diff --git a/README.md b/README.md index 8d8be0b8d3..40a9aa8c5a 100644 --- a/README.md +++ b/README.md @@ -35,10 +35,11 @@ in, not the clean single-language input most static-analysis tooling assumes. has to build first. * **Fast enough to run on every commit.** Most repositories scan in well under a minute — [Kubernetes](https://github.com/squid-protocol/gitgalaxy-raw-output/blob/main/v2.4.6/kubernetes/kubernetes_galaxy_llm.md), - 1.39M lines across Go, YAML, JSON, Shell, and Proto, scans end to end in 50.83 seconds. A - handful of 20M+ LOC outliers take a few minutes instead — see the - [104-repo benchmark](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/) - for the full spread, not just the favorable case. + 1.39M lines across Go, YAML, JSON, Shell, and Proto, scans end to end in 50.83 seconds. Scan + time is fit as two regimes across a 599-repo batch — flat overhead below ~4,258 LOC, then + `time(s) ≈ 3.36e-05 × LOC^0.969` above it (R²=0.88, near-linear, not degrading on large + inputs) — see [Proof, Not Just Claims](#proof-not-just-claims) for the chart and derivation, + not just this rounded headline. * **CI-native output, not a standalone report.** Every scan produces a SARIF file (drops straight into GitHub/GitLab security dashboards), a CycloneDX SBOM (dependency compliance), and a 0–100 risk-exposure score per file, folder, and repo. See [Benchmarks](#benchmarks) for @@ -183,6 +184,15 @@ Every "structural signature" and "AST-free" claim above is backed by three thing 2. **A true golden diff against real, unmodified production code.** [`language-crucible`](https://github.com/squid-protocol/language-crucible) is a pinned, tagged snapshot of ~120 real subdirectories pulled from major open-source projects — Godot's C++, the Roslyn C# compiler, curl, Kubernetes, Apollo 11's AGC flight software, and more — deliberately left disconnected and uncompilable, the same hostile state real repos are in. Every pull request that touches the parsing engine re-scans that entire corpus and diffs the output, field by field, against a checked-in snapshot (`tests/golden_master_audit.json`); a diff means the output changed on real code, and it has to be explained before it's accepted — not a smoke test, an actual golden-master comparison. See [`tests/README.md`](tests/README.md#5-golden-master-differential-testing-the-language-crucible) for exactly how this is wired into CI, and [language-crucible's own README](https://github.com/squid-protocol/language-crucible) for why that corpus is built the way it is. 3. **[Unedited raw scan output at real-world scale](https://github.com/squid-protocol/gitgalaxy-raw-output).** Where the golden-master corpus above proves correctness on ~120 curated adversarial paradigms, this repo is the complementary evidence that the engine actually runs, unmodified, across hundreds of independently-chosen real repositories — every `_galaxy_audit.json`, `_galaxy_master.db`, and `_galaxy_llm.md` the scanner produced, kept versioned per engine release. The corpus manifest pinning exactly which repos and commits were scanned currently covers a 323-repo subset of the larger batch archived there — stated plainly in that repo's own README rather than implied to be complete. +That same raw-output batch is what the speed claim above is fit from — every repo plotted, not just the favorable Kubernetes example: + +
+
+