Constellation

The problem

Every code-review tool tells you where a change is, never what it means. CODEOWNERS knows who owns a file; linters know your style; SonarQube knows your smells. None can answer the question a senior engineer asks in two seconds: "if I merge this, what is downstream of it, and is this the kind of change that breaks downstream things?" That answer lives in the call graph - which GitLab Orbit finally exposes as a queryable knowledge graph.

What Constellation does

On every merge request it indexes the repo with Orbit, runs a four-lens analysis over exactly the symbols you changed, and posts a verdict that can block the merge:

Impact - the real transitive blast radius (recursive CALLS traversal), keystones (PageRank), and chokepoints (articulation points whose failure isolates downstream code).
Ownership - bus-factor and single-point-of-failure, from real git-blame weighted by call centrality (anonymized).
Compliance - whether the blast radius reaches a sensitive control boundary.
Provenance - vulnerability exposure scoped to the same subgraph.

These compose: Impact materializes the blast-radius subgraph once and the other three consume it - one architecture, not four bots.

The core idea: risk = what changed x what depends on it

We deterministically classify each edit as cosmetic / body-edit / contract-break and gate topology risk by it. The whole thesis in one demo: the same function compile (509 transitive dependents) auto-approves on a comment and blocks on a signature change. Topology alone sees 509 either way; Constellation sees the difference.

How we built it

GitLab Orbit Local (a DuckDB code-property graph) as the data plane - every signal is a SQL query against the real graph. Correctly-implemented graph algorithms: a depth-bounded recursive CTE (terminates on cycles), PageRank with dangling-mass redistribution, and remove-and-recount articulation points. Two history lenses grounded in git: a bounded, receipted "scar prior" (reverts/hotfixes/fix-density near the change) and git-truth ownership. Deployed through GitLab CI: it downloads and checksum-verifies Orbit, indexes the repo, runs the orchestrator, and posts the verdict.

Evidence it works (all reproducible)

Replaying the last 25 merged MRs: 60% auto-approve, 28% senior review, 4% block - the one block changed 8 signatures touching ~1,310 dependents.
Of the 18 most-called production functions, 12 have no direct test (rendered as a risk map).
It even reviews its own merge requests. 7 integration tests pass against a live Orbit binary.

What we're honest about (because trust is the product)

Orbit Local has no SDLC tables, so the Provenance MR-to-author lineage and Compliance approval checks are representative and labelled as such. The call graph is static, so reachability is a strong heuristic, not a proof (we say "no direct test", not "untested"). Blast radius is name-resolved, so it's an upper bound. The change-failure score is a transparent heuristic plus a capped, receipted prior - not a calibrated probability.

What's next

SDLC enrichment via Orbit-Remote (turns the two representative lenses fully real), FQN-level symbol resolution for exact blast radius, and a base-vs-head call-graph diff so the gate reasons about edges added and severed.