [
-            "person_id",
-            "file_id",
-            "touches",
-            "recency_weight",
-            "first_seen",
-            "last_seen",
-            "sensitive_weight",
-        ],
-        edge_rows,
-    )
-    if not args.no_cochange:
-        write_csv(
-            out_dir / "cochange_edges.csv",
-            [
-                "file_a",
-                "file_b",
-                "cochange_count",
-                "jaccard",
-            ],
-            cochange_rows,
-        )
-
-    orphaned_sensitive_code = []
-    bus_factor_hotspots = []
-    for path, file_entry in files.items():
-        tags = file_entry["sensitive_tags"]
-        if not tags:
-            continue
-        bus_factor = len(file_entry["authors"])
-        last_seen = file_entry["last_seen"]
-        age_days = (now - last_seen).days
-        top_owner = None
-        if path in file_people_touches:
-            top_owner = max(file_people_touches[path].items(), key=lambda item: item[1])[0]
-        hotspot = {
-            "path": path,
-            "bus_factor": bus_factor,
-            "last_touch": last_seen.isoformat(),
-            "sensitivity_tags": sorted(tags.keys()),
-            "top_owner": top_owner,
-        }
-        if bus_factor <= args.bus_factor_threshold:
-            bus_factor_hotspots.append(hotspot)
-            if age_days >= args.stale_days:
-                orphaned_sensitive_code.append(
-                    {
-                        **hotspot,
-                        "last_security_touch": last_seen.isoformat(),
-                    }
-                )
-
-    hidden_owners = []
-    for tag, total in tag_totals.items():
-        if total <= 0:
-            continue
-        person_totals = tag_person_totals[tag]
-        if not person_totals:
-            continue
-        top_email, top_value = max(person_totals.items(), key=lambda item: item[1])
-        share = top_value / total
-        if share >= args.owner_threshold:
-            person_name = people.get(top_email, {}).get("name", top_email)
-            hidden_owners.append(
-                {
-                    "person": top_email,
-                    "name": person_name,
-                    "controls": f"{share * 100:.0f}% of {tag} code",
-                    "category": tag,
-                    "share": round(share, 4),
-                }
-            )
-
-    summary = {
-        "generated_at": now.isoformat(),
-        "repo": os.path.abspath(args.repo),
-        "parameters": {
-            "since": args.since,
-            "until": args.until,
-            "half_life_days": args.half_life_days,
-            "bus_factor_threshold": args.bus_factor_threshold,
-            "stale_days": args.stale_days,
-            "owner_threshold": args.owner_threshold,
-            "sensitive_config": args.sensitive_config,
-            "identity": args.identity,
-            "date_field": args.date_field,
-            "include_merges": args.include_merges,
-            "cochange_enabled": not args.no_cochange,
-            "cochange_max_files": args.cochange_max_files,
-            "cochange_min_count": args.cochange_min_count,
-            "cochange_min_jaccard": args.cochange_min_jaccard,
-            "cochange_default_excludes": not args.no_default_cochange_excludes,
-            "cochange_excludes": cochange_excludes,
-            "author_default_excludes": not args.no_default_author_excludes,
-            "author_exclude_regexes": author_exclude_regexes,
-            "community_top_owners": args.community_top_owners,
-        },
-        "orphaned_sensitive_code": orphaned_sensitive_code,
-        "hidden_owners": hidden_owners,
-        "bus_factor_hotspots": bus_factor_hotspots,
-        "stats": {
-            "commits": total_commits_included,
-            "commits_seen": total_commits_seen,
-            "commits_excluded_identities": commits_excluded_identities,
-            "commits_excluded_merges": commits_excluded_merges,
-            "edges": total_edges,
-            "people": len(people),
-            "files": len(files),
-            "cochange_pairs_total": len(cochange_counts) if not args.no_cochange else 0,
-            "cochange_edges": len(cochange_rows) if not args.no_cochange else 0,
-            "cochange_commits_used": cochange_commits_used if not args.no_cochange else 0,
-            "cochange_commits_skipped": cochange_commits_skipped if not args.no_cochange else 0,
-            "cochange_commits_filtered": cochange_commits_filtered if not args.no_cochange else 0,
-            "cochange_files_excluded": cochange_files_excluded if not args.no_cochange else 0,
-        },
-    }
-
-    with (out_dir / "summary.json").open("w", encoding="utf-8") as handle:
-        json.dump(summary, handle, indent=2)
-
-    if args.communities or args.graphml:
-        try:
-            import networkx as nx
-            from networkx.algorithms import bipartite
-        except ImportError:
-            raise RuntimeError(
-                "networkx is required for communities/graphml output. Install with: pip install networkx"
-            )
-        else:
-            graph_bipartite = None
-            graph_cochange = None
-            person_nodes = set()
-            file_nodes = set()
-            community_index: dict[str, int] = {}
-            community_metadata: list[dict[str, object]] = []
-
-            if args.graphml or (args.communities and (args.no_cochange or not cochange_rows)):
-                graph_bipartite = nx.Graph()
-                for (email, path), edge in edges.items():
-                    if int(edge["touches"]) < args.min_touches:
-                        continue
-                    graph_bipartite.add_node(email, node_type="person")
-                    graph_bipartite.add_node(path, node_type="file")
-                    graph_bipartite.add_edge(email, path, weight=float(edge["touches"]))
-                    person_nodes.add(email)
-                    file_nodes.add(path)
-
-            if not args.no_cochange and cochange_rows:
-                graph_cochange = nx.Graph()
-                for file_a, file_b, count, jaccard in cochange_rows:
-                    graph_cochange.add_edge(
-                        file_a,
-                        file_b,
-                        weight=float(jaccard),
-                        count=int(count),
-                    )
-
-            if args.communities:
-                communities_result = None
-                if graph_cochange is not None:
-                    communities_result = list(
-                        nx.algorithms.community.greedy_modularity_communities(
-                            graph_cochange, weight="weight"
-                        )
-                    )
-                elif graph_bipartite is not None and file_nodes:
-                    projected = bipartite.weighted_projected_graph(graph_bipartite, file_nodes)
-                    communities_result = list(
-                        nx.algorithms.community.greedy_modularity_communities(projected)
-                    )
-
-                if communities_result is not None:
-                    serialized = []
-                    for idx, community in enumerate(communities_result, start=1):
-                        files_list = sorted(community)
-                        owners = compute_community_owners(
-                            files_list,
-                            people,
-                            file_people_touches,
-                            file_people_recency,
-                            file_people_sensitive,
-                            args.community_top_owners,
-                        )
-                        for path in files_list:
-                            community_index[path] = idx
-                        entry = {
-                            "id": idx,
-                            "size": len(files_list),
-                            "files": files_list[: args.max_community_files],
-                            "maintainers": owners["top_maintainers"],
-                            "bus_factor": owners["bus_factor"],
-                            "owner_count": owners["owner_count"],
-                            "totals": owners["totals"],
-                        }
-                        serialized.append(entry)
-                        metadata = dict(entry)
-                        metadata.pop("files", None)
-                        community_metadata.append(metadata)
-                    with (out_dir / "communities.json").open("w", encoding="utf-8") as handle:
-                        json.dump(serialized, handle, indent=2)
-
-            if args.communities:
-                for node, community_id in community_index.items():
-                    if graph_cochange is not None and node in graph_cochange:
-                        graph_cochange.nodes[node]["community_id"] = community_id
-                    if graph_bipartite is not None and node in graph_bipartite:
-                        graph_bipartite.nodes[node]["community_id"] = community_id
-
-                graph_for_json = graph_cochange or graph_bipartite
-                if graph_for_json is not None:
-                    try:
-                        from networkx.readwrite import json_graph
-                    except ImportError:
-                        pass
-                    else:
-                        data = json_graph.node_link_data(graph_for_json, edges="edges")
-                        data.setdefault("graph", {})
-                        data["graph"]["community_maintainers"] = community_metadata
-                        json_name = (
-                            "cochange.graph.json"
-                            if graph_for_json is graph_cochange
-                            else "ownership.graph.json"
-                        )
-                        with (out_dir / json_name).open("w", encoding="utf-8") as handle:
-                            json.dump(data, handle, indent=2)
-
-            if args.graphml:
-                if graph_bipartite is not None:
-                    nx.write_graphml(graph_bipartite, out_dir / "ownership.graphml")
-                if graph_cochange is not None:
-                    nx.write_graphml(graph_cochange, out_dir / "cochange.graphml")
-
-    return out_dir
-
-
-def main() -> int:
-    args = parse_args()
-    try:
-        out_dir = build_ownership_map(args)
-    except RuntimeError as exc:
-        print(str(exc), file=sys.stderr)
-        return 1
-
-    print(f"Ownership map written to {out_dir}")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())