# research(2026-09). The Stage 1 report carried ten \needcite badges because the intake
staged every entry as a search-level characterization. All but one are now cited: each source was
read against arXiv, the ACM Digital Library, the ACL Anthology or Springer, and four of the claims
built on them were wrong in a way a reviewer would have caught.
# research(2026-09). A sweep of this year's federated-LoRA privacy work, read for whether anyone
has now measured what RQ2 measures.
datasets/results/interval-calibration.json, scripts/interval_calibration.py. Section 7 of the
report states the pairs cluster bootstrap's false-positive rate under a true null. That figure has
been living in a comment in measure/stats.py since it was measured, with no artifact behind it,
which is the one thing a registered report cannot do with a number a reviewer will check.
*-c128-p2.json. The 128-example run said leakage is a function of how long each client trains.
It was one packing, so who shared a client with whom was decided once, and the reading rested on
two points that differ in size as well as in length. This is the same 51 clients, the same
training seed, the same 128 examples each, repacked with packing seed 2: the only thing that moves
is which examples group into which client.
A fresh context reviewed the previous day's corrections without being told why they were written. Nothing blocking; every committed result it regenerated reproduces from HEAD, and it confirmed the factor geometry computes A minus the broadcast initial A and records that file's hash. Its serious finding was about the tests rather than the code: 24 of 59 mutants survived the suite, among them the probe fix's own regression test, which could not fail on a mutant that restored the very behaviour it was written for, because its fixture scored 1.0 and only a label on the result told the versions apart.
The review found the raw probe reading 0.841 with an interval of [0.814, 0.836]. The cause was the procedure, not the interval formula: each bootstrap resample refitted the classifier on changes drawn with replacement, about 63% of them unique, so every refit trained on less and scored lower, and the resampled accuracies sat below the estimate by more than their own spread. A bias-corrected (BCa) interval was tried first and made it worse -- [0.839, 0.839] -- because any interval built from quantiles of the draws cannot contain an estimate that every draw falls below.
scripts/subspace_split.py, rewritten after the review. Every attribution cell now carries its
exact project-level p over the 84 groupings, accuracy is reported beside balanced accuracy, the
basis for each scored client is refitted without its whole project (the stricter refit the
review proposed), the degenerate rank-1 shared cell is not scored, and the best cell over ranks is
judged against the null's best over the same ranks.
The four committed aggregate-attack results were rerun from a clean tree with the permutation now
in aggregate.project_permutation: distinct groupings, the truth checked to reproduce itself, four
round-draw seeds each. Provenance now names the commit that produced them and would list any
uncommitted code; these list none.
Three independent reviews reran today's analyses against the committed data. Findings that change what this log says, stated here before any is fixed:
The one mechanism for organizational coherence still standing is shared code conventions. It predicts something the convention-shape probe can measure without any adapter: within an organization, how separable its C++ projects are from one another when read only as convention shapes. Separability near 0.5 means the projects write alike; high separability means each project has its own conventions.
# research(2026-09). Checked on their abstract pages: Kumar, Lones, Maarek and Zantout,
"Fine-Tuning Models for Automated Code Review Feedback" (arXiv:2605.12610, May 2026), fine-tune Code
Llama on feedback distilled from a proprietary model, for student Java code. Begolli, Aksoy and
Neider, "Fine-Tuning Multilingual Language Models for Code Review: An Empirical Study on Industrial
C# Projects" (arXiv:2507.19271), pool public benchmarks with industrial repositories into one
training corpus. Neither trains per project or per organization, and neither evaluates an adapter
on another organization's data. The matched-against-mismatched contrast RQ1 registers, which asks
whether an adaptation is specific to the organization it came from rather than to the task, does
not appear in either.
At 256 examples, AOSP's system/core (204 usable examples) cannot fill one client, and the job refused to drop the source silently. Run anyway, AOSP would fall to two projects and four clients, and the project-level permutation from 84 arrangements to 28, with a floor of 1/28 rather than 1/84. That would be a different and weaker test on a thinner set, not a further point on the same curve, so it is not run. Long local training needs larger per-project corpora, which is what the ten-project AOSP rebuild is for.
From the raw change records, which carry salted pseudonyms for each change's owner, submitter and attention set: for each C++ project in the committed source list, the set of accounts that appear on its changes, and for each organization the mean Jaccard overlap between the account sets of its different projects. No account is identified; only set sizes and intersections are read.
Two explanations for Qt's permutation moving from p = 0.238 at 64 examples a client to the 1/84 floor at 128 were tested and failed: pairwise coherence (Qt stays at -0.0005 at 128) and, post hoc, centred centroid coherence (Qt is positive at both lengths and lower at 128, +0.109 to +0.047). Rather than generate a third, this tests the confound the training-length entry already named: the two sets differ in composition as well as length, because packing at 128 leaves fewer clients per project (AOSP's system-core falls from three clients to one, frameworks-av from four to two).
If an organization is detectable exactly when its projects resemble each other more than they resemble an outsider's, that property is one number per organization: