component library design

Software architecture suffers from ambiguous abstraction concepts and inadequate tool support. Method: This work systematically reconstructs the seminal 1995 architectural model and proposes, for the first time, a practice-grounded conceptual framework for architectural abstraction—elevating component composition relationships to system-level abstractions that are formally modelable and verifiable. It integrates architectural description language (ADL) design, abstract modeling, prototype tool development, and diachronic historical analysis. Contribution/Results: The study establishes software architecture as an independent concern with rigorous theoretical foundations. Its outcomes catalyzed a surge in ADL research, laid the groundwork for model-based systems engineering (MBSE), and continue to inform the design of cloud-native, microservice, and AI-driven architectures. The framework significantly enhances the expressiveness, formal verifiability, and engineering applicability of architectural abstractions.

This study addresses the proliferation of functional redundancy in service-oriented architectures caused by heterogeneous clients, which undermines system evolvability and maintainability. To mitigate this issue, the authors propose a novel reference architecture that synergistically integrates metadata-driven mechanisms with pattern languages. By leveraging metadata management and a plugin-based design, the approach effectively constrains service redundancy while enhancing reuse capabilities. The work innovatively combines metadata mechanisms and pattern languages in architectural construction and validates its efficacy through a triangulated evaluation method incorporating scenario-based assessment and real-world case studies. Empirical results demonstrate that the majority of system changes during evolution require no code modifications—only configuration adjustments or the addition of pluggable components—thereby significantly improving architectural stability and reuse efficiency.

The component-based software development (CBSD) community has long lacked industry-accepted methods and tools for component selection. Method: We employed a mixed-methods approach—surveying and conducting semi-structured interviews with 98 practitioners and researchers—to systematically identify industrial pain points, current practices, and quality evaluation priorities. Contribution/Results: This study is the first to articulate, from an industrial perspective, three core requirement categories for AI-powered component selection tools: functionality, quality attributes (e.g., explainability, reliability, integrability), and AI trustworthiness—and to empirically quantify their acceptance thresholds. It delivers an industry-prioritized ranking of component selection quality criteria, bridging the academia–industry gap via co-prioritization. These findings establish a rigorous empirical foundation for designing and evaluating next-generation AI-assisted CBSD tools.

The integration of machine learning (ML) components into software product lines (SPLs) suffers from a lack of systematic variability modeling and reuse mechanisms for ML artifacts. Method: This paper proposes the first structured framework unifying SPL engineering and ML component development, grounded in feature modeling. It supports systematic variability modeling of ML functionality, component substitution, hyperparameter tuning, and cross-configuration reuse within SPLs. A prototype implementation is realized via the VariaMos tool. Contribution/Results: Empirical evaluation across multiple product configurations demonstrates improved consistency in ML component modeling, enhanced development efficiency, and strengthened decision support capabilities. The work bridges a critical theoretical and practical gap at the intersection of SPL and ML engineering, delivering a scalable, data-driven methodology for product line engineering.

Modern software development’s heavy reliance on third-party packages introduces significant security risks and maintenance burdens. This paper focuses on “chain-end packages”—dependencies at the terminus of dependency supply chains with no external dependencies—providing the first systematic definition, taxonomy, and empirical analysis of their ecosystem role. Leveraging full NPM metadata, we combine dependency graph mining, lifecycle modeling, and maintenance-status clustering to identify five categories: actively maintained, long-term frozen, deeply nested, deceptively simple, and dependency-cohesive. Our analysis reveals their nontrivial prevalence and critical resilience value, challenging the “default reuse” paradigm. We propose a novel supply-chain governance framework that incorporates chain-end packages as a first-class assessment dimension, advocating a shift from indiscriminate reuse toward deliberate, risk-aware dependency selection. (149 words)

为了解决软件供应链安全问题，本文提出SCA-Agent方法，通过构建组件生命周期轨迹来提高第三方组件识别及演变理解的准确性。

Current Software Bill of Materials (SBOM) tools struggle to comprehensively identify security vulnerabilities due to the absence of a unified standard for component identification, thereby jeopardizing software supply chain security. This work introduces the Component Introduction Mechanism (CIM) analysis framework—the first of its kind—to systematically evaluate the component detection capabilities of cdxgen, syft, trivy, ORT, and Microsoft’s sbom-tool across real-world projects in six programming languages: Python, Java, Go, PHP, Rust, and C. The study reveals that existing tools commonly suffer from incomplete CIM coverage, ambiguous component definitions, and shared blind spots, leading to significant ambiguities and omissions in generated SBOMs. These findings underscore the urgent need for community-wide consensus on component identification and provide an empirical foundation and strategic guidance for developing more reliable SBOM technologies.

This study addresses the unclear practical adoption of agentic software engineering methodological frameworks within large-scale code repositories. To investigate this, we conduct the first empirical examination across 116,000 GitHub repositories, integrating mining software repositories techniques, stratified sampling, quantitative artifact detection, and qualitative coding analysis to systematically evaluate the prevalence, co-occurrence, and rule characteristics of eight coordination mechanisms. Our findings reveal an overall presence rate of at least one mechanism at 21.7%, rising to 65.3% among highly starred projects. However, fully integrated systems remain rare, as current practices are predominantly confined to the isolated application of individual mechanisms. This work provides foundational empirical evidence regarding how multi-agent coordination paradigms are currently operationalized in open-source software development, highlighting a significant gap between theoretical agentic frameworks and their holistic real-world implementation.

This work addresses the lack of a unified configuration governance mechanism in heterogeneous multi-agent systems, which hinders versioned, auditable, and cross-framework consistent management. The authors propose a framework-agnostic reference model for agent configuration governance that normalizes diverse configurations into a canonical configuration graph via semantic projection and enforces uniform governance semantics over this graph. Key innovations include typed and independently versioned configuration items, strict decoupling of configuration from runtime, a lattice-based monotonic influence propagation mechanism, and dependency-aware immutable revisions with provenance tracking. The model is validated across LangGraph, CrewAI, and OpenAI Agents SDK, demonstrating governance-equivalent ACM representations across 27 governance scenarios and 9 propagation cases, while guaranteeing convergence, termination, and a unique fixed point.

本文提出了一种基于仓库的实现方法，通过自动接口更新和一致性检查减少有人和无人飞行器软件开发中跨域不一致问题。