Offshore regression recurrence research

Key Stats

• Six evidence signals: original cause, repair version, new trigger, same-path recurrence, owner transfer, corrective action
• One frozen population and observation window
• Two independent reviewers for a planned subset

Key Takeaways

• Preserve versioned evidence and chronology.
• Separate preparation from technical risk acceptance.
• Verify the intended artifact and runtime result.

Research protocol

Research question. This study asks why closed engineering defects recur and which patterns identify evidence, ownership, code, test, or release gaps. It examines defects reopened after recorded repair across applications and infrastructure. The output is a reproducible evidence register and owner packet, not a claim that a system is secure, correct, compliant, or ready for release. NIST SSDF supplies a primary framework for software-development roles and practices; NIST SP 800-53 supports access, audit, configuration, and change-control evidence; OWASP ASVS supplies application verification context. Company architecture, product, security, and release owners determine actual treatment.

Population. Include successful, failed, cancelled, superseded, rolled-back, transferred, and reopened items. Each row retains repository, service, environment, stable issue ID, source commit, artifact or configuration version, intake time, queue state, reviewer, decision event, implementation, and final disposition. Primary observations are original cause, repair version, new trigger, same-path recurrence, owner transfer, corrective action. Freeze selection before outcomes and record every exclusion. Secrets, personal data, customer records, and restricted logs remain in approved systems with masked references.

Chronology. Retain original timestamp, timezone, actor or automation, system, and stable event ID for request, commit, review, test, build, deploy, alert, rollback, and verification. Add UTC without replacing originals. Review-ready, reviewer acknowledgement, evidence request, response, decision, implementation, and verification are distinct. This prevents missing-evidence time from being attributed to a reviewer and deployment time from being attributed to the developer. Clock or log gaps remain explicit limitations.

Source preservation. Original requirements, architecture decisions, issue history, commits, lockfiles, schemas, configurations, test outputs, build records, artifacts, approvals, and runtime evidence receive stable identifiers or hashes where permitted. Extracted fields link to source and version. Current main, latest image, or final dashboard cannot prove what existed earlier. Superseded artifacts remain connected through explicit change events rather than being overwritten by the successful result.

Classification. Review original cause, repair version, new trigger, same-path recurrence, owner transfer, corrective action as aligned, different, missing, superseded, not applicable, or owner interpretation required. Calculations show inputs, denominators, exclusions, precision, and result. Matching tags, green status, familiar filenames, or prior behavior are not proof. Those observations guide review but cannot resolve contract compatibility, customer impact, production authority, security acceptance, release scope, or business risk.

Independent review. Two reviewers receive the same frozen evidence and independently record signals, missing evidence, defect classification, current owner, stop condition, and bounded decision request. Agreement is measured separately for facts, risk flags, routing, and closure. Disagreements are adjudicated against sources and definitions, not by choosing the faster answer. Original reviewer responses remain retained so later taxonomy improvement does not erase earlier ambiguity.

Challenge cases include similar artifact names, rebuilt tags, timestamps near cutoff, approval followed by a commit change, automation without attributable actor, overlapping reviewers, transferred incident, rotated secret, rejected deployment retried, and closure followed by new evidence. The method passes when reviewers reconstruct the same sources, chronology, differences, and decision point. It fails when current state replaces historical evidence or a developer accepts a controlled exception to improve a metric.

Authority. Offshore developers may reproduce behavior, prepare code, tests, comparisons, runbooks, and evidence queues. They may not broaden privileged access, disclose secrets, change public contracts, approve their own high-risk exceptions, accept security or accessibility risk, or deploy outside release authority. Application, platform, data, product, security, accessibility, and release owners retain assigned decisions. A missing owner is reported as a design defect rather than absorbed by the preparer.

Measures include population completeness, artifact lineage, test evidence, review acknowledgement, decision time, implementation time, reviewer agreement, rollback readiness, reopened defects, repeated causes, and verified closure. Report distributions and denominators, not only averages. Stratify by change type, service, risk, owner role, and workflow when samples permit. Do not rank individuals by raw speed, commits, merges, or tickets. A correct controlled stop can take longer.

Sampling reflects the decision. Include every predefined high-consequence case, then select ordinary work reproducibly. Do not replace inaccessible logs or artifacts with convenient records while preserving sample size. Keep selected, available, reviewed, excluded, unscorable, replaced, and unresolved counts separate. Compare original and final samples by risk, service, age, change type, and outcome. Publish concentrated missingness rather than letting a clean subset represent the engineering population.

Limitations include overwritten logs, inaccessible SaaS systems, shared identities, clock drift, nondeterministic builds, mutable dependencies, policy ambiguity, informal decisions, and small samples. The study cannot prove absence of defects, security, legal compliance, causation, or future reliability. Its conclusion is narrower: why closed engineering defects recur and which patterns identify evidence, ownership, code, test, or release gaps can be examined when population, versions, chronology, roles, classifications, decisions, implementation, and limitations remain visible.

Pilot a normal change, missing-source path, environment conflict, urgent defect, and post-approval change. Ask an independent reviewer to reconstruct the same signals and owner question. Dependence on private chat, local state, memory, or undocumented tools becomes a gap. The owner decides whether to change repository controls, CI, runbook, access, or review cadence. A pilot tests workflow; it does not prove every future change behaves the same.

Actions link recurring findings to mechanism, owner, evidence, target date, acceptance test, and post-change observation. Missing timestamps may call for logging; mutable artifacts for digest enforcement; ownership ambiguity for code-owner rules; inconsistent decisions for approved examples. Training is not the default when tooling, test data, interfaces, or authority maps are unclear. Retest changed and unaffected cases and preserve the old measurement.

Reporting separates observations, interpretations, recommendations, and decisions. Observations cite records; interpretations state assumptions; recommendations name mechanisms; decisions identify authorized people and times. Negative findings identify tests because “no issue” without method is not evidence. Retain extraction time, query version, reviewer, population, denominators, unavailable evidence, unresolved high-risk cases, and next verification point.

Access and separation of duties are tested alongside code and artifacts. Reviewers receive minimum read permissions for frozen evidence; preparation does not require authority to merge, deploy, change configuration, rotate production credentials, approve exceptions, or alter customer data. Record individual identities for material actions and set expiry for temporary access. When evidence cannot be obtained safely, route the gap to the platform or security owner. Broader permission granted merely to finish a study can introduce more risk than the research question justifies and make later reproduction depend on exceptional access.

The final decision brief states what evidence supports and cannot support. It names population and period, shows denominators, describes unavailable artifacts or logs, distinguishes association from causation, and identifies unresolved high-risk changes under controlled access. It does not generalize one offshore engineering lane to all developers, providers, systems, or future releases. Management may expand, retain, narrow, pause, or repair the lane. The chosen action records owner, rationale, effective time, affected repositories and environments, rollback considerations, and next verification so research ends with accountable use instead of a detached percentage.

Continuity testing gives a backup reviewer only retained study materials and asks that person to reproduce selection, classifications, measures, and owner questions. Missing query logic, local fixtures, private dashboards, timezone assumptions, or undocumented exclusions become explicit defects. Repair them before repeating analysis. Store the approved method beside the output and preserve superseded versions. A later reviewer should explain why corrected evidence, a larger population, or revised definition changed a result without suggesting either period was manipulated.

Primary sources checked October 8, 2026: NIST Secure Software Development Framework, https://csrc.nist.gov/pubs/sp/800/218/final; NIST SP 800-53 Rev. 5, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; OWASP Application Security Verification Standard, https://owasp.org/www-project-application-security-verification-standard/. These sources inform evidence design. They do not certify a team, codebase, product, deployment, or provider.

Evidence table

Good distributed work is observable at the handoff: the result, evidence, limitations, and next owner are all explicit.

Frequently asked questions

Related Research