The collision demo answers what does this change touch. These three answer the questions that come after the merge: does a vulnerable package actually reach our code, did the predicted blast radius hold up in production, and were the recorded decisions made under rules that still exist.
Every number below is computed from the committed GitLab Orbit self-index and the committed policy file. No network call, no model, no API key. Same input, same output, every run.
Source: data.json (built by scripts/build_static.py from data/keystone_self_graph.duckdb, a real orbit index of this repository). Reproduce with python scripts/dependency_risk.py, python scripts/incident_recall.py, python scripts/config_drift.py.
Loading data.json…