Dead Code Finder

The problem

• Most impact-analysis tools answer "what breaks if I change this." Nobody had a good answer to the narrower question, "is anyone calling this at all," with an honest confidence level attached instead of a blanket yes/no.
• Naive static analysis over-claims in both directions: it either declares something "safe to delete" with no real proof, or produces false positives on legitimate-but-unusual call patterns like decorator dispatch, test-framework reflection, and inheritance/MRO.

The approach

• Built as a GitLab Duo Agent Platform flow that queries Orbit’s real static call graph for CALLS/IMPORTS edges on every Definition node in the project, rather than pattern-matching source text.
• Every finding lands in one of three honest buckets instead of a binary: Confident (no incoming call/import edges anywhere), Uncertain (ambiguous cases like inheritance/MRO dispatch), or Skipped (decorator-based dispatch, test-framework reflection, hardware entry points, explicitly flagged as "cannot assess statically," never silently dropped).
• A hard behavioral constraint by design: the flow never deletes, renames, or modifies a file, never opens a merge request, and never says "safe to delete", only "no reference found in the static call graph, here is exactly what was checked."
• Validated against a deliberately planted set of dead-code fixtures covering the genuinely hard cases: cross-file import resolution, inheritance/MRO dispatch, decorator-based dispatch, constructor/dunder handling on a real ~500-line class, and test-framework reflection discovery.

What broke (and how it got fixed)

• The platform’s own skill-injection mechanism was unreliable: the flow’s procedure file was correctly placed in the project, but at runtime sometimes arrived as just its manifest entry instead of the full procedure body. Fixed by inlining the full procedure directly into the system prompt as a guaranteed fallback, while still preferring the real injected skill whenever it loaded correctly.
• The Orbit graph-query tools were declared in the flow’s own configuration but came back unavailable at runtime, traced to an account-level GitLab Duo preference ("Custom Agents") that was off by default, not a platform or flow bug. Rather than silently degrading or guessing, the flow was built to detect the missing tools explicitly and switch to a clearly labeled file-based fallback mode, tagging every finding made that way as `[INFERRED]` since file-reading is weaker evidence than a real graph traversal.
• After the account toggle was fixed and the flow ran against the real graph, comparing its output to the actual source surfaced two genuine logic bugs: a standalone driver function that exercises an inheritance chain was wrongly bucketed as confidently dead (the exclusion rule for driver functions didn’t generalize to it), and a real, simple, single-hop call was missed by the graph traversal, traced to a separate numeric-ID precision issue and fixed with a single-ID re-check whenever an expected edge unexpectedly came back empty.

Outcome

• Before finding the account toggle, the file-based fallback mode’s guesses were independently checked against the real Orbit graph via the GitLab CLI, run completely outside the flow; every finding held up, including correctly telling apart a method reachable only through inheritance from one nobody calls at all.
• After both logic bugs were fixed, a second run against the real graph correctly reclassified both cases and exactly matched the earlier CLI-verified findings.
• The fallback mode’s disclosure habits (the labeled banner, the `[INFERRED]` tagging) were kept in the flow even after the underlying toggle was fixed, since skill injection can fail independently of Orbit access; treated as a standing resilience pattern, not a one-off patch.

Stack

Honest scope

A hackathon submission validated against Python specifically; other languages aren’t independently verified. It can’t detect transitively dead code (referenced only by other dead code), can’t see usage outside the project’s own indexed scope, can’t see references from non-code files like YAML or CI templates, and has no commit/MR age data available to distinguish "abandoned" from "new and not yet wired up."