Bad Egg v1: suspension advisory score

[jeffreyksmithjr]

Summary

Add a lightweight suspension advisory score ("Bad Egg") that flags PR authors who resemble suspended/malicious accounts. Computed from the same data Good Egg already fetches -- no additional API calls.

Evidence

Experiments on the bot-detection branch (PR #44), tracked in experiments/bot_detection/RESULTS.md:

• Iteration 10 (stage14): 10-feature balanced LR achieves AUC 0.65-0.68 for suspension prediction across 6 temporal holdout cutoffs.
• Iteration 11 (stage15): Feature ablation shows 3-feature model {merge_rate, median_additions, isolation_score} beats the full 10-feature model in every cutoff. 7 of 10 features are pure noise for suspension detection.

Scoring model

Balanced logistic regression with 3 features:

• merge_rate — fraction of PRs merged. Strongest single predictor.
• median_additions — median lines added per PR (log-transformed). Catches anomalous PR sizes.
• isolation_score — fraction of author's repos where no other multi-repo contributor works. Catches activity in obscure/abandoned repos.

Implementation tasks

• Add SuspicionScore model to models.py
• Add advisory tier computation to scorer.py (HIGH / ELEVATED / NORMAL)
• Calibrate tier thresholds against a cost model (current top-1%/top-5% are arbitrary)
• Add output formatting to formatter.py (Markdown, JSON, check-run)
• Wire into Action, CLI, and MCP interfaces
• Ship pre-trained LR coefficients as config (seed-free design, no hosted service needed)
• Verify cross-temporal stability of T_2024 coefficients before shipping

[jeffreyksmithjr]

Many proposed methodologies don't work with the data that GitHub makes available at a realistic scale. So, this proposal would be harmful and not help with bot detection.