Skip to content

Keep known repositories selectable in reporting exports - #2304

Merged
wesm merged 3 commits into
mainfrom
fix/reporting-evidence-groups
Oct 17, 2026
Merged

wesm merged 3 commits into
mainfrom
fix/reporting-evidence-groups

Conversation

@wesm

@wesm wesm commented Oct 17, 2026

Copy link
Copy Markdown
Member

Reporting export version 5 keeps known repository activity selectable when another session with the same project name has missing, conflicting, or different repository evidence. Today those contributions collapse into one unresolved project, hiding the known portion from scoped reports.

The new version groups activity and usage by each session’s saved identity before aggregation. Project selection applies to the complete report, including totals and concurrency. It uses existing archive evidence without inspecting checkouts or changing stored data.

Versions 3 and 4 keep their existing behavior. Consumers opting into version 5 must obtain new project keys and refresh saved digests. See the export contract for the grouping rules.

A session without repository evidence currently makes every contribution
under its project name unresolved. Consumers cannot select the known
repository without also including unrelated activity.

Offer these finer groups under an explicit new schema so existing exports
and saved digests retain their meaning. Repository evidence remains local
to each contribution; a shared name cannot establish identity.
@roborev-ci

roborev-ci Bot commented Oct 17, 2026

Copy link
Copy Markdown

roborev: Combined Review (8bd3fe2)

Verdict: Changes require fixes for 1 finding.

Medium

  • internal/db/reporting_identity.go:60: For a dated session with an empty project and no identity snapshot, replacing Project with a nonempty group key bypasses buildReportingFirstSeen's empty-project guard. Schema 5 reports new_projects=1 where versions 3 and 4 report 0, violating the retained accounting rules.

    Fix: Preserve whether the original project was empty and exclude those groups from first-seen project counts. Add a behavioral regression test for a dated projectless session.


Reviewers: 3x codex, codex (security) | Synthesis: codex, 8s | Total: 4m16s

Schema 5 assigns a nonempty selector even when a session has no project.
That selector must not become evidence that a new project exists.
Preserve the original absence separately from the display label, since
redacted path labels still represent real projects.
@roborev-ci

roborev-ci Bot commented Oct 17, 2026

Copy link
Copy Markdown

roborev: Combined Review (0dd8251)

Verdict: No findings at or above medium severity.


Reviewers: 3x codex, codex (security) | Synthesis: codex | Total: 3m7s

@wesm wesm self-assigned this Oct 17, 2026
… schema 4

Schema 5 promises the same accounting as schema 4, but splitting a
project name into identity groups changed two results. A session without
a project appeared as an unlabeled project in the activity and usage
breakdowns. A project with both verified and unknown sessions counted as
two new projects.

Both checks need the session's original project name, not the display
label, because a redacted path label still names a real project.

Schema 5 keys come from saved identity evidence, so they move when a
sync or upgrade changes that evidence. The export contract now says so,
because a saved selector can quietly match less after such a change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roborev-ci

roborev-ci Bot commented Oct 17, 2026

Copy link
Copy Markdown

roborev: Combined Review (701ccc6)

Verdict: No findings at or above medium severity.


Reviewers: 3x codex, codex (security) | Synthesis: codex | Total: 3m47s

@wesm
wesm merged commit 33c30f4 into main Oct 17, 2026
24 checks passed
@wesm
wesm deleted the fix/reporting-evidence-groups branch October 17, 2026 13:53
wesm added a commit that referenced this pull request Oct 18, 2026
Reporting exports now come in two versions: version 3, the default, and version 5 for joint cells. `--schema-version 4` is rejected before the archive opens. Integrations get one joint contract instead of two, and the export code loses the second joint path that #2304 added. This benefits both users and developers.

Version 5 has the same fields and accounting as version 4 and differs only in how it groups projects. Version 4 puts every contribution under one project label. A single session with missing or different repository evidence therefore hides a verified repository's activity. Moving to version 5 already requires new project keys and refreshed digests, so keeping version 4 would preserve only that hiding behavior. Retiring it now means 0.46.0, the first release with version 5, ships a single joint version. Versions 1 and 2 were retired the same way when version 3 arrived. Version 3 stays as the default because it has a different shape (no joint cells, bucket choice, or project scope) and plain invocations rely on it.

**Breaking change:** integrations using version 4 must switch to version 5. They must read new project keys from the project breakdowns or `joint.projects` of an unscoped export, and refresh saved digests. The changelog and the export guide say so.

Where to look:

- `internal/db/reporting_export.go`: identity grouping now always applies to joint exports.
- `internal/db/reporting_identity_test.go`: one test required every session under a label to share evidence, which is version 4 behavior. Its snapshot-consistency and identity-correction checks now assert the version 5 result: the verified repository keeps its key, and the corrected session moves to an unknown group. Its other cases already exist in the version 5 grouping tests.
- `docs/reporting-export.md`: the identity-evidence section no longer says that a key identifies only a label, or that conflicting identities produce `ambiguous`.

Most other test changes update version numbers or unwrap loops over versions 4 and 5.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant