Building digital societies as ecosystems: how recognition and repeat relationships sustain cross-community work in open source

Abstract

Abstract We measure cross-boundary collaboration in an open-source software (OSS) ecosystem by reconstructing the bipartite contributor–repository graph of 464 cybersecurity-focused projects and $11{,}372$ 11 , 372 contributor identities active over October 2001–May 2022, seeded from the curated Rawsec Cybersecurity Inventory. Louvain community detection identifies 163 non-singleton communities; per-community contributor count scales superlinearly with repository count ( $n_{\mathrm{contributors}}\sim {n_{\mathrm{repos}}}^{1.4}$ n contributors ∼ n repos 1.4 ), and community formation follows a logistic trajectory whose inflection falls in 2018. Three patterns support a recognition & repeat-relationship account of cross-boundary work. First , cross-community work concentrates in a thin carrier layer : only nine contributors span seven or more communities at the commit level, authoring 14% of 4015 inter-community merged pull-request records; the top-50 cross-community contributors produce 54%, and half of all cross-boundary work comes from 36 contributors (0.34% of the population). Second , boundary friction is relationship-specific rather than a fixed property of the boundary: under repository and author fixed effects, prior write access in the destination repository raises the odds of a cross-community pull-request being merged 2.3-fold and cuts integration latency by 66%, whereas the breadth of a contributor across other communities buys nothing. Third , community survival is cohort-structured: per-cohort residualisation hazard rises an order of magnitude between pre-2010 and 2018 cohorts, and external community reach predicts survival mainly through community size, leaving late-cohort communities under-served. The corpus closes just before large-language-model coding assistants entered mainstream use, so these measurements form a pre-AI baseline for a system now changing fast. Their joint implication is sharp: the cross-boundary work holding this ecosystem together is carried by very few people and priced by relationships that take years to accumulate – a dependency invisible to aggregate activity metrics, and erodible without any of them moving. Whether it generalises beyond one curated cybersecurity corpus is untested; this baseline is what makes that testable.

The authors' abstract, as published at the source. EPJ Data Science, 2026 · DOI ↗