🔬 physics

Building Digital Societies as Ecosystems: How Recognition and Repeat Relationships Sustain Cross-Community Work in Open Source

This study analyzes a decade-spanning cybersecurity open-source ecosystem to demonstrate that cross-community collaboration is sustained by a thin layer of highly recognized contributors who reduce boundary friction through repeat relationships, revealing a cohort-based survival pattern that establishes a critical baseline for understanding social dynamics in future AI-mediated digital societies.

Original authors: Lucia Gomez Tejeiro, Thibaut Chataing, Julian Jang-Jaccard, Alain Mermoud, Thomas Maillart

Published 2026-05-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Lucia Gomez Tejeiro, Thibaut Chataing, Julian Jang-Jaccard, Alain Mermoud, Thomas Maillart

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, bustling digital city built entirely by volunteers. This city isn't made of bricks and mortar, but of code. It's the world of Open Source Software (OSS), specifically focused on cybersecurity tools. In this city, there are thousands of different neighborhoods (projects) where people build specific tools like locks, alarms, or scanners.

This paper is a study of how these neighborhoods stay connected and how the whole city survives, even when some neighborhoods fall into disrepair. The researchers looked at data from over 20 years (2001–2022) involving nearly 11,500 people and 464 projects.

Here is the story of their findings, explained simply:

1. The City is Growing, But It's Changing Shape

In the early days, the city was just a few scattered villages. Then, a major highway opened (the launch of GitHub in 2008), and people started building neighborhoods much faster.

The Growth Spurt: The number of neighborhoods grew rapidly until about 2018.
The Plateau: After 2018, the city stopped adding new neighborhoods at the same rate. It hit a "carrying capacity."
The Secret Problem: Even though the city looked big and busy, the average amount of work happening in each neighborhood started to drop years before the growth stopped. It was like a party where the music kept playing, but the guests were slowly leaving the dance floor.

2. The "Super-Connectors" (The Carrier Layer)

This is the most important discovery. In a city with hundreds of neighborhoods, how do they talk to each other?

The Lonely Majority: 91% of the volunteers only ever work in one neighborhood. They are like people who only ever visit their own local park.
The Super-Connectors: A tiny, tiny group of people (only 9 individuals out of 11,000+) are the "Super-Connectors." These are the people who hop between 7 or more different neighborhoods.
The Magic Bridge: These 9 people (and a slightly larger group of about 50) do the heavy lifting of connecting the city. They author more than half of all the "handshakes" (pull requests) that happen between different neighborhoods. Without them, the city would be a collection of isolated islands.

3. The "Trust Tax" (Friction vs. Recognition)

When a volunteer tries to help a neighborhood they don't belong to, it's usually hard.

The Stranger's Struggle: If a "one-time visitor" (someone who usually works in just one place) tries to fix code in a different neighborhood, their request is often rejected or takes a very long time to get approved. It's like a stranger trying to enter a private club; the bouncer is suspicious, and the process is slow.
The VIP Pass: However, for the Super-Connectors, the rules are different. Because they have been there before and have built a reputation, they get a "VIP pass." Their requests are accepted almost as quickly as if they were working in their own neighborhood.
The Lesson: The friction isn't because the neighborhoods are mean; it's a recognition cost. You have to build trust over time. The Super-Connectors have already paid that cost, so they can cross boundaries easily.

4. The "New Kid" Problem (Cohort Hazard)

The study found that the age of a neighborhood matters a lot for its survival.

The Old Guard: Neighborhoods built before 2010 are very stable. They have had time to build trust and find their Super-Connectors.
The New Kids: Neighborhoods built after 2017 are in big trouble. They are much more likely to "die" (stop being updated) quickly.
The Gap: Even though the Super-Connectors are still working hard, they aren't reaching the new neighborhoods fast enough. The new neighborhoods are "under-served." They don't have the VIPs visiting them yet, so they struggle to survive.

5. Why This Matters for the Future (The AI Warning)

The researchers stopped collecting data in May 2022, right before Artificial Intelligence (AI) coding assistants became popular. They argue that this data is a crucial "baseline" to compare against the future.

What AI Might Fix: AI might help write code faster or fix small errors, which is great.
What AI Might Break: The study suggests that AI cannot easily replace the human trust built by the Super-Connectors.
- If an AI writes a code fix for a neighborhood it doesn't belong to, will the neighborhood trust it?
- If AI replaces the human "Super-Connectors," who will build the relationships that make the city work?
- The paper warns that we shouldn't try to "optimize away" the human social fabric. The trust that allows these 9 people to bridge the gaps is the glue holding the digital society together. If we replace them with bots, we might lose the ability to recognize who is trustworthy, and the whole city could become fragile.

Summary

The paper tells us that a digital society works not because everyone is nice, but because a tiny, dedicated group of people builds trust across different groups. They pay a "tax" of time and effort to prove they are reliable, and once they do, they can move freely.

The danger for the future is that if we rely too much on AI to do the connecting, we might lose the human element of recognition that keeps the system stable. The city needs its Super-Connectors, and we need to understand that their value isn't just in the code they write, but in the trust they carry.

Technical Summary: Building Digital Societies as Ecosystems

Problem Statement
Open Source Software (OSS) has evolved from an economic curiosity into critical infrastructure mediating physical systems and public services. While intra-project dynamics (heavy-tailed contribution, bursty activity) are well-documented, the mechanisms sustaining inter-project collaboration across community boundaries remain under-studied. Specifically, it is unclear what holds an OSS ecosystem together when individual projects fail or are abandoned, and how the "boundary friction" of cross-community work is managed. The paper addresses the question: What sustains an OSS ecosystem when individual projects come and go, and how do recognition and repeat relationships facilitate cross-boundary work?

Methodology
The study reconstructs a bipartite contributor–repository graph using data from the Rawsec Cybersecurity Inventory, covering 464 cybersecurity-focused projects and 11,372 contributors active between October 2001 and May 2022.

Data Processing & Identity Canonicalization:
- The authors merged commit data from the GitHub REST API with collaboration event data (including rejected PRs and reviews) from the GitHub Archive (via BigQuery).
- Contributor identities were canonicalized by mapping numeric author IDs to login strings, filtering out 11 explicit bots and 688 "phantom" git identities, resulting in a dataset of 10,490 canonical human contributors.
- Repositories were weighted by interaction frequency ( $\log(1 + c)$ , where $c$ is the commit count).
Community Detection:
- Louvain community detection (resolution = 0.5) was applied to the weighted bipartite graph, identifying 163 non-singleton communities.
- The study explicitly avoids one-mode projections (e.g., contributor–contributor networks) to prevent inflating degrees and obscuring the asymmetry between occasional co-presence and sustained co-affiliation.
Analytical Framework:
- Breadth Analysis: Measured by the number of distinct communities ( $k$ ) a contributor touches at the commit level.
- Depth Analysis: Operationalized through five indicators stratified by whether the submitter's home community matches the recipient repository's community:
  1. Pull-request (PR) acceptance rate.
  2. Integration latency (turnaround time).
  3. Review-state mix (share of PRs receiving "CHANGES REQUESTED").
  4. Issue discussion depth (comment count).
  5. Contributor retention after boundary crossing.
- Survival Analysis: Communities were tracked for "residualisation" (activity dropping below 5% of their mean yearly commits). A Cox proportional-hazards model and Kaplan–Meier estimators were used to analyze survival probabilities relative to cohort (birth year), size, and cross-community connectivity.

Key Contributions & Results

1. Structural Anatomy and Scaling

Superlinear Scaling: The number of contributors scales superlinearly with the number of repositories ( $n_{contributors} \sim n_{repos}^{1.4}$ ), indicating that larger repository portfolios attract disproportionately more contributors.
Logistic Saturation: Community formation follows a logistic trajectory, saturating around 2018 ( $K \approx 252$ communities). The ecosystem shifted from a growth phase driven by new community formation (extensive margin) to a phase where per-community intensity declined (intensive margin) starting in 2014.

2. The "Carrier Layer" of Cross-Boundary Work

Extreme Concentration: Cross-community work is sustained by a numerically thin "carrier layer." Only 9 canonical humans span 7 or more communities ( $k \ge 7$ ).
Volume Contribution: These 9 individuals author 14% of all 4,015 inter-community merged PRs. The top 50 cross-community contributors produce 54% of this volume.
Rank Correlation: Commit-level breadth and PR-level cross-boundary activity are nearly perfectly rank-ordered ( $\rho = 0.96$ ), confirming that the same minority absorbs the integration cost.
Fragility: 52% of the 163 communities currently lack any active cross-community contributor, leaving them exposed to fragmentation.

3. Recognition and Friction Gradient

Boundary Friction: Inter-community PRs generally face higher friction: a 20.8 percentage-point lower acceptance rate (61.1% vs. 81.9%) and 2–4x longer integration latency compared to intra-community PRs.
The Recognition Mechanism: Friction is not a fixed property of the boundary but a cost of recognition.
- For single-occurrence submitters ( $k=1$ ), inter-community acceptance is only 42%, with a median latency of 147 hours.
- For high-breadth contributors ( $k=5–9$ ), acceptance rises to 87%, and latency compresses to 49 hours (near-intra-community speeds).
- This suggests that repeat cross-boundary submissions accumulate trust, effectively removing the friction barrier.

4. Cohort-Structured Survival

Cohort Hazard: The annual hazard of a community entering a residual (dormant) state rises an order of magnitude for cohorts born after 2010 compared to pre-2010 cohorts.
Predictive Power: While cross-community connectivity (PR share) is protective in multivariate models ($HR = 0.11$), the effect of external reach is largely mediated by community size.
The Tension: The stable carrier layer does not guarantee survival for late-born cohorts. Despite the existence of the carrier layer, late-cohort communities are over-represented in residualisation events, indicating a mismatch between the supply of cross-boundary attention and the needs of newer communities.

Significance and Claims
The paper posits a "recognition / repeat-relationship" account of sustained cross-boundary work. It argues that modular ecosystems are workable not because friction is absent, but because a small set of recurring contributors absorbs it through accumulated trust.

Pre-AI Baseline: The corpus closes in May 2022, immediately before the mainstream diffusion of Large Language Model (LLM) coding assistants. The authors present their findings as a measurable pre-AI baseline.
Optimization Limits: The paper claims that while AI might optimize away boilerplate or dependency hygiene, it cannot easily replicate the human social fabric of trust accumulation that the recognition mechanism relies on.
Digital Societies: The study frames OSS ecosystems as a template for "digital societies." It suggests that the "carrier layer" is not merely infrastructure to be made efficient, but a fundamental mechanism by which a community recognizes its collective work.
Caution on AI: The authors warn that blindly applying AI-driven routing or optimization could erode the trust mechanisms that sustain cross-boundary collaboration, potentially making ecosystems more fragile to unanticipated shocks (a "robust-yet-fragile" regime).

The paper concludes that the measurement strategy used (carrier-layer identification, friction-gradient stratification, and survival analysis) is transportable to any time-evolving bipartite interaction system where boundary-crossing carries an integration cost, such as citizen science or federated data ecosystems.