Skip to content

Audit random user selection function bias#21

Open
adamhurm wants to merge 3 commits intomainfrom
claude/audit-user-selection-bias-EmOU2
Open

Audit random user selection function bias#21
adamhurm wants to merge 3 commits intomainfrom
claude/audit-user-selection-bias-EmOU2

Conversation

@adamhurm
Copy link
Copy Markdown
Owner

This audit identifies a critical bias issue in the random user selection logic caused by recursive re-roll pattern. The report documents:

  • Critical recursive re-roll bias creating selection inefficiencies
  • Member cache verification concerns
  • Random seed management recommendations
  • Detailed probability analysis showing perception of bias
  • Recommended fixes with code examples
  • Testing recommendations for validation

Key finding: The recursive pattern at bot.py:196 causes the same user to be selected multiple times before re-rolling, creating both real inefficiency and perceived bias in the selection process.

This audit identifies a critical bias issue in the random user selection
logic caused by recursive re-roll pattern. The report documents:

- Critical recursive re-roll bias creating selection inefficiencies
- Member cache verification concerns
- Random seed management recommendations
- Detailed probability analysis showing perception of bias
- Recommended fixes with code examples
- Testing recommendations for validation

Key finding: The recursive pattern at bot.py:196 causes the same user
to be selected multiple times before re-rolling, creating both real
inefficiency and perceived bias in the selection process.
This commit implements all three recommendations from the audit report:

1. **Fix recursive re-roll bias** (CRITICAL):
   - Replaced recursive logic with pre-filtering approach
   - Current Super Pal is now excluded from selection pool before random selection
   - Eliminates repeated selection attempts and stack overflow risk
   - Single selection attempt per cycle, no re-rolls needed
   - Lines changed: bot.py:197-206

2. **Add member cache verification** (MODERATE):
   - Added logging to verify Discord member cache completeness
   - Logs total guild members vs cached members
   - Warns when cache may be incomplete
   - Helps diagnose potential missing users in selection pool
   - Lines changed: bot.py:190-195

3. **Replace random with secrets module** (LOW):
   - Changed from `random.choice()` to `secrets.choice()`
   - Provides cryptographically secure random selection
   - Eliminates any theoretical predictability
   - Applied to both super_pal_of_the_week() and karate_chop()
   - Lines changed: bot.py:10, 205, 528

**Testing**:
- Added test_exclude_current_super_pal_from_selection()
- Added test_member_cache_verification()
- Added test_no_eligible_members_edge_case()
- All tests verify the new pre-filtering logic works correctly

**Impact**:
- No more perception of bias from repeated selections in logs
- More efficient (O(1) selection vs O(N/(N-1)) with re-rolls)
- Better security with cryptographic randomness
- Better observability with member cache verification
Documents the successful implementation of all three fixes:
1. Recursive re-roll bias elimination
2. Member cache verification logging
3. Cryptographic randomness implementation

Includes before/after comparison, impact analysis, and deployment notes.
All issues are now marked as RESOLVED.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants