Impact Lens

Inspiration

Every developer, before editing a function, asks the same question: what depends on this, and what will I break? Search tools answer the wrong question — they find the name, not the transitive dependency ripple. The callers of the callers, the subclass two files over, the test that fails three hops away — none of it shows up in a grep. So reviewers approve changes blind to blast radius, and new contributors "fix a small helper" that forty things call. AI coding agents have the same blind spot.

The hackathon theme is "intelligent orchestration, now with context." The most decision-relevant context for any change is its blast radius — and GitLab Orbit finally makes it queryable.

What it does

Impact Lens takes a code symbol and returns its full transitive blast radius from the GitLab Orbit knowledge graph:

• every definition, file, and test that transitively depends on it (callers, importers, subclasses),
• an explainable risk score (breadth × volume × reach, discounted by test coverage),
• the exact tests to re-run, and a warning when a wide change is untested.

$ impact-lens src.click.utils.echo
Risk 75/100 (HIGH) — 24 definitions across 5 files, depth 4. No tests in the blast radius.

$ impact-lens _get_words
Risk 26/100 (LOW) — 23 dependents, all tests -> re-run these 23 tests.

It ships as three surfaces so a human or an agent can use it: a CLI, a GitLab Duo Agent Skill (/impact-lens), and a custom flow published to the AI Catalog.

How we built it

The capability a plain LLM + grep cannot replicate is multi-hop reverse-dependency traversal, and that is exactly what Orbit's graph makes cheap. Orbit Local indexes the repo into a DuckDB graph whose gl_edge table holds typed directed edges (source) --CALLS/EXTENDS--> (target) (source depends on target). Impact Lens walks them in reverse, transitively, in one recursive CTE:

WITH RECURSIVE blast AS (
  SELECT id, 0 AS depth, [id] AS path FROM gl_definition WHERE fqn = :symbol
  UNION ALL
  SELECT e.source_id, b.depth+1, list_append(b.path, e.source_id)
    FROM blast b JOIN gl_edge e ON e.target_id = b.id
   WHERE e.relationship_kind IN ('CALLS','EXTENDS') AND e.source_kind='Definition'
     AND NOT list_contains(b.path, e.source_id)   -- cycle guard (call graphs loop)
     AND b.depth < 8)
SELECT min(depth) AS depth, d.fqn, d.file_path FROM blast b JOIN gl_definition d USING (id);

The query is issued through the sanctioned orbit sql -F json CLI (so it meaningfully uses Orbit via its CLI interface), parsed into a typed report, and scored. The skill lets a local Duo/Claude agent run the same traversal; the flow (flow-registry v1) is the AI-Catalog-publishable artifact. Python, zero runtime dependencies, hermetic unit tests for the risk model and report rendering, green GitLab CI.

What we learned

Orbit's real value isn't "search the code" — it's graph joins across the SDLC that text tools can't express. Once you have a typed dependency graph, "what does this change break?" becomes one recursive query, and the answer is exact rather than guessed. We also learned the runtime boundary the hard way: custom catalog flows run server-side (ambient) and can't reach a developer's local Orbit graph — so the local skill and the catalog flow are two honest surfaces over the same engine.

Challenges we ran into

• Cycle safety: real call graphs contain cycles (recursion, mutual calls). A naive recursive CTE never terminates; we carry the visited path and prune with list_contains.
• Edge direction: confirming CALLS/EXTENDS point dependent→dependency (so blast radius is the reverse walk) against the live gl_edge schema before trusting it.
• Local vs ambient runtime: custom flows are ambient-only and can't reach a local Orbit binary — resolved by shipping the offline path as a skill and the catalog path as a flow.
• Portability: the Orbit gnu binary needs glibc ≥ 2.32; we install the musl static build on older hosts.

What's next

• Diff mode: impact-lens --diff HEAD~1 to score a whole changeset, for CI gating ("this MR has HIGH untested blast radius").
• Orbit Remote: join SDLC data — suggest reviewers by ownership and link affected pipelines.
• MR comment bot: post the impact report automatically on every merge request.
• Editor surfacing: a CodeLens-style "blast radius: 24 · risk HIGH" hint above each definition. ## Accomplishments that we're proud of

What we learned

What's next for Impact Lens

Built With

• ai-catalog
• duckdb
• gitlab-duo-agent-platform
• gitlab-orbit
• python
• sql
• tree-sitter