A Global Author-Identity Map for the World of Code:62.7M Developer Identities from 106.8M Author Strings over 5.87B Commits

Source: arXiv:2607.06183 · Published 2026-07-07 · By Audris Mockus

TL;DR

This paper addresses the critical problem of author identity resolution at massive scale in software repositories, as the same developer uses multiple author strings and the same strings may be reused by different developers. The authors release a curated global author-identity map for the World of Code (WoC) repository version V2604, covering nearly 5.87 billion commits and 106.8 million raw author strings folded into 62.7 million unique identities. Key innovations include a six-stage disambiguation pipeline combining attribute gating, structural cuts, and a logistic edge classifier to mitigate the dominant issue of over-merge (clumping). This map eliminates the previously encountered “mega-cluster” phenomenon, limiting the largest cluster to under 7,000 developer IDs versus millions in prior versions. As a result, they achieve a precision/recall tradeoff (0.88/0.70) on a human-curated gold dataset that is more pragmatic than prior overly optimistic estimates that ignored clumping. Additionally, they quantify how these identity resolution errors impact downstream developer metrics such as head count, productivity, and collaboration networks. The artifacts and pipeline are released alongside the WoC V2604 dataset in a self-contained package to enable replication and use.

Key findings

• The global alias map collapses 106.8M raw author strings into 62.7M canonical developer identities across 5.87B commits, raising human-id commit coverage from 66.3% to 98.17%.
• The largest identity cluster in the new map is 6,910 IDs versus 3,006,318 in the prior WoC V3 map, eliminating the “mega-cluster” over-merge problem.
• Against the ALFAA human gold set, the released map achieves recall 0.70 and precision 0.88, compared to V3’s apparent precision 0.95 which collapses to 0.52 when counting its mega-cluster.
• Without alias resolution (using raw author strings), developer population is inflated by +66.6%, with 40% raw IDs duplicate fragments. Median commits per developer remain 5, but p90 commits per dev rise from 65 to 99 after aliasing.
• Aliasing reduces spurious edges in the developer collaboration graph by 32%, dropping connected developers from 70% to 49%, and halves the apparent multi-developer projects from 36.3% to 16%.
• The six-stage pipeline, combining value gating, structural betweenness cuts, and logistic edge classification trained on 2.6M GitHub ID labels, dissolves mega-clusters while preserving recall through shingle expansions.
• Local within-project resolution recovers 47.8% of low-quality ambiguous IDs that the global map declines to merge, improving overall coverage.
• Bot and bad-attribute IDs comprise 5.42% of raw IDs but 8.46% of commits, dominating the most prolific raw identities and requiring explicit classification to avoid pollution of developer analytics.

Threat model

The adversary is effectively the noise and ambiguity in global software provenance metadata—developer aliasing via multiple names/emails and usage of generic or bot identities. The system assumes no centralized identity authority and that merges must avoid over-merge (clumping) to prevent corrupting downstream analyses. Attacks like intentional identity spoofing or adversarial author strings are out of scope but may exacerbate aliasing problems.

Methodology — deep read

1. Threat Model & assumptions: The adversary is implicit—repository-scale analysis suffers from noisy author identity metadata as developers use multiple email/name strings and many strings are generic or reused by distinct people. The assumption is no reliable centralized identity, and the problem is to unsupervisedly disambiguate authors globally without introducing massive over-merge (clumping).

2. Data Provenance & Size: Data consists of all public Git commits in WoC V2604—5,866,595,698 commits with 106,826,059 distinct raw author/committer strings. Two gold truth sets are used for validation: ALFAA human-rated pairs (~469k) focused on OpenStack, and a within-handle GitHub ground truth with 9.57M handles from single-account repositories.

3. Architecture & Algorithm: The pipeline has six stages: (1) link generation by emitting candidate same-person edges via shared exact email, name, or rare handle tokens; (2) value gating to neutralize bad attributes (generic names, shared emails, bots) via blacklist and name spread analysis; (3) structural gating by sampling betweenness centrality over the union graph to cut high-betweenness bridge IDs that weld disjoint communities (dissolving mega cluster); (4) edge classification with a logistic model trained on 2.6M free GitHub handle labels to prune homonym welds by scoring candidate pairs with features based on attribute spread, name/handle patterns, project overlap; (5) recall recovery by classifier-filtered expansion of dormant cross-project shingle edges combined with GitHub noreply account assertions; (6) selecting a canonical representative ID per cluster based on highest quality rules prioritizing real names and valid emails, plus within-project resolution of ambiguous low-quality IDs.

4. Training: The edge classifier is logistic regression trained on 2.6M auto-derived labels within GitHub handles (free labels). Hyperparameters and exact epochs are not specified, but it was selected for out-of-distribution generalization over a gradient-boosted alternative.

5. Evaluation Protocol: The map is evaluated jointly on splitting (1-recall) and clumping (1-precision) errors on ALFAA human gold data and GitHub handle ground truth. Prior WoC maps ignored clumping by excluding mega-clusters, giving artificially high precision. Statistical assessments include measuring largest cluster size and error composition. They also measure coverage on full commit corpus via provenance tags. Downstream analytic impact is assessed on developer counts, productivity, bus-factor, collaboration networks (co-project and co-file graphs), median/p90 metrics, and graph topology.

6. Reproducibility: All four artifacts (global alias map a2AFullSUG, per-ID classification A2clsFull, within-project resolution P2aAFull, commit-to-identity c2AFull) are co-versioned and released with WoC V2604. A fully self-contained replication package includes the entire pipeline implemented as SLURM jobs over sharded data, with code for link gen, gating, structural cuts, edge classifier training/scoring, map building, and evaluation harness. The classifier and pipeline are described in detail, but exact seeds are not reported. However, the replication package enables exact reproduction on WoC V2604.

Example End-to-End: For a given commit, the raw author string (e.g. multiple variants of "Jane Doe [email protected]") is mapped via global alias graph edges filtered by value gating and structural cuts into a canonical identity cluster, choosing a highest-quality representative. Ambiguous IDs in some projects that cannot be merged globally are resolved within single projects via P2aAFull. Every commit receives a provenance tag (global map, bot, within-project, or unresolved) enabling precise filtering of aliasing quality. This refined identity resolves commits previously scattered across multiple aliases, boosting human-id coverage to above 98%.

Technical innovations

• Introduction of structural gating via sampled betweenness cuts to break mega-clusters in the union graph that attribute-based gating cannot dissolve.
• A logistic edge classifier trained on 2.6M within-handle GitHub ID labels scoring candidate merges to prune false-positive homonym welds post-structural cut.
• Recall recovery using classifier-filtered expansions of dormant cross-project shingle overlaps combined with GitHub noreply account assertions, maximizing recall while controlling clumping.
• A per-identity classification taxonomy marking IDs as good, bad-by-attribute, local, bot, or partial to enable selective merging and downstream filtering.
• A combined global alias map plus within-project low-quality ID resolution layer to safely merge ambiguous identities in local scope without risking mega-cluster formation.

Datasets

• World of Code V2604 — 5,866,595,698 commits, 106,826,059 raw author strings — public WoC dataset
• ALFAA human-rated pairs — 469,000 pairs (label=2 matches) — human curated OpenStack-centric gold
• GitHub within-handle ground truth — 9.57M handles from 21.5M commits — internal, under submission

Baselines vs proposed

• Prior WoC map V3 (excluding mega-cluster): Precision 0.949, Recall 0.915 vs Proposed a2AFullSUG Precision 0.879, Recall 0.703
• Prior WoC map V3 (as shipped with 3M mega-cluster): Precision 0.522, Recall 1.000 vs Proposed a2AFullSUG Precision 0.879, Recall 0.703
• GitHub ground truth recall-only benchmark: Prior maps report near 1.0 recall due to blind clumping rating, new map achieves recall 0.60 (max9 scoring) and 0.56 (FullyMerged)
• Developer population raw 104.39M IDs vs core map 64.92M vs final map 62.67M (−40% over-estimate without aliasing)
• Co-project collaboration edges drop from 2.34B raw to 1.59B final map (−32% edges due to alias resolution)

Limitations

• Recall is still imperfect (0.70 on ALFAA gold), meaning some alias fragmentation remains, especially within single projects where global map abstains.
• Precision/recall tuning trades off some recall to contain mega-clusters; some split errors come from conservative gating and pruning.
• Classification relies on constructed labels and heuristics which may embed shortcuts and biases (e.g. noreply GitHub accounts).
• Evaluation benchmarks cover only OpenStack-centric and GitHub handles; generalization to other ecosystems is assumed but not verified.
• The pipeline is compute intensive and requires access to the entire WoC dataset and SLURM infrastructure for reproduction.
• The map is static (WoC V2604); its updating and handling of new incoming data remain future work.

Open questions / follow-ons

• How to further improve recall without re-introducing mega-clusters, especially for ambiguous identities in complex multi-project scenarios?
• Can dynamic, incremental map updates integrate new commits and identities without recomputing from scratch?
• How to generalize and validate alias resolution methods across non-GitHub ecosystems or private repositories?
• Can integrated identity linkages across software and scholarly domains scale reliably beyond current cross-corpus joins?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners building identity or behavior models over large-scale software repositories, this work exposes the critical challenge of author aliasing and the dangers of over-merge biases in identity resolution. Reliable author disambiguation is foundational to trustworthy developer analytics, anomaly detection, and attribution of suspicious behavior. The six-stage pipeline combining attribute gating, structural graph cuts, and supervised edge classification sets a new methodological standard for scalable, high-precision identity fusion in noisy crowdsourced and open-source ecosystems. Practitioners integrating author signals across corpora or linking code authors to external entities should be particularly wary of clumping effects that silently corrupt precision, and they can leverage the provided artifacts and pipeline to improve the quality and interpretability of identity-based features in bot and abuse detection systems.

Cite

@article{arxiv2607_06183,
  title={ A Global Author-Identity Map for the World of Code:62.7M Developer Identities from 106.8M Author Strings over 5.87B Commits },
  author={ Audris Mockus },
  journal={arXiv preprint arXiv:2607.06183},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.06183}
}

Read the full paper

• arXiv:2607.06183 (abstract)
• arXiv:2607.06183 (PDF)