Orbit Blast-Radius

See the real downstream impact of a merge request, before you click Merge. It reads the diff on every MR, uses GitLab Orbit's knowledge graph and posts a ranked "blast radius" right in the MR.

Comment

Orbit Blast-Radius — Devpost submission

See the real downstream impact of a merge request — before you click Merge. Proven on real codebases (httpx, requests, peewee, tqdm) via GitLab Orbit.

Inspiration

Every reviewer has approved a "one-line change" that quietly broke something three files away. Code review shows the diff, not the blast radius — the callers, the tests, the work items downstream of what you touched. GitLab Orbit finally makes that knowable: it's a queryable graph of the whole codebase. We built the agent that turns that graph into a go/no-go signal right inside the merge request.

What it does

On a merge request, Orbit Blast-Radius:

  1. Reads the diff and maps each changed line to the tightest enclosing definition.
  2. Queries Orbit's graph for everything downstream — callers (transitive) and the tests that exercise them — using the CALLS relationship edges.
  3. Computes a ranked risk score and a suggested re-test set.
  4. Posts an MR comment + an interactive, animated dependency graph.

The developer sees, before merging: what this change can break, and exactly what to re-test.

Proven on real code (not mocks)

We dumped GitLab Orbit graphs for six real repos and ran the agent against them. From the live httpx graph:

  • Risky: changing Client.request (httpx/_client.py) ripples to 7 downstream methods (the HTTP verbs) — risk 81/100 — and the agent flags that nothing directly tests the core method; the suite only reaches it through the public verbs.
  • Well-covered: changing streaming_body surfaces the 8 tests that exercise it — risk 0 — i.e. a precise re-test set.

Both results come straight from Orbit's graph with zero authentication and zero credits.

How we built it

  • Engine (Python): parse_diff → changed_definitions (tightest-enclosing, with inferred end_line so mid-body edits still map) → graph_backend.references_blast_radius (reverse the CALLS edges to find callers, transitively, depth-limited) → risk + re-test set.
  • Orbit integration — the no-auth path: instead of the Duo-gated MCP get_references tool, we read the local Knowledge Graph's GET /api/graph/initial REST endpoint and compute the blast radius from its CALLS relationship edges. Free, local, no GitLab account, no credits.
  • GitLab layer: reads the MR diff and posts the comment (gated — never automatic).
  • Visual: a self-contained D3 force graph — changed symbol at center, dependents rippling outward, colored by risk — fed directly by the engine's JSON.
  • Delivery: a GitLab Duo Agent Platform flow, published to the AI Catalog.

The engine is locked by 7 offline test suites, including a test_graph_real_shape built from real gkg output, so the parser matches reality (synthetic node ids, the double-quoted relationship_type, node_type keys, Windows %5C path encoding).

Challenges

  • gkg's Python call-graph resolves direct/named calls but not instance-method calls (client.get() → Client.get), so the re-test set is richest for symbols tests call by name. We surface this honestly rather than hide it — "nothing directly tests this" is a real, useful signal.
  • The graph endpoint 404s on any query parameter and needs %5C-encoded Windows paths — found and pinned by probing the live server.

What's next

  • Cross-repo blast radius via Orbit Remote.
  • Resolve instance-method call edges to enrich the re-test set.
  • A VS Code surface so you see the radius before opening the MR.

Try it

# against a saved Orbit graph dump (no server needed)
python demo_live.py --graph samples/graph_httpx.json --auto
# or live: gkg index <repo>; gkg server start;  python cli.py --mr <project>!<iid> --backend graph

License: MIT.

Built With

  • claude
  • css
  • d3.js
  • gitlab
  • gitlab-ai-catalog
  • gitlab-api
  • gitlab-ci
  • gitlab-duo-agent-platform
  • gitlab-knowledge-graph
  • gitlab-orbit
  • gitlab-pages
  • gkg
  • html
  • javascript
  • mcp
  • python
  • rest-api
Share this project:

Updates