# Owner Map

> Paste a git-history export. Owner Map measures who holds the recent knowledge of every file,
> which sensitive paths have a bus factor of one, whose files have lost their owner, and where a
> CODEOWNERS file claims something the history contradicts - then reviews the risk, plans the
> knowledge transfer, or splits an in-flight change set into pull requests that each need the fewest
> reviewer groups.

- URL: https://owner-map.skillsafe.ai/
- API tutorial: https://owner-map.skillsafe.ai/api.html
- API base: https://api.skillsafe.ai/v1/app-api (app slug `owner-map`)
- Model: `gpt-terra` (currently resolves to `gpt-5.6-terra`), publisher markup 1000 bps
- Hosting: SkillSafe. Static bundle, strict CSP, no server code.

## What problem it solves

Every engineering organisation has files that one person understands and nobody else does, and
almost none of them can name those files. `CODEOWNERS` does not answer the question, because it
records who was assigned, not who has done the work. Owner Map answers it from the one record that
cannot be edited after the fact: the commit history.

The measurement is deterministic and runs entirely in the browser. Only the three judgement lanes
are metered, and they receive the aggregate, never the log.

## How the numbers are computed

- **Knowledge score**, per author per file: the sum over that author's commits touching the file of
  `0.5 ^ (age_in_days / 365) * (1 + log10(1 + lines_changed))`. The half-life is one year, so a
  commit from four years ago counts about a sixteenth of an identical one from today. The log term
  stops a 900-line vendored update outranking ten real fixes.
- **Ownership share**: an author's knowledge score over the file's total.
- **Bus factor**: the smallest number of authors whose shares add to 0.5 - how many people have to
  be unavailable before half the recent knowledge of that file is gone.
- **HHI**: the sum of squared shares, 0 to 1. It distinguishes "one owner and one deputy" from "one
  owner and five occasional contributors".
- **Risk score**, 0-100: additive and fully decomposed on the page - bus factor 1 (+34, +12 more
  when one author holds 80% or more), a sensitive-path match (+22), an owner marked left or on-leave
  (+26), untouched for more than 540 days (+8), sensitive with no CODEOWNERS rule (+14), high churn
  (+6). Generated output is discounted to a fifth; a file with one or two human commits in the
  window is capped, because that is not ownership.
- **Bots hold no ownership.** Commits by dependabot, renovate, release bots, semantic-release and CI
  identities are counted in the totals and reported separately, but earn no share - knowledge a bot
  holds cannot be handed over, and without this correction a weekly dependency bump makes the bot
  the largest owner of every lockfile-heavy directory.

## The CODEOWNERS reality check

Git applies the **last** matching rule. Three distinct failures are reported, because each needs a
different fix:

- **gaps** - a path no rule matches at all, so a change there needs no named reviewer.
- **mismatches** - a rule whose declared owners are not among the three biggest contributors to the
  code they are supposed to review.
- **rules that own nothing** - either `no-such-path` (the rule points at paths this history does not
  contain) or `shadowed` (a later rule wins on every path it matches, e.g. `/docs/ @team` followed
  by `*.md @guild`; the shadowing rule is named).

## Input contract

One `git log` export is the work object for all three lanes:

```
git log --no-merges --numstat --date=short --pretty=format:"::%H|%an|%ae|%ad|%s"
```

The default `git log --numstat` shape is also parsed, but carries no commit subjects. Three optional
inputs change the answer more than anything else: the CODEOWNERS file, a list of who has left or is
on leave, and the glob patterns that count as sensitive.

The run input the page submits is a JSON object - `{"task", "repo_label", "notes", "facts"}`, plus
`"changed_files"` for the split lane. `facts` is the aggregate: totals, per-author shares and
statuses, the ranked file table with per-file top contributors, the directory rollup, the CODEOWNERS
findings, the flags, and a bounded low-discrepancy sample of commit subjects. The raw history is
never part of the payload. Note that the run body **is** that object - it is not wrapped in an
`input` key.

## Output contract

One JSON object, the same envelope for every lane: `lane`, `lane_inferred`, `title`, `posture`
(`healthy` | `watch` | `at-risk` | `critical`), `verdict`, `summary`, `headline_numbers`,
`findings[]` (`id`, `title`, `severity`, `path`, `owner`, `evidence`, `why`, `action`, `effort`),
`coverage_check[]`, `artifact`, `next_lane`, `assumptions`, `open_questions`, and a per-lane `body`:

- `risk` - `body.owner_notes`, `body.codeowners_actions`; artifact is a CODEOWNERS draft.
- `handover` - `body.pairings`, `body.phases`, `body.at_risk_if_delayed`; artifact is a dated plan.
- `split` - `body.prs`, `body.leftovers`, `body.merge_order`; artifact is the PR plan.

## Accountability

The measurement raises flags with stable ids (`SPOF-1`, `ORPH-2`, `GAP-3`, `MISM-1`, `SHAD-1`,
`DEAD-1`, `CONC-1`, `EXIT-1`). Every critical or high flag must come back in the reply's
`coverage_check` as `confirmed`, `set-aside` or `superseded`. Any that does not is displayed on the
page as unreviewed rather than silently dropped. In the split lane the app also checks that every
file in the change set was placed in exactly one pull request or explicitly left out.

## What it will not tell you

Who *understands* a file as opposed to who edited it; who reviewed the changes; who wrote the design
document; who is on the team this week. It never runs `git`, never authenticates against a forge and
never writes to your disk.

## Free without an account

The parser, the full ownership table, the people table, the CODEOWNERS reality check, the flags, the
generated CODEOWNERS draft, and the CSV/JSON exports. Also a saved model reply for each of the three
lanes, rendered by the real render path.

## Sources

A derived work built on three published agent skills, credited in the footer and in the prompt:

- `@openai/security-ownership-map` - the security-oriented ownership topology, bus factor and
  CODEOWNERS reality check.
- `@sickn33/git-pr-workflows-onboard` - onboarding and knowledge transfer for git and pull-request
  workflows.
- `@nvidia/mcore-split-pr` - splitting a change set to reduce the number of required CODEOWNERS
  reviewer groups.

Not affiliated with those skills' authors, nor with Git or GitHub. Git is a trademark of Software
Freedom Conservancy.