[mevichitra]

Summary

#53 (long-span drift mode) and #55 (35-repository corpus, batch runner, statistics and the committed paper/ tables) were merged into claude/nice-allen-ptg63r, the branch of #51, after #51 had already been merged into main. About 6,000 lines of research code and results never reached main. This PR merges that branch into main, resolves the conflicts with #54 (RQ2 transformations) and #56 (SonarQube, Bandit and Semgrep schemes), and fixes a bug in drift mode that only appears once the two are combined.

Type of change

• Bug fix (false positive / false negative correction)
• New rule (attach rule ID from the tracker)
• Engine / runner change
• CLI change
• Docs only
• Tooling / CI (research code under research/, not part of the released package)

Checklist

• git commit -s — DCO sign-off on all commits
• pytest passes locally
• ruff check research/ and ruff format --check research/ clean
• MYPYPATH=src mypy --strict research/finding_identity clean
• News fragment: not needed for research/

What changed

Merge commit, conflicts resolved by keeping both sides:

• cli.py: the transform subcommand (Add controlled transformation experiment for finding identity (RQ2) #54) is registered next to drift, drift-summary and the corpus commands (batch, corpus, stats). replay keeps --analyzer and the per-analyzer schemes (research: compare the identity methods of SonarQube, Bandit and Semgrep #56).
• scan.py: Scanner keeps the pluggable analyzer (research: compare the identity methods of SonarQube, Bandit and Semgrep #56) and gains the per-category totals (Finding identity: 35-repository corpus, batch runner and statistics #55).
• requirements.txt: keeps research: compare the identity methods of SonarQube, Bandit and Semgrep #56's pinned research dependencies; matplotlib now also serves stats --plot.
• .gitignore: ignores tables/ as well as fidelity/.build/ and .cache/.
• README.md: keeps the Fidelity and RQ2 sections and the Corpus, Batch and Statistics sections. It now notes that the committed paper/ tables predate the sonar and bandit schemes and the line-separator fix, and that batch --force re-scores every scheme.

research: score drift spans file by file: drift mode pooled every compared file's findings into one list before scoring. That was harmless for the key-based schemes, whose keys include the path. The SonarQube tracker from #56, though, compares one file's findings and lines, so the pooled input let it pair findings across files. In the drift test it "mispaired" the finding of a renamed file with one from another file. Each file pair is now scored on its own, as the consecutive mode does, and the counts are summed. The chained ground truth is unchanged.

The drift tests looped over every scheme except line, with outcomes written for key-based schemes. Those loops now cover the key-based schemes, and sonar and bandit get explicit checks:

span	change	sonar	bandit
2	flagged line edited	loses the edited finding	keeps it (ignores location and code)
3	file renamed	keeps the renamed file's finding (compares the file pair, not paths)	loses it (compares the file name)
5	new copy of an old line	takes it for the old finding (hidden)	takes it for the old finding (hidden)

Test evidence

$ python -m pytest research/finding_identity/tests -q
118 passed, 1 skipped          # the skip is a live Semgrep test
$ python -m pytest -q
652 passed
$ ruff check research/ && ruff format --check research/
All checks passed!
39 files already formatted
$ MYPYPATH=src python -m mypy --strict research/finding_identity
Success: no issues found in 35 source files

Before the drift fix, the merged tree failed test_span_2_edit_loses_the_edited_finding (bandit) and test_span_3_file_rename_breaks_every_path_based_key (sonar: {'known_ok': 1, 'mispaired': 1, 'false_new': 1}).

Notes for reviewer

• The committed paper/ tables are out of date. They come from the corpus run of 2026-10-14, which scored only line, line_text, github and the codeguard family. The paper needs a re-run with batch --force to add the sonar and bandit columns.
• With --analyzer bandit or semgrep, the per-category totals put every finding under unknown, because the categories come from CodeGuard's rule registry. So stats has no security-only table for those runs.
• Once this is merged, claude/nice-allen-ptg63r can be deleted.