gitgalaxy-population-analyses

Population-level statistics over GitGalaxy scan data: where a single scan describes one repository, this repo asks what hundreds of scans look like together — how risk exposures distribute across real-world code, whether repositories cluster into structural archetypes, and how malware-labeled populations separate from benign ones. Raw inputs come from gitgalaxy-raw-output (unedited per-repo scan bundles); this repo merges them into master SQLite databases (build_master_db.py, master_db_updater.py) and runs the analyses offline. Nothing here is on any CI path.

What's here

• structural-fingerprint-scanner: a packaged tool (sfs) that fingerprints GitGalaxy scans in the engine's population reference frame, compares repositories by design (profile distance) and by inherited code (calibrated function-level structural twins), and draws profile and descent trees. It replaces the earlier twin_discovery*.py and mine_dna_stoichiometry.py scripts (now in archive/). Validated on 44 DOOM ports with known ancestry (examples/doom).
• Master database assembly — build_master_db.py / master_db_updater.py merge raw-output scan DBs into one population database (data/); db_health_assessor.py sanity-checks it.
• Risk-exposure distributions — detailed_risk_exposure_stats_from_db.py, plot_ridgelines.py → the ridgeline plots in analyses_ridgeplots/ (66 charts: per-metric distributions across the population, e.g. avg_func_args_ridgeplot.png).
• Structural archetypes — archetype_analysis_suite.py, apply_language_specific_clusters.py, repo_macro_fingerprints.py: clustering repositories by structural signature profile.
• Threat/malware population studies — analyze_threat_prediction_distributions.py, repo_level_malware_analysis_suite.py, graph_malware_zscores_by_cluster.py, malware_telemetry_report.py, extract_zero_day_suspects.py → analysis_outputs/ (z-score separations of malware-labeled vs. benign repos, classifier confusion heatmap, danger_zone_audit.csv).
• Function-level studies — function_analysis_suite.py, validate_function_metrics.py.

The GitGalaxy constellation

This repo is one strand of the web of repos that build, prove, and showcase GitGalaxy:

• gitgalaxy — the engine that produced every data point here
• gitgalaxy-raw-output — the unedited scan bundles this repo aggregates
• gitgalaxy-population-analyses — you are here: the statistical layer on top
• language-crucible — the pinned adversarial corpus behind the engine's golden-master regression gate
• keyword-rosetta — one planted program in 46 languages, measuring cross-language measurement consistency (read its bias findings before treating cross-language comparisons here as unbiased)
• cobol_to_java_examples — 10 COBOL repos auto-translated to compiling Spring Boot architectures
• squid-telemetry — public distribution/adoption metrics
• Docs: architecture & methodology site · risk-equation methodology chapter · Museum of Code · gitgalaxy.io