PRESTO: A Machine Learning Framework for Predicting Software System Performance Using SDLC Metrics

How well can you predict production performance from development process data alone? Modern DevOps pipelines record 164 metrics across eight SDLC phases, yet no public dataset links these signals to runtime outcomes. We built PRESTO and a Gaussian copula-based synthetic data generator, released as a public reproducibility package (Zenodo DOI: 10.5281/zenodo.22005439). During this revision, an audit of the generator’s own code, prompted by peer review, found three implementation bugs (48 of 84 specified metric correlations were silently never applied; domain-specific calibration overrides were never wired in; one metric’s documented distribution family was silently substituted for a different one). We fixed all three, regenerated all three synthetic domains, and reran the full downstream pipeline; every synthetic-domain number below reflects the corrected code, and Section 3.1.3 discloses exactly what changed. Across three enterprise-domain synthetic datasets, the best model achieved R² = 0.11 to 0.49 using only SDLC process features; a target-correlation ablation shows this largely reflects recovery of the generator’s specified structure, so the synthetic domains alone are not evidence of genuine signal. Adding historical uptime features raised the primary domain’s R² to 0.91, and roughly 88% of that gain is autoregressive persistence rather than process signal. Tree-based ensembles remained the best untuned model on all three domains, though Gradient Boosting now collapses badly on the primary domain (R² = −1.49) while Random Forest does not; once linear models are properly tuned, a tuned model edges out Random Forest on that same domain, but by a margin smaller than the estimation noise, so this is a near-tie, not a linear-model win. Build and testing infrastructure availability were the strongest synthetic-domain predictors; build-phase metrics now outweigh code-quality metrics roughly 6.6:1 in aggregate importance, and testing metrics roughly 4.3:1, both smaller ratios than an earlier, bug-affected 11:1 figure; real-world TravisTorrent data is directionally consistent (Test-phase features rank #1 in 5 of 7 projects), but a robustness check excluding a definitionally-circular test-duration feature drops every project’s holdout R² to negative, so this should be read as a weak, feature-ranking-only signal, not confirmation. We introduce Phase-Aware Recursive Feature Elimination, which guarantees cross-phase coverage and, under the corrected data, avoids collapse on two of three domains, though it fails badly on the primary domain. Four independent real-world datasets, unaffected by the generator fixes since they use real external data, still with bootstrap confidence intervals: TravisTorrent (R² = 0.475 best of seven, median 0.005), Mozilla Perfherder (R² = 0.17 to 0.91, autoregressive persistence), GHALogs (R² ≈ 0.11, zero leakage risk, significant for all five models, n = 28,443), and SQuaD(R² = 0.402 defect-fix, our strongest point estimate but not significant; enriching with real static-analysis code-quality features raises it to 0.483 and narrows the CI to a near-miss [−0.037,0.738], still not significant; R² = 0.245 CVE-count, weaker but significant). GHALogs and SQuaD’s CVE-count result are what actually license a confirmatory claim: SDLC process signals carry genuine, transferable predictive value, though not uniformly across every real-world dataset examined.