Static repository ownership files often fail to reflect who actually reviews and maintains codebases over time. Developer Srishti Pandey developed an open-source tool named Provenance to investigate this discrepancy using graph databases, exposing how rarely listed code owners match actual contributors.
The Flaws in Traditional Code Ownership Files
Code repositories typically rely on configuration files to designate who owns specific modules, but these documents rarely update automatically when team members transition or responsibilities shift. To measure this gap, the developer loaded roughly 180 days of pull request history from the Home Assistant core repository into FalkorDB, a dataset encompassing thousands of modules and contributors. Upon checking whether listed owners actually participated in pull requests touching their assigned modules, the analysis revealed a stark mismatch. Across the dataset, the designated owner acted as the actual reviewer only about 14 percent of the time, demonstrating that static ownership files are frequently inaccurate.
Leveraging Graph Databases for Relationship Mapping
Moving beyond basic relational storage, the project models people, modules, pull requests, and decisions as interconnected nodes, while relationships like authorship, reviews, and module dependencies form the edges. Using Cypher queries and built-in PageRank algorithms, the system can trace multi-step dependencies to determine what breaks if a key maintainer departs. To maintain trustworthiness, Provenance includes a built-in code verifier that automatically replays queries behind every generated claim. If the resulting numbers fail to match the initial facts, the system drops the claim entirely rather than displaying unverified data, combining graph traversal with strict automated validation checks.
Analysis: Uncovering Hidden Project Risks and Expertise Gaps
The disconnect between static documentation and actual developer activity introduces severe, hidden risks into software maintenance. When organizations rely on outdated ownership records, code reviews routinely route to the wrong individuals, leaving critical knowledge silos unmanaged and new contributors without proper guidance. The graph-based approach demonstrated in this project transforms how engineering teams assess vulnerability by exposing single points of failure that traditional file structures conceal. For instance, evaluating the Home Assistant dataset showed that if a prominent contributor stops reviewing, numerous core modules lose their only recent expert coverage, cascading across hundreds of dependent modules downstream. While graph algorithms excel at finding frequent collaborators and structural bottlenecks, hybrid approaches that combine graph ranking with traditional text search prove necessary for handling new or rarely touched code modules where historical data is scarce. Ultimately, adopting dynamic, verifiable tracking helps engineering leads anticipate departures, distribute reviews effectively, and prevent critical system components from becoming abandoned blind spots.
System Architecture and Getting Started
Built with a FastAPI backend and a React TypeScript dashboard, the open-source repository provides multiple automated agents for routing, verification, and historical analysis. Running the project locally requires Docker Desktop for FalkorDB, Python 3.11 or newer, Node.js 20 or newer, and a valid GitHub token to fetch public repository data. Once configured, developers can load graph data, run local API services, and explore interactive coordination and tenant isolation demos. Licensed under the MIT License, the source code and complete setup steps are publicly available for engineering teams aiming to audit their own dependency structures and reviewer expertise.
Editorial graphic and headline text by Signal Titans.
Source: CODEOWNERS Is a Lie. I Built a Graph to Prove It. · GitHub – srishtipandey1/provenance: A graph-powered tool for understanding code ownership, reviewer expertise, and project risk. · GitHub
SIGNAL TITANS
Leave a Reply