Skip to content

docs: static analysis feature opportunities from review taxonomy#797

Merged
carlos-alm merged 5 commits intomainfrom
docs/static-analysis-opportunities-v2
Apr 4, 2026
Merged

docs: static analysis feature opportunities from review taxonomy#797
carlos-alm merged 5 commits intomainfrom
docs/static-analysis-opportunities-v2

Conversation

@carlos-alm
Copy link
Copy Markdown
Contributor

Summary

  • Adds static analysis feature opportunities report based on review taxonomy analysis
  • Includes Greptile review coverage analysis and taxonomy classification
  • Identifies actionable feature ideas derived from automated review patterns

Replaces #792 (rebased on current main).

Test plan

  • Docs-only change, no code impact

…onomy

Analyze 1,017 inline review comments across 300 PRs to identify which
problem classes codegraph could catch with new deterministic static
analysis features. Proposes 18 new check predicates organized into
prioritized tiers, with estimated catch rates per problem class.
@claude
Copy link
Copy Markdown

claude bot commented Apr 3, 2026

Claude finished @carlos-alm's task —— View job


Review Complete ✓

Todo List

  • Read and analyze the 3 added documentation files
  • Apply 5-phase review process from direct prompt
  • Check backlog compliance and foundation alignment
  • Provide comprehensive review feedback

Root Cause Analysis

Problem Being Solved: This PR addresses the strategic question of which static analysis features codegraph should prioritize by systematically analyzing 1,017 review comments across 300 PRs to quantify what types of issues could be caught by deterministic static analysis.

Why This Approach: Rather than building features based on intuition, this data-driven approach identifies the highest-impact static analysis opportunities by:

  1. Categorizing actual review findings from the project's history
  2. Mapping each category to feasibility using codegraph's existing data (AST, CFG, dataflow, graph)
  3. Proposing concrete features with quantified catch rates

Risk Assessment: LOW RISK — This is purely documentation that provides strategic planning data. No code changes, no dependencies added, no breaking changes.


Backlog Compliance

  • Zero-dep: ✓ — No new dependencies (docs-only change)
  • Foundation-aligned: ✓ — Fully aligned with P1 (always-current), P4 (zero-cost core), P8 (planning-focused)
  • Problem-fit: 5 — Directly addresses the core problem by identifying which features would prevent AI agents from missing blast radius and making incorrect assumptions
  • Breaking: No — Purely additive documentation
  • Tier: 1 — Zero-dep + foundation-aligned

Content Quality Assessment

Strengths

  1. Quantitative rigor: Analysis of 1,017 real comments provides solid empirical foundation
  2. Actionable prioritization: Features are ranked by catch rate and complexity
  3. Implementation roadmap: Clear 3-phase plan with realistic effort estimates
  4. Backlog integration: Thoughtful mapping to existing backlog items shows strategic coherence
  5. Foundation alignment: All proposed features respect the zero-cost, always-current principles

Technical Accuracy

  • ✅ Feature proposals correctly leverage existing data structures (AST, CFG, dataflow, graph edges)
  • ✅ Catch rate estimates appear realistic based on pattern complexity
  • ✅ Implementation dependencies properly identified
  • ✅ Breaking change assessments accurate

Minor Issues

  1. File organization: 3 large generated files could be consolidated or moved to a dedicated analysis directory
  2. Staleness risk: Analysis based on PRs refactor: domain error hierarchy (ROADMAP 3.8) #431-chore: release v3.8.1 #789 may become outdated as patterns evolve
  3. Validation gap: No mention of how proposed features would be validated against the original 260 "addressable" findings

Strategic Value

This analysis provides exceptional strategic value for several reasons:

  1. Evidence-based prioritization: Replaces gut-feeling feature decisions with quantitative data
  2. Quick wins identified: Tier A features (A1-A7) offer 50% coverage with low complexity
  3. Realistic scope: Acknowledges that 45% of issues require semantic understanding beyond static analysis
  4. Resource optimization: Prevents over-investment in low-impact features

The 18 proposed features are well-scoped and represent genuine value-adds that would materially improve codegraph's utility for AI agents.


Recommendations

APPROVE — with minor suggestions:

  1. Consider consolidation: The 3 files total 1,982 lines. Consider creating a dedicated docs/analysis/ directory or consolidating into fewer files.

  2. Add validation plan: Include a section on how the proposed features would be validated against the original review findings to ensure catch rates are accurate.

  3. Update tracking: Consider adding dates or PR ranges to make it clear when this analysis should be refreshed.


Final Assessment

## Root Cause Analysis
**Problem Being Solved**: Strategic prioritization of static analysis features using empirical data from 1,017 review comments
**Why This Approach**: Data-driven feature prioritization beats intuition-based roadmap planning
**Risk Assessment**: LOW — docs-only change with high strategic value

## Backlog Compliance
- Zero-dep: ✓ — No new dependencies
- Foundation-aligned: ✓ — Fully aligned with core principles
- Problem-fit: 5 — Directly addresses AI agent blast-radius blind spots
- Breaking: No
- Tier: 1

## Critical Concerns
None. High-quality strategic analysis document.

## Final Recommendation
- Rating: ⭐⭐⭐⭐☆ (4/5)
- Action: APPROVE WITH CONDITIONS
- Reasoning: Excellent strategic analysis with quantitative rigor. Minor organizational improvements suggested but not blocking.

This PR represents exactly the kind of evidence-based strategic thinking that mature projects need. The analysis quality is high, the methodology is sound, and the proposed features are well-aligned with codegraph's mission.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Apr 3, 2026

Greptile Summary

This PR adds three companion documents — a static-analysis feature opportunities report, a review coverage analysis, and a review taxonomy — derived from categorizing 1,017 inline review comments across 300 PRs. It is a docs-only change with no code impact.

The previously flagged issues are resolved: the taxonomy's Category Summary now has 16 rows summing to exactly 1,017, and the Executive Summary correctly distinguishes ~41% deterministic from ~15% heuristic coverage rather than attributing all 55% to deterministic analysis.

Three smaller documentation quality issues remain (all P2):

  • "18 new features" count is opaque: The Executive Summary states 18 features, but the Tiers section has only 15 labeled proposals (A1–A7, B1–B3, C1–C3, D1–D2). The discrepancy is technically correct — three proposals each bundle two check flags — but is non-obvious to readers counting Tier entries.

  • ROI table in coverage analysis and Tier proposals describe different sets of 18: The ROI table includes --expensive-in-loop (already in backlog, not new) and --untested-exports (no Tier ID), while omitting --no-dead-assignments, --no-unresolved-imports, and --no-param-mutation that do appear in Tier proposals.

  • "Cannot Catch" table sums to 349, not the stated 454: The six-row table sits under a line claiming 454 non-feasible findings; the remaining ~105 are real but not surfaced.

Confidence Score: 5/5

Safe to merge — docs-only change with no code impact; all prior P1 concerns are resolved

Both previously flagged issues (taxonomy totals and deterministic/heuristic conflation) are correctly addressed. Remaining findings are P2 doc-quality issues that do not affect correctness or decisions made from these reports.

docs/reports/static-analysis-feature-opportunities.md (lines 12 and 136–147) and generated/REVIEW_COVERAGE_ANALYSIS.md (ROI table, lines 318–342)

Important Files Changed

Filename Overview
docs/reports/static-analysis-feature-opportunities.md New report proposing 18 static-analysis features in Tiers A–D; exec summary correctly updated to separate ~41% deterministic from ~15% heuristic; minor count opacity and incomplete Cannot Catch table remain
generated/REVIEW_COVERAGE_ANALYSIS.md Coverage breakdown by feasibility tier; ROI table's 18 rows partially diverge from the 15 Tier proposals in the companion report
generated/REVIEW_TAXONOMY.md Category Summary now has 16 rows summing to 1,017 — prior fix correctly applied

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["1,017 review findings\n(300 PRs)"] --> B{Feasibility}
    B -->|"7.6% (77)"| C["Already catchable"]
    B -->|"32.8% (334)"| D["Feasible new feature"]
    B -->|"14.9% (152)"| E["Partially feasible\nheuristic"]
    B -->|"44.6% (454)"| F["Not feasible\nrequires LLM"]
    C --> G["~41% deterministic\n411 findings"]
    D --> G
    G --> I["Tier A - Quick Wins A1-A7\n~130 caught"]
    G --> J["Tier B - CFG Checks B1-B3\n+60 caught"]
    G --> K["Tier C - AST+Dataflow C1-C3\n+64 caught"]
    G --> L["Tier D - Compound D1-D2\n+8 caught"]
Loading

Reviews (3): Last reviewed commit: "fix(docs): correct stale-reference catch..." | Re-trigger Greptile

Comment on lines +540 to +552
| #545 | `\|\|` operator incorrectly used for numeric quality-gain fallback | P1 | `optimiser.js` |
| #775 | `parenDepthDelta` changes comma-split evaluation order | P2 | `query-builder.ts` |
| #722 | `->` right-assignment operator not handled correctly | P2 | `r.ts` |
| #708 | Kotlin `logical_node_type` covers only `&&`, not `\|\|` | P2 | `complexity.rs` |
| #642 | Qualifier ambiguity for bare `feat:` commits | P2 | `SKILL.md` |

</details>

#### String & Encoding (4) &mdash; P1: 1 | P2: 3

<details>
<summary>Show 4 comments</summary>

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Category Summary totals don't add up to 1,017

The 11 categories in the Category Summary table sum to 850, not 1,017 — leaving 167 findings unaccounted for. Three subcategories visible in the Top 15 list have no corresponding top-level category row:

  • Titan Pipeline / Procedure Gap — 55 comments
  • Stale / Outdated References — 52 comments
  • Shell Script / Check Logic Bug — 48 comments

Those three alone account for 155 of the 167 gap (the remainder likely lives in other unlisted subcategories). Either these need their own top-level category rows (e.g. Stale References, Process / Shell Scripts), or they need to be rolled up into an existing category (e.g. "Process" for Titan Pipeline and Shell Script) with the counts corrected accordingly. As written, the table claims 100% categorization but is missing ~16% of the findings.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed — added 5 missing top-level category rows (Titan Pipeline: 55, Stale/Outdated References: 52, Shell Script: 48, Display/Output: 9, Other: 3) to the Category Summary table so the rows now sum to 1,017.


### Impact by Problem Class

| Problem class | Review findings | Catchable | Catch rate | Primary data source |
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 "55% deterministic" claim conflates deterministic and heuristic

The Executive Summary states:

~55% of issues could be caught by deterministic static analysis

But REVIEW_COVERAGE_ANALYSIS.md breaks this down explicitly:

Feasibility Count %
Already catchable 77 7.6%
Feasible new feature 334 32.8%
Subtotal (deterministic) 411 ~41%
Partially feasible (heuristic) 152 14.9%
Combined 563 ~55%

The 55% figure is only reached by including "partially feasible" (heuristic) findings that the coverage analysis itself describes as having false positives. The coverage analysis correctly states "~41% deterministic … another ~15% heuristically." The Executive Summary should mirror that distinction — claiming all 55% are "deterministic" overstates the precision of the proposed checks.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed — the Executive Summary now correctly distinguishes ~41% deterministic from ~15% heuristic coverage, matching the coverage analysis breakdown. The combined ~55% is still stated but no longer attributed entirely to deterministic analysis.

- Add 5 missing top-level category rows to REVIEW_TAXONOMY.md Category
  Summary (Titan Pipeline, Stale References, Shell Script, Display,
  Other) so rows total 1,017 instead of 850
- Distinguish deterministic (~41%) from heuristic (~15%) coverage in
  Executive Summary instead of claiming all 55% as deterministic
- Fix "95% feasible" to "91% feasible" for Prepared Statement in Loop
  (10/11 = 91%, consistent with companion report)
- Clarify ~244 vs ~260 addressable count: ~260 is total catchable by
  problem class, ~244 is the subset addressed by the 18 proposed features
@carlos-alm
Copy link
Copy Markdown
Contributor Author

Addressed all Greptile feedback in ea8fad8:

  1. Category Summary gap (P1) — Added 5 missing top-level rows (Titan Pipeline: 55, Stale References: 52, Shell Script: 48, Display/Output: 9, Other: 3) so the table now sums to 1,017.

  2. "55% deterministic" conflation (P1) — Executive Summary now correctly states ~41% deterministic + ~15% heuristic = ~55% combined.

  3. "95% feasible" should be 91% (P1, outside diff) — Fixed to 91% (10/11), consistent with the companion report.

  4. ~260 vs ~244 addressable count (P2, outside diff) — Clarified labels: ~260 is total catchable by problem class, ~244 is the subset addressed by the 18 proposed features. Added explanatory note to the ROI table.

@carlos-alm
Copy link
Copy Markdown
Contributor Author

@greptileai

…on totals

Stale/Outdated References feasibility: 45% -> 52% (27/52, matching
the actual feasible count from the coverage breakdown). Feature report
Impact table and A4 description updated from 23/44% to 27/52%.

Priority Distribution P1/P2/P3 corrected to match Category Summary
column sums: P1 355->344, P2 521->522, P3/unmarked 139->149.
@carlos-alm
Copy link
Copy Markdown
Contributor Author

Addressed both remaining Greptile findings in 67d3855:

  1. Stale/Outdated References feasibility inconsistency — Coverage analysis header corrected from 45% to 52% (27/52), matching the actual feasible breakdown. Feature report Impact table and A4 description updated from 23/44% to 27/52% to match. All three representations now agree.

  2. P1 column rollup mismatch — Priority Distribution table corrected to match Category Summary column sums: P1 355→344, P2 521→522, P3/unmarked 139→149. The category-level data (which was corrected in the prior commit to sum to 1,017) is the source of truth.

@carlos-alm
Copy link
Copy Markdown
Contributor Author

@greptileai

@carlos-alm carlos-alm merged commit 699d5db into main Apr 4, 2026
12 checks passed
@carlos-alm carlos-alm deleted the docs/static-analysis-opportunities-v2 branch April 4, 2026 00:23
@github-actions github-actions bot locked and limited conversation to collaborators Apr 4, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant