stackvitals 0.1.0__py3-none-any.whl

mergescout/signals/evidence.py

@@ -0,0 +1,94 @@
+from datetime import datetime
+
+import duckdb
+
+from mergescout.signals.identity import build_people, build_pr_class
+from mergescout.signals.issues import build_issue_signals
+from mergescout.signals.labels import build_label_trust
+from mergescout.signals.repo_stats import build_repo_stats
+from mergescout.signals.rules import RULES, Rules
+from mergescout.signals.walls import build_walls
+
+EVIDENCE_VERSION = 1
+TABLES = ("people", "repo_stats", "issue_signals", "label_trust", "repo_walls", "candidates")
+
+
+def build_candidates(con: duckdb.DuckDBPyConnection, now: datetime, rules: Rules = RULES) -> int:
+    # Built in one SQL pass: a Python loop took 285 s for 69k issues, far too slow for the full corpus.
+    con.execute("CREATE OR REPLACE MACRO iso(x) AS strftime(timezone('UTC', x), '%Y-%m-%dT%H:%M:%SZ')")
+    con.execute("""
+        CREATE OR REPLACE TABLE candidates AS
+        WITH lt AS (
+            SELECT repo_id, list({label: label, closed_n: closed_n, known_fixes: known_fixes,
+                                  outsider_fixes: outsider_fixes, outsider_share: outsider_share,
+                                  low: outsider_low, high: outsider_high, enough: coalesce(enough, false),
+                                  window_days: $window_days, median_fix_lines: median_fix_lines,
+                                  median_fix_files: median_fix_files} ORDER BY label) AS labels,
+                list('not enough evidence for label trust on ''' || label || ''' (' || known_fixes
+                     || ' fixes with a known author; need ' || $min_closed || ')' ORDER BY label)
+                    FILTER (WHERE NOT coalesce(enough, false) AND closed_n > 0) AS label_notes
+            FROM label_trust GROUP BY repo_id),
+        wl AS (
+            SELECT repo_id, list({wall: wall, blocking: coalesce(blocking, false), evidence: evidence}
+                                 ORDER BY wall) AS walls
+            FROM repo_walls GROUP BY repo_id),
+        base AS (
+            SELECT s.*, r.name AS repo, coalesce(rs.merged, 0) AS om_merged,
+                   coalesce(rs.merged, 0) + coalesce(rs.closed, 0) AS om_decided, rs.merge_rate, rs.merge_low,
+                   rs.merge_high, coalesce(rs.merge_enough, false) AS om_enough,
+                   coalesce(rs.newcomer_merged, 0) AS nm_merged, coalesce(rs.newcomer_decided, 0) AS nm_decided,
+                   rs.newcomer_rate, rs.newcomer_low, rs.newcomer_high,
+                   coalesce(rs.newcomer_enough, false) AS nm_enough, rs.window_days, rs.window_complete,
+                   rs.median_review_hours, coalesce(rs.reviewed, 0) AS reviewed,
+                   coalesce(rs.review_enough, false) AS review_enough, coalesce(rs.bot_prs, 0) AS bot_prs,
+                   coalesce(rs.ai_prs, 0) AS ai_prs, coalesce(rs.insider_prs, 0) AS insider_prs,
+                   coalesce(lt.labels, []) AS label_trust, coalesce(lt.label_notes, []) AS label_notes,
+                   coalesce(wl.walls, []) AS walls
+            FROM issue_signals s JOIN repo_meta r USING (repo_id) LEFT JOIN repo_stats rs USING (repo_id)
+            LEFT JOIN lt USING (repo_id) LEFT JOIN wl USING (repo_id)
+            WHERE s.opportunity OR s.available)
+        SELECT repo_id, repo, number, title, coalesce(available, false) AS available,
+            coalesce(opportunity, false) AS opportunity,
+            to_json({
+                version: $version, computed_at: $computed_at,
+                source: {run_id: run_id, fetched_at: iso(fetched_at)},
+                issue: {labels: coalesce(labels, []), assignees: assignees, linked_open_prs: linked_open_prs,
+                        dead_ends: dead_ends, interest_30d: interest_30d},
+                availability: {available: coalesce(available, false),
+                               blocked_by: list_filter(string_split(coalesce(blocked_by, ''), ', '), lambda b: b <> ''),
+                               last_claim_at: iso(last_claim_at), claimers: claimers},
+                repo: {
+                    outsider_merge: {merged: om_merged, decided: om_decided, rate: merge_rate, low: merge_low,
+                                     high: merge_high, enough: om_enough, window_days: window_days,
+                                     window_complete: coalesce(window_complete, false)},
+                    newcomer_merge: {merged: nm_merged, decided: nm_decided, rate: newcomer_rate, low: newcomer_low,
+                                     high: newcomer_high, enough: nm_enough, window_days: window_days,
+                                     window_complete: coalesce(window_complete, false)},
+                    review_hours: {median: median_review_hours, n: reviewed, enough: review_enough},
+                    excluded: {bot_prs: bot_prs, ai_prs: ai_prs, insider_prs: insider_prs}},
+                labels: label_trust, walls: walls,
+                notes: list_concat(list_filter([
+                    CASE WHEN NOT om_enough THEN 'not enough evidence for outsider merge rate (' || om_decided
+                         || ' decided PRs; need ' || $min_decided || ')' END,
+                    CASE WHEN NOT nm_enough THEN 'not enough evidence for newcomer merge rate (' || nm_decided
+                         || ' decided PRs; need ' || $min_decided || ')' END,
+                    CASE WHEN window_complete = false THEN 'PR history covers only the last ' || window_days
+                         || ' days (newest ' || $pr_cap || ' PRs)' END,
+                    CASE WHEN NOT review_enough THEN 'not enough evidence for review time (' || reviewed
+                         || ' maintainer reviews; need ' || $min_reviewed || ')' END], lambda n: n IS NOT NULL),
+                    label_notes)})::VARCHAR AS evidence_json
+        FROM base""", {"version": EVIDENCE_VERSION, "computed_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"), "min_decided": rules.min_decided, "pr_cap": rules.pr_cap,
+                       "min_reviewed": rules.min_reviewed, "min_closed": rules.min_closed,
+                       "window_days": rules.window_days})
+    return con.execute("SELECT count(*) FROM candidates").fetchall()[0][0]
+
+
+def build_all(con: duckdb.DuckDBPyConnection, now: datetime, rules: Rules = RULES) -> dict[str, int]:
+    build_people(con)
+    build_pr_class(con)
+    build_repo_stats(con, now, rules)
+    build_issue_signals(con, now, rules)
+    build_label_trust(con, now, rules)
+    build_walls(con)
+    build_candidates(con, now, rules)
+    return {t: con.execute(f"SELECT count(*) FROM {t}").fetchall()[0][0] for t in TABLES}

mergescout/signals/exploits.py

@@ -0,0 +1,43 @@
+"""Exploit evidence for advisories' CVEs: CISA's Known Exploited Vulnerabilities list (exploited in the wild) and FIRST's
+EPSS (the chance of exploitation in the next 30 days). Both are free and need no key; EPSS answers 100 CVEs a request."""
+from urllib.parse import quote
+
+from mergescout.signals.deps_map import http_get_json
+
+KEV_FEED = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+EPSS_API = "https://api.first.org/data/v1/epss"
+EPSS_BATCH = 100
+
+
+def kev_ids(get_json=http_get_json) -> set[str]:
+    """The CVEs CISA lists as exploited in the wild; an unreadable feed gives none (never a guess)."""
+    try:
+        feed = get_json(KEV_FEED) or {}
+    except Exception:  # noqa: BLE001
+        return set()
+    return {str(v.get("cveID")) for v in feed.get("vulnerabilities") or [] if str(v.get("cveID", "")).startswith("CVE-")}
+
+
+def epss_scores(cves: list[str], get_json=http_get_json) -> dict[str, dict]:
+    """{cve: {"epss", "percentile"}} for the CVEs EPSS scores; a batch that fails is left out, not guessed."""
+    out = {}
+    wanted = sorted({c for c in cves if c.startswith("CVE-")})
+    for n in range(0, len(wanted), EPSS_BATCH):
+        batch = wanted[n:n + EPSS_BATCH]
+        try:
+            got = get_json(f"{EPSS_API}?cve={quote(','.join(batch), safe=',')}&limit={EPSS_BATCH}") or {}
+        except Exception:  # noqa: BLE001
+            continue
+        for row in got.get("data") or []:
+            try:
+                out[row["cve"]] = {"epss": round(float(row["epss"]), 5), "percentile": round(float(row["percentile"]), 5)}
+            except (KeyError, TypeError, ValueError):
+                continue
+    return out
+
+
+def lookup(cves: list[str], get_json=http_get_json) -> dict[str, dict]:
+    """{cve: {"epss", "percentile", "kev"}}: the shape osv.refresh_vulns(exploits=...) takes."""
+    kev = kev_ids(get_json)
+    scores = epss_scores(cves, get_json)
+    return {c: {**scores.get(c, {}), "kev": c in kev} for c in cves if c in scores or c in kev}

mergescout/signals/flow_bench.py

@@ -0,0 +1,258 @@
+from datetime import datetime, timedelta
+
+import duckdb
+
+from mergescout.bench.ci import _pct, quantiles, tier
+from mergescout.bench.matched import mh_risk_difference
+
+MIN_PRS = 10
+MIN_GROUP = 50
+METRICS = ("first_review_hours", "merge_hours", "outsider_merge_rate", "size_lines")
+DEFINITION = ("per repo, PRs opened in the last 90 days by people (bots and AI agents left out): median hours from opening "
+              "to the first review by a maintainer other than the author; median hours from opening to merge; outside "
+              "contributors' merged share of their decided PRs; median lines added plus removed. Repos with 10+ PRs.")
+
+
+def flow_benchmarks(con: duckdb.DuckDBPyConnection, now: datetime, window_days: int = 90, top_languages: int = 25) -> dict:
+    """Review-flow percentiles of public repos by language and size, from the crawl; groups need 50+ repos."""
+    rows = con.execute("""
+        WITH w AS (
+            SELECT p.*, coalesce(p.first_human_review_at, p.first_review_at) AS review_at,
+                   coalesce(p.first_human_review_by, p.first_review_by) AS review_by
+            FROM pr_class p WHERE p.created_at >= $since AND p.author_class IN ('insider', 'outsider'))
+        SELECT w.repo_id, any_value(rm.language) AS language, any_value(rm.stars) AS stars, count(*) AS prs,
+            median(epoch(w.review_at - w.created_at) / 3600) FILTER (
+                WHERE w.review_at IS NOT NULL AND w.review_by IS DISTINCT FROM w.author_login AND rv.kind = 'insider')
+                AS first_review_hours,
+            median(epoch(w.merged_at - w.created_at) / 3600) FILTER (WHERE w.merged_at IS NOT NULL) AS merge_hours,
+            (count(*) FILTER (WHERE w.author_class = 'outsider' AND w.state = 'MERGED'))::DOUBLE
+                / nullif(count(*) FILTER (WHERE w.author_class = 'outsider' AND w.state IN ('MERGED', 'CLOSED')), 0)
+                AS outsider_merge_rate,
+            median(coalesce(w.additions, 0) + coalesce(w.deletions, 0)) AS size_lines
+        FROM w LEFT JOIN people rv ON rv.repo_id = w.repo_id AND rv.login = w.review_by
+        LEFT JOIN repo_meta rm ON rm.repo_id = w.repo_id
+        GROUP BY w.repo_id HAVING count(*) >= $min_prs""",
+        {"since": now - timedelta(days=window_days), "min_prs": MIN_PRS}).fetchall()
+    cols = ("repo_id", "language", "stars", "prs", *METRICS)
+    repos = [dict(zip(cols, r)) for r in rows]
+    counts = {}
+    for r in repos:
+        counts[r["language"] or "Other"] = counts.get(r["language"] or "Other", 0) + 1
+    langs = {name for name, _ in sorted(counts.items(), key=lambda kv: -kv[1])[:top_languages]}
+    groups = {}
+    for r in repos:
+        lang = r["language"] if r["language"] in langs else "Other"
+        for key in (f"{lang}|{tier(r['stars'])}", f"{lang}|all", f"all|{tier(r['stars'])}", "all|all"):
+            groups.setdefault(key, []).append(r)
+    out = {}
+    for key, items in groups.items():
+        if len(items) < MIN_GROUP:
+            continue
+        entry = {"repos": len(items)}
+        for m in METRICS:
+            values = [round(float(r[m]), 4) for r in items if r[m] is not None]
+            if len(values) >= MIN_GROUP:
+                entry[m] = {"repos": len(values), **quantiles(values)}
+        out[key] = entry
+    return {"version": 1, "built_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"), "window_days": window_days,
+            "repos": len(repos), "definition": DEFINITION, "population": 'public GitHub repos in the daily crawl with 10+ pull requests by people in the last 90 days', "gaps": 'no private or enterprise teams; GitHub only; review counted from opening, not from leaving draft', "groups": out}
+
+
+def _median(values: list[float]) -> float | None:
+    s, n = sorted(values), len(values)
+    return None if not n else (s[n // 2] if n % 2 else (s[n // 2 - 1] + s[n // 2]) / 2)
+
+
+BUCKETS = (("5-15", 5, 15), ("15-50", 15, 50), ("50+", 50, None))
+
+
+def odds_backtest(con: duckdb.DuckDBPyConnection, now: datetime, horizon_days: int = 30, settle_days: int = 60,
+                  history_days: int = 365, k: int = 10, min_past: int = 5, min_future: int = 3) -> dict:
+    """How well a repo's past outside-PR merge rate predicts its next outside PRs: the raw rate, the rate pulled toward
+    the typical repo of its group by k PRs (what the suite shows), and that typical rate alone. The target is every
+    outside PR opened in the next horizon_days, merged within the settle window or not; errors weighted by PRs and
+    also given by how many past PRs a repo had."""
+    cut = now - timedelta(days=horizon_days + settle_days)
+    rows = con.execute("""
+        SELECT p.repo_id, any_value(rm.language), any_value(rm.stars),
+            count(*) FILTER (WHERE p.closed_at >= $lo AND p.closed_at < $cut AND p.state IN ('MERGED', 'CLOSED')),
+            count(*) FILTER (WHERE p.closed_at >= $lo AND p.closed_at < $cut AND p.state = 'MERGED'),
+            count(*) FILTER (WHERE p.created_at >= $cut AND p.created_at < $hi),
+            count(*) FILTER (WHERE p.created_at >= $cut AND p.created_at < $hi AND p.merged_at IS NOT NULL AND p.merged_at < $settled)
+        FROM pr_class p LEFT JOIN repo_meta rm USING (repo_id) WHERE p.author_class = 'outsider' GROUP BY p.repo_id""",
+        {"lo": cut - timedelta(days=history_days), "cut": cut, "hi": cut + timedelta(days=horizon_days),
+         "settled": cut + timedelta(days=horizon_days + settle_days)}).fetchall()
+    repos = [(lang or "Other", tier(stars), pc, pm, fn, fm) for _, lang, stars, pc, pm, fn, fm in rows
+             if pc >= min_past and fn >= min_future]
+    out = {"version": 2, "repos": len(repos), "prs": sum(r[4] for r in repos), "k": k,
+           "definition": f"outside PRs decided in the {history_days} days before a cut-off predict the share of outside PRs "
+                         f"opened in the next {horizon_days} days that were merged within {horizon_days + settle_days} days "
+                         f"of the cut-off; repos with {min_past}+ past and {min_future}+ next PRs; the typical rate is the "
+                         f"median of its language and size group (50+ repos) or of all repos"}
+    if not repos:
+        return out
+    by_group = {}
+    for lang, size, pc, pm, _, _ in repos:
+        for key in (f"{lang}|{size}", "all|all"):
+            by_group.setdefault(key, []).append(pm / pc)
+    typical = {key: _median(v) for key, v in by_group.items() if len(v) >= 50 or key == "all|all"}
+    err, bins, buckets = {"raw": 0.0, "shrunk": 0.0, "typical_only": 0.0}, {}, {}
+    for lang, size, pc, pm, fn, fm in repos:
+        typ = typical.get(f"{lang}|{size}", typical["all|all"])
+        observed, shrunk = fm / fn, (pm + k * typ) / (pc + k)
+        name = next(label for label, lo, hi in BUCKETS if pc >= lo and (hi is None or pc < hi))
+        b = buckets.setdefault(name, {"repos": 0, "prs": 0, "err": {"raw": 0.0, "shrunk": 0.0, "typical_only": 0.0}})
+        b["repos"] += 1
+        b["prs"] += fn
+        for key, pred in (("raw", pm / pc), ("shrunk", shrunk), ("typical_only", typ)):
+            err[key] += abs(pred - observed) * fn
+            b["err"][key] += abs(pred - observed) * fn
+        cal = bins.setdefault(min(int(shrunk * 10), 9), [0, 0.0, 0])
+        cal[0] += fn
+        cal[1] += shrunk * fn
+        cal[2] += fm
+    total = out["prs"]
+
+    def table(items):
+        # The share of next PRs merged, by the repo's raw past rate in tenths.
+        cells = {}
+        for _, _, pc, pm, fn, fm in items:
+            c = cells.setdefault(min(int(pm / pc * 10), 9), [0, 0.0, 0])
+            c[0] += fn
+            c[1] += pm / pc * fn
+            c[2] += fm
+        return cells
+    # The correction is measured on repos it was not built from: fit on one half, check on the other, and swap.
+    halves = (repos[0::2], repos[1::2])
+    err["calibrated"] = 0.0
+    for fit, check in ((halves[0], halves[1]), (halves[1], halves[0])):
+        cells = table(fit)
+        for _, _, pc, pm, fn, fm in check:
+            c = cells.get(min(int(pm / pc * 10), 9))
+            err["calibrated"] += abs((c[2] / c[0] if c else pm / pc) - fm / fn) * fn
+    out["calibration_raw"] = [{"bin": f"{i / 10:.1f}-{(i + 1) / 10:.1f}", "prs": n, "predicted": round(s / n, 4),
+                               "observed": round(m / n, 4)} for i, (n, s, m) in sorted(table(repos).items())]
+    out.update(typical=round(typical["all|all"], 4), mae={name: round(e / total, 4) for name, e in err.items()},
+               by_past_prs={label: ({"repos": buckets[label]["repos"], "prs": buckets[label]["prs"],
+                                     "mae": {key: round(e / buckets[label]["prs"], 4) for key, e in buckets[label]["err"].items()}}
+                                    if label in buckets else {"repos": 0, "prs": 0}) for label, _, _ in BUCKETS},
+               calibration=[{"bin": f"{i / 10:.1f}-{(i + 1) / 10:.1f}", "prs": n, "predicted": round(s / n, 4),
+                             "observed": round(m / n, 4)} for i, (n, s, m) in sorted(bins.items())])
+    return out
+
+
+MIN_AGENT_REPOS = 20
+
+
+def agent_prs(con: duckdb.DuckDBPyConnection, now: datetime, window_days: int = 180, min_each: int = 5) -> dict:
+    """PRs opened by coding agents next to people's outside PRs in the same repos (each with min_each+ decided PRs of
+    both kinds): the median repo's merge share of each, per group of similar repos with 20+ such repos. Agents are known
+    by their account, as the suite's app knows them (an AI-assisted PR by a person stays that person's), and a PR counts
+    in the window it was decided in."""
+    rows = con.execute("""
+        SELECT p.repo_id, any_value(rm.language), any_value(rm.stars),
+            count(*) FILTER (WHERE p.author_role = 'agent'), count(*) FILTER (WHERE p.author_role = 'agent' AND p.state = 'MERGED'),
+            count(*) FILTER (WHERE p.author_role = 'outsider'),
+            count(*) FILTER (WHERE p.author_role = 'outsider' AND p.state = 'MERGED')
+        FROM pr_class p LEFT JOIN repo_meta rm USING (repo_id)
+        WHERE coalesce(p.merged_at, p.closed_at) >= $since AND p.state IN ('MERGED', 'CLOSED')
+            AND p.author_role IN ('agent', 'outsider')
+        GROUP BY p.repo_id""", {"since": now - timedelta(days=window_days)}).fetchall()
+    groups = {}
+    for _, lang, stars, an, am, on, om in rows:
+        if an < min_each or on < min_each:
+            continue
+        lang = lang or "Other"
+        for key in (f"{lang}|{tier(stars)}", f"{lang}|all", f"all|{tier(stars)}", "all|all"):
+            groups.setdefault(key, []).append((an, am / an, on, om / on))
+    return {key: {"repos_with_agent_prs": len(g),
+                  "agent": {"decided": sum(x[0] for x in g), "merged": round(_median([x[1] for x in g]), 4)},
+                  "outsider": {"decided": sum(x[2] for x in g), "merged": round(_median([x[3] for x in g]), 4)}}
+            for key, g in groups.items() if len(g) >= MIN_AGENT_REPOS}
+
+
+MIN_LEADER_REPOS = 10  # an agent seen in fewer repos is left off the leaderboard
+# Which agent, from its account's name or the branch prefix it pushes from a person's account.
+AGENT_NAME = """CASE
+    WHEN p.author_role = 'agent' THEN coalesce(
+        nullif(regexp_extract(lower(p.author_login), '(copilot|devin|claude|codex|cursor|openhands|sweep|jules|codegen)', 1), ''),
+        'other agent')
+    ELSE lower(regexp_extract(coalesce(p.head_ref, ''), '^(copilot|codex|cursor|devin|claude)[/-]', 1)) END"""
+
+
+def agent_leaderboard(con: duckdb.DuckDBPyConnection, now: datetime, window_days: int = 180) -> dict:
+    """Each coding agent across the crawl's public repos: repos and decided PRs, the share merged, the share merged by
+    someone other than its author, and its gap against people's PRs of the same repo, month and size (Mantel-Haenszel,
+    95% range); agents seen in fewer than 10 repos are left out."""
+    rows = con.execute(f"""
+        SELECT p.repo_id, strftime(coalesce(p.merged_at, p.closed_at), '%Y-%m') AS month,
+            CAST(floor(log2(coalesce(p.additions, 0) + coalesce(p.deletions, 0) + 1)) AS INTEGER) AS band,
+            CASE WHEN p.author_role = 'agent' OR regexp_matches(coalesce(p.head_ref, ''), '^(copilot|codex|cursor|devin|claude)[/-]', 'i')
+                 THEN {AGENT_NAME} END AS agent,
+            count(*), count(*) FILTER (WHERE p.state = 'MERGED'),
+            count(*) FILTER (WHERE p.state = 'MERGED' AND lower(coalesce(p.merged_by, '')) <> lower(coalesce(p.author_login, '')))
+        FROM pr_class p
+        WHERE coalesce(p.merged_at, p.closed_at) >= $since AND p.state IN ('MERGED', 'CLOSED')
+            AND p.author_role IN ('agent', 'insider', 'outsider')
+        GROUP BY p.repo_id, month, band, agent""", {"since": now - timedelta(days=window_days)}).fetchall()
+    people, mine = {}, {}
+    for repo, month, band, agent, n, merged, others in rows:
+        if agent:
+            mine.setdefault(agent, {})[(repo, month, band)] = (n, merged, others)
+        else:
+            people[(repo, month, band)] = (n, merged)
+    agents = {}
+    for name, cells in mine.items():
+        repos = {k[0] for k in cells}
+        if len(repos) < MIN_LEADER_REPOS:
+            continue
+        n, merged, others = (sum(c[i] for c in cells.values()) for i in range(3))
+        pairs = [(c[1], c[0], people[k][1], people[k][0]) for k, c in cells.items() if k in people and people[k][0]]
+        entry = {"repos": len(repos), "prs": n, "merged": round(merged / n, 4), "merged_by_others": round(others / n, 4)}
+        if pairs:
+            rd, se = mh_risk_difference(pairs)
+            entry["vs_people"] = {"gap": round(rd, 4), "low": round(rd - 1.96 * se, 4), "high": round(rd + 1.96 * se, 4),
+                                  "prs_compared": sum(p[1] for p in pairs)}
+        agents[name] = entry
+    return {"window_days": window_days, "agents": dict(sorted(agents.items(), key=lambda kv: -kv[1]["prs"]))}
+
+
+def agent_matched(con: duckdb.DuckDBPyConnection, now: datetime, window_days: int = 180) -> dict:
+    """Coding agents' PRs (their account, or an agent's branch such as codex/ opened from a person's account) against
+    people's PRs of the same repo, month and size, per group of similar repos with 20+ such repos: the gap in merged and
+    in merged by someone other than the author (Mantel-Haenszel risk difference, 95% range). Most agents' PRs are merged
+    by whoever ran the agent, so the second gap is the one that says whether anyone else accepted them."""
+    rows = con.execute("""
+        SELECT p.repo_id, any_value(rm.language), any_value(rm.stars),
+            strftime(coalesce(p.merged_at, p.closed_at), '%Y-%m') AS month,
+            CAST(floor(log2(coalesce(p.additions, 0) + coalesce(p.deletions, 0) + 1)) AS INTEGER) AS band,
+            (p.author_role = 'agent' OR regexp_matches(coalesce(p.head_ref, ''), '^(copilot|codex|cursor|devin|claude)[/-]', 'i')) AS agent,
+            count(*), count(*) FILTER (WHERE p.state = 'MERGED'),
+            count(*) FILTER (WHERE p.state = 'MERGED' AND lower(coalesce(p.merged_by, '')) <> lower(coalesce(p.author_login, '')))
+        FROM pr_class p LEFT JOIN repo_meta rm USING (repo_id)
+        WHERE coalesce(p.merged_at, p.closed_at) >= $since AND p.state IN ('MERGED', 'CLOSED')
+            AND p.author_role IN ('agent', 'insider', 'outsider')
+        GROUP BY p.repo_id, month, band, agent""", {"since": now - timedelta(days=window_days)}).fetchall()
+    strata, meta = {}, {}
+    for repo, lang, stars, month, band, agent, n, merged, others in rows:
+        cell = strata.setdefault((repo, month, band), [0, 0, 0, 0, 0, 0])
+        at = 0 if agent else 3
+        cell[at], cell[at + 1], cell[at + 2] = n, merged, others
+        meta[repo] = (lang or "Other", stars)
+    groups = {}
+    for (repo, _month, _band), c in strata.items():
+        if c[0] and c[3]:
+            lang, stars = meta[repo]
+            for key in (f"{lang}|{tier(stars)}", f"{lang}|all", f"all|{tier(stars)}", "all|all"):
+                groups.setdefault(key, []).append((repo, c))
+    out = {}
+    for key, cells in groups.items():
+        repos = {repo for repo, _c in cells}
+        if len(repos) < MIN_AGENT_REPOS:
+            continue
+        found = {"repos": len(repos), "agent_prs": sum(c[0] for _r, c in cells)}
+        for name, hit in (("merged", 1), ("merged_by_others", 2)):
+            rd, se = mh_risk_difference([(c[hit], c[0], c[3 + hit], c[3]) for _r, c in cells])
+            found[name] = {"gap": round(rd, 4), "low": round(rd - 1.96 * se, 4), "high": round(rd + 1.96 * se, 4)}
+        out[key] = found
+    return out

mergescout/signals/identity.py

@@ -0,0 +1,73 @@
+import duckdb
+
+from mergescout.signals.rules import (AI_AGENT_BOT_NAMES, AI_AGENT_LOGINS, BOT_NAME_PATTERN, HUMAN_BOT_NAMES,
+                                      KNOWN_BOTS, UNKNOWN_LOGINS)
+
+
+def _quoted(names) -> str:
+    return ", ".join("'" + n.replace("'", "''") + "'" for n in sorted(names))
+
+
+def build_people(con: duckdb.DuckDBPyConnection) -> None:
+    # Insiders are found by what they do (merging, listed roles), not only by GitHub's association label.
+    con.execute(f"""
+        CREATE OR REPLACE TABLE people AS
+        WITH acts AS (
+            SELECT repo_id, author_login AS login, author_association AS assoc, author_type AS typ, 'pr' AS act FROM prs
+            UNION ALL SELECT repo_id, merged_by, NULL, NULL, 'merged_other' FROM prs
+                WHERE state = 'MERGED' AND merged_by IS NOT NULL AND merged_by IS DISTINCT FROM author_login
+            UNION ALL SELECT repo_id, merged_by, NULL, NULL, 'self_merge' FROM prs
+                WHERE state = 'MERGED' AND merged_by = author_login
+            UNION ALL SELECT repo_id, first_review_by, first_review_association, NULL, 'review' FROM prs
+            UNION ALL SELECT repo_id, first_human_review_by, first_human_review_association, NULL, 'review' FROM prs
+            UNION ALL SELECT repo_id, author_login, author_association, NULL, 'issue' FROM issues
+            UNION ALL SELECT repo_id, author_login, author_association, author_type, 'comment' FROM comments
+            UNION ALL SELECT repo_id, author_login, author_association, NULL, 'issue' FROM closed_issues),
+        agg AS (
+            SELECT repo_id, login,
+                bool_or(typ = 'Bot' OR lower(login) LIKE '%[bot]' OR lower(login) IN ({_quoted(KNOWN_BOTS)})
+                        OR (regexp_matches(lower(login), '{BOT_NAME_PATTERN}')
+                            AND NOT regexp_matches(lower(login), '{HUMAN_BOT_NAMES}'))) AS bot,
+                bool_or(assoc IN ('OWNER', 'MEMBER', 'COLLABORATOR')) AS listed,
+                bool_or(act = 'merged_other') AS merges_others,
+                bool_or(act = 'self_merge') AS self_merges,
+                count(*) AS activity,
+                count(*) FILTER (WHERE act = 'pr') AS prs
+            FROM acts
+            WHERE login IS NOT NULL AND lower(login) NOT IN ({_quoted(UNKNOWN_LOGINS)})
+            GROUP BY repo_id, login),
+        -- People named in CODEOWNERS / MAINTAINERS / OWNERS are maintainers even when they rarely merge.
+        owners AS (
+            SELECT DISTINCT repo_id, lower(o) AS l FROM (SELECT repo_id, unnest(owner_logins) AS o FROM repo_meta))
+        SELECT a.repo_id, a.login,
+            CASE WHEN bot THEN 'bot' WHEN listed OR merges_others OR self_merges OR ow.l IS NOT NULL THEN 'insider'
+                 ELSE 'outsider' END AS kind,
+            concat_ws(', ', CASE WHEN bot THEN 'bot account' END, CASE WHEN listed THEN 'listed role' END,
+                      CASE WHEN merges_others THEN 'merges others' END, CASE WHEN self_merges THEN 'merges own' END,
+                      CASE WHEN ow.l IS NOT NULL THEN 'in owner files' END) AS reasons,
+            activity, prs
+        FROM agg a LEFT JOIN owners ow ON ow.repo_id = a.repo_id AND ow.l = lower(a.login)""")
+
+
+def build_pr_class(con: duckdb.DuckDBPyConnection) -> None:
+    con.execute(f"""
+        CREATE OR REPLACE VIEW pr_class AS
+        SELECT p.*, CASE
+            WHEN p.author_login IS NULL OR lower(p.author_login) IN ({_quoted(UNKNOWN_LOGINS)}) THEN 'unknown'
+            WHEN replace(lower(p.author_login), '[bot]', '') IN ({_quoted(AI_AGENT_LOGINS)}) THEN 'ai'
+            WHEN replace(lower(p.author_login), '[bot]', '') IN ({_quoted(AI_AGENT_BOT_NAMES)})
+                 AND (p.author_type = 'Bot' OR lower(p.author_login) LIKE '%[bot]') THEN 'ai'
+            WHEN pe.kind = 'bot' OR p.ai_tag = 'bot' THEN 'bot'
+            WHEN p.ai_tag IS NOT NULL THEN 'ai'
+            WHEN pe.kind = 'insider' THEN 'insider'
+            ELSE 'outsider' END AS author_class,
+            -- The author alone, as the suite's app decides it: a person's AI-assisted PR is still that person's.
+            CASE
+            WHEN p.author_login IS NULL OR lower(p.author_login) IN ({_quoted(UNKNOWN_LOGINS)}) THEN 'unknown'
+            WHEN replace(lower(p.author_login), '[bot]', '') IN ({_quoted(AI_AGENT_LOGINS)}) THEN 'agent'
+            WHEN replace(lower(p.author_login), '[bot]', '') IN ({_quoted(AI_AGENT_BOT_NAMES)})
+                 AND (p.author_type = 'Bot' OR lower(p.author_login) LIKE '%[bot]') THEN 'agent'
+            WHEN pe.kind = 'bot' OR p.ai_tag = 'bot' THEN 'bot'
+            WHEN pe.kind = 'insider' THEN 'insider'
+            ELSE 'outsider' END AS author_role
+        FROM prs p LEFT JOIN people pe ON pe.repo_id = p.repo_id AND pe.login = p.author_login""")

mergescout/signals/issues.py

@@ -0,0 +1,76 @@
+from datetime import datetime, timedelta
+
+import duckdb
+
+from mergescout.labels import BEGINNER, HOT
+from mergescout.signals.identity import _quoted
+from mergescout.signals.rules import (CLAIM_PATTERN, DISCUSSION_LABEL, DISCUSSION_TITLE, RULES, TRIAGE_LABEL_PATTERN,
+                                      UNKNOWN_LOGINS, WAIT_LABEL_PATTERN, WAIT_PATTERN, Rules)
+
+
+def norm_label_macro(con: duckdb.DuckDBPyConnection) -> None:
+    # Same rule as labels.norm_label: lower case, drop :emoji:, keep letters and digits, single spaces.
+    con.execute(r"""CREATE OR REPLACE MACRO norm_label(x) AS trim(regexp_replace(
+        regexp_replace(regexp_replace(lower(x), ':[a-z0-9_+-]+:', ' ', 'g'), '[^a-z0-9]+', ' ', 'g'), ' +', ' ', 'g'))""")
+
+
+def build_issue_signals(con: duckdb.DuckDBPyConnection, now: datetime, rules: Rules = RULES) -> None:
+    norm_label_macro(con)
+    claim_since = now - timedelta(days=rules.claim_days)
+    interest_since = now - timedelta(days=rules.interest_days)
+    con.execute(f"""
+        CREATE OR REPLACE TABLE issue_signals AS
+        WITH c AS (
+            SELECT c.*, coalesce(pe.kind, 'outsider') AS kind FROM comments c
+            LEFT JOIN people pe ON pe.repo_id = c.repo_id AND pe.login = c.author_login
+            WHERE c.author_login IS NOT NULL AND lower(c.author_login) NOT IN ({_quoted(UNKNOWN_LOGINS)})),
+        claims AS (
+            SELECT repo_id, number, max(created_at) AS last_claim_at, count(DISTINCT author_login) AS claimers
+            FROM c WHERE kind = 'outsider' AND regexp_matches(lower(body_excerpt), $claim) GROUP BY ALL),
+        waits AS (
+            SELECT repo_id, number, max(created_at) AS wait_at
+            FROM c WHERE kind = 'insider' AND regexp_matches(lower(body_excerpt), $wait) GROUP BY ALL),
+        interest AS (
+            SELECT repo_id, number, count(DISTINCT author_login) AS interest_30d
+            FROM c WHERE kind = 'outsider' AND created_at >= $interest_since GROUP BY ALL),
+        il AS (
+            SELECT *, list_transform(coalesce(labels, []), lambda x: norm_label(x)) AS nl FROM issues),
+        i AS (
+            SELECT *, len(list_filter(nl, lambda x: regexp_matches(x, $wait_label))) > 0 AS wait_label,
+                len(list_filter(nl, lambda x: regexp_matches(x, $triage_label))) > 0 AS triage_label,
+                list_has_any(nl, $hot) AS opportunity
+            FROM il)
+        SELECT i.repo_id, i.number, i.title, i.labels,
+            i.opportunity, list_has_any(i.nl, $beginner) AS beginner, i.triage_label,
+            CASE WHEN regexp_matches(lower(coalesce(i.title, '')), $disc_title)
+                      OR len(list_filter(i.nl, lambda x: regexp_matches(x, $disc_label))) > 0
+                 THEN 'discussion' ELSE 'task' END AS kind,
+            coalesce(i.assignees, 0) AS assignees, coalesce(i.linked_open_prs, 0) AS linked_open_prs,
+            coalesce(i.linked_closed_prs, 0) AS dead_ends,
+            cl.last_claim_at, coalesce(cl.claimers, 0) AS claimers, w.wait_at,
+            coalesce(it.interest_30d, 0) AS interest_30d,
+            (coalesce(i.assignees, 0) = 0 AND coalesce(i.linked_open_prs, 0) = 0
+             AND (cl.last_claim_at IS NULL OR cl.last_claim_at < $claim_since) AND w.wait_at IS NULL
+             AND NOT i.wait_label AND NOT (i.triage_label AND NOT i.opportunity)) AS available,
+            concat_ws(', ', CASE WHEN i.assignees > 0 THEN 'assigned' END,
+                      CASE WHEN i.linked_open_prs > 0 THEN 'open PR' END,
+                      CASE WHEN cl.last_claim_at >= $claim_since THEN 'claimed recently' END,
+                      CASE WHEN w.wait_at IS NOT NULL THEN 'maintainer asked to wait' END,
+                      CASE WHEN i.wait_label THEN 'label says not ready' END,
+                      CASE WHEN i.triage_label AND NOT i.opportunity THEN 'label says not settled yet' END)
+                AS blocked_by,
+            i.created_at, i.updated_at, i.fetched_at, i.run_id
+        FROM i
+        LEFT JOIN claims cl USING (repo_id, number) LEFT JOIN waits w USING (repo_id, number)
+        LEFT JOIN interest it USING (repo_id, number)
+        -- Bot-made issues (CI failures, CVE alerts) are not tasks unless a beginner or help label invites outsiders:
+        -- real bots also mirror maintainer tasks (stdlib-bot lint fixes, MelvinBot "Help Wanted").
+        LEFT JOIN people au ON au.repo_id = i.repo_id AND au.login = i.author_login
+        WHERE i.state = 'OPEN' AND NOT (coalesce(au.kind, '') = 'bot' AND NOT list_has_any(i.nl, $hot))
+          AND NOT regexp_matches(lower(coalesce(i.title, '')), $dashboard) AND NOT EXISTS (
+            SELECT 1 FROM issue_events e WHERE e.repo_id = i.repo_id AND e.number = i.number AND e.event = 'gone'
+              AND e.observed_at::DATE >= coalesce(i.fetched_at::DATE, DATE '1970-01-01'))""",
+        {"claim": CLAIM_PATTERN, "wait": WAIT_PATTERN, "interest_since": interest_since,
+         "claim_since": claim_since, "hot": sorted(HOT), "beginner": sorted(BEGINNER),
+         "wait_label": WAIT_LABEL_PATTERN, "triage_label": TRIAGE_LABEL_PATTERN, "disc_title": DISCUSSION_TITLE,
+         "disc_label": DISCUSSION_LABEL, "dashboard": r"^\s*dependency dashboard\s*$"})

mergescout/signals/labels.py

@@ -0,0 +1,79 @@
+from datetime import datetime, timedelta
+
+import duckdb
+
+from mergescout.labels import HOT
+from mergescout.signals.issues import norm_label_macro
+from mergescout.signals.repo_stats import _wilson_macros
+from mergescout.signals.rules import RULES, Rules
+
+
+def build_label_trust(con: duckdb.DuckDBPyConnection, now: datetime, rules: Rules = RULES) -> None:
+    norm_label_macro(con)
+    _wilson_macros(con)
+    con.execute("""
+        CREATE OR REPLACE TABLE label_trust AS
+        WITH closed AS (
+            -- Refreshes bring closed issues as issue rows; only crawlers that record fixes fill linked_closed_prs.
+            SELECT DISTINCT ON (repo_id, number) *
+            FROM (SELECT repo_id, number, labels, state_reason, fix_pr, fix_pr_state, fix_author, fix_association,
+                         closed_at, fetched_at FROM closed_issues
+                  UNION ALL
+                  SELECT repo_id, number, labels, state_reason, fix_pr, fix_pr_state, fix_author, fix_association,
+                         closed_at, fetched_at FROM issues WHERE state = 'CLOSED' AND linked_closed_prs IS NOT NULL)
+            WHERE closed_at >= $since
+            ORDER BY repo_id, number, fetched_at DESC NULLS LAST),
+        ci AS (
+            SELECT DISTINCT ON (repo_id, number, label) *
+            FROM (SELECT *, unnest(list_transform(labels, lambda x: norm_label(x))) AS label FROM closed)
+            WHERE list_contains($hot, label)),
+        judged AS (
+            SELECT ci.repo_id, ci.label, ci.number, ci.fix_pr, CASE
+                WHEN ci.state_reason = 'NOT_PLANNED' THEN 'not_planned'
+                WHEN ci.state_reason = 'DUPLICATE' THEN 'duplicate'
+                WHEN ci.fix_pr_state IS DISTINCT FROM 'MERGED' THEN 'other'
+                WHEN pe.kind = 'bot' OR p.ai_tag = 'bot' THEN 'bot'
+                WHEN p.ai_tag IS NOT NULL THEN 'ai'
+                WHEN pe.kind = 'insider' OR ci.fix_association IN ('OWNER', 'MEMBER', 'COLLABORATOR') THEN 'insider'
+                WHEN ci.fix_author IS NULL THEN 'other'
+                ELSE 'outsider' END AS outcome
+            FROM ci
+            LEFT JOIN people pe ON pe.repo_id = ci.repo_id AND pe.login = ci.fix_author
+            LEFT JOIN prs p ON p.repo_id = ci.repo_id AND p.number = ci.fix_pr),
+        sizes AS (
+            SELECT j.repo_id, j.label, median(p.additions + p.deletions) AS median_fix_lines,
+                   median(p.changed_files) AS median_fix_files, count(p.number) AS sized
+            FROM judged j JOIN prs p ON p.repo_id = j.repo_id AND p.number = j.fix_pr
+            WHERE j.outcome IN ('outsider', 'insider') GROUP BY ALL),
+        stale AS (
+            SELECT repo_id, label, count(*) AS open_stale
+            FROM (SELECT repo_id, created_at, unnest(list_transform(labels, lambda x: norm_label(x))) AS label
+                  FROM issues WHERE state = 'OPEN')
+            WHERE list_contains($hot, label) AND created_at < $stale_before GROUP BY ALL),
+        counts AS (
+            SELECT repo_id, label, count(*) AS closed_n,
+                count(*) FILTER (WHERE outcome = 'outsider') AS outsider_fixes,
+                count(*) FILTER (WHERE outcome = 'insider') AS insider_fixes,
+                count(*) FILTER (WHERE outcome = 'ai') AS ai_fixes,
+                count(*) FILTER (WHERE outcome = 'bot') AS bot_fixes,
+                count(*) FILTER (WHERE outcome = 'not_planned') AS not_planned,
+                count(*) FILTER (WHERE outcome = 'duplicate') AS duplicates,
+                count(*) FILTER (WHERE outcome = 'other') AS other,
+                -- The share only counts fixes whose author is known; unlinked closes say nothing about who fixed them.
+                count(*) FILTER (WHERE outcome IN ('outsider', 'insider', 'ai', 'bot')) AS known_fixes
+            FROM judged GROUP BY ALL)
+        SELECT k.repo_id, k.label, coalesce(c.closed_n, 0) AS closed_n,
+            coalesce(c.outsider_fixes, 0) AS outsider_fixes, coalesce(c.insider_fixes, 0) AS insider_fixes,
+            coalesce(c.ai_fixes, 0) AS ai_fixes, coalesce(c.bot_fixes, 0) AS bot_fixes,
+            coalesce(c.not_planned, 0) AS not_planned, coalesce(c.duplicates, 0) AS duplicates,
+            coalesce(c.other, 0) AS other, coalesce(c.known_fixes, 0) AS known_fixes,
+            c.outsider_fixes::DOUBLE / nullif(c.known_fixes, 0) AS outsider_share,
+            wilson_lo(c.outsider_fixes, c.known_fixes) AS outsider_low,
+            wilson_hi(c.outsider_fixes, c.known_fixes) AS outsider_high,
+            coalesce(c.known_fixes, 0) >= $min_closed AS enough,
+            s.median_fix_lines, s.median_fix_files, coalesce(s.sized, 0) AS sized, coalesce(st.open_stale, 0) AS open_stale
+        FROM (SELECT repo_id, label FROM counts UNION SELECT repo_id, label FROM stale) k
+        LEFT JOIN counts c USING (repo_id, label) LEFT JOIN sizes s USING (repo_id, label)
+        LEFT JOIN stale st USING (repo_id, label)""",
+        {"hot": sorted(HOT), "stale_before": now - timedelta(days=rules.stale_days), "min_closed": rules.min_closed,
+         "since": now - timedelta(days=rules.window_days)})