My Constitutional Auditor Missed Dead Code. Here's Why — and What I'm Doing About It.

A live investigation. This post will be updated as I dig deeper, fix it, and reflect on what it means.

The Discovery

Today I deleted a file called llm_api_client.py.

It had no imports pointing to it anywhere in the codebase. Pure orphan. Dead code by any definition.

The problem: CORE's constitutional auditor didn't catch it.

CORE has a rule called purity.no_dead_code:

{

  "id": "purity.no_dead_code",

  "statement": "Production code MUST NOT contain unreachable or dead symbols as identified by static analysis.",

  "enforcement": "reporting"

}

The rule exists. The audit runs it on every core-admin code audit call. It produced exactly 1 warning in recent runs — but not for llm_api_client.py.

I only found the dead file manually, while working through a separate compliance task.

That's a problem worth understanding.

The Investigation: What Is the Auditor Actually Doing?

CORE's enforcement model separates what the law says from how it's enforced. The rule lives in .intent/rules/, the enforcement mechanism lives in .intent/enforcement/mappings/.

Here's the full enforcement declaration for purity.no_dead_code:

purity.no_dead_code:

  engine: workflow_gate

  params:

    check_type: dead_code_check

    tool: "vulture"

    confidence: 80

Vulture. A solid static analysis tool — but one with a specific scope. Vulture finds unused symbols within files: functions that are defined but never called, variables assigned but never read, classes that are never instantiated.

What vulture does not do: traverse the import graph to find files that nothing imports.

llm_api_client.py likely had internal symbols that appeared "used" within the file itself. From vulture's perspective: no violations. From reality's perspective: the entire file was unreachable from the rest of the system.

The rule says: "unreachable or dead symbols"

The enforcement checks: unused symbols inside files

These are two different things. The enforcement is a subset of what the rule claims to guarantee. The constitution was shallow.

The Insight

This is, I think, the most honest thing I can say about constitutional AI governance:

The constitution is only as strong as its enforcement mechanisms. A rule that exists but enforces shallowly is not a guarantee — it's an aspiration.

CORE did exactly what it was told. No more, no less. The law declared "no dead code." The enforcement mechanism checked for unused symbols. The file slipped through the gap between what the law said and what the enforcement did.

This isn't a criticism of the approach. It's the nature of any governance system — constitutional law included. The text of the law and the apparatus that enforces it are always two separate things. The gap between them is where violations live.

What matters is: can the system correct itself when the gap is found?

In CORE's model, the fix is a .intent/ declaration change. Not Python. Not a code patch. A policy update that changes enforcement behavior system-wide.

What the Fix Looks Like (Conceptually)

True dead file detection requires import graph traversal — building a dependency graph of the entire codebase and identifying files that no entry point can reach.

Tools that can do this: pydeps, custom AST graph traversal, or a knowledge_gate that queries CORE's own symbol database (which already tracks file-level relationships via core.symbols).

The declaration change would look something like:

purity.no_dead_code:

  engine: workflow_gate

  params:

    check_type: dead_code_check

    tool: "vulture"          # symbol-level: keep this

    confidence: 80

  # ADD:

  additional_checks:

    - check_type: orphan_file_check

      engine: knowledge_gate

      params:

        check_type: unreachable_files

        entry_points:

          - "src/cli/"

          - "src/body/atomic/"

I checked. CORE's knowledge_gate currently supports:

• capability_assignment


• ast_duplication


• semantic_duplication


• duplicate_ids


• table_has_records

No orphan file detection. No import graph traversal.

The gap goes deeper than a declaration change. A new check_type implementation is needed — which means extending knowledge_gate itself, or building a dedicated engine. The .intent/ declaration is the easy part. The enforcement mechanism has to exist first.

This is the rabbit hole.

Status

• [x] Dead file discovered manually (llm_api_client.py)


• [x] Root cause identified (vulture scope vs. import graph traversal)


• [x] Constitutional gap diagnosed (rule vs. enforcement mismatch)


• [x] Investigation: knowledge_gate does not support orphan file detection — new engine needed


• [ ] Design: new check_type for import graph traversal


• [ ] Implementation: extend knowledge_gate or build dedicated engine


• [ ] Declaration: update .intent/enforcement/mappings/code/purity.yaml
  


• [ ] Verify: audit now catches what it missed


• [ ] Reflection: what this means for CORE's autonomy claims

[UPDATE 1 — coming soon: designing the orphan file check — declaration-first, engine second]

[UPDATE 2 — coming soon: implementation and proof it works]

[UPDATE 3 — coming soon: the philosophical reflection on constitutional blind spots]

CORE is open source: github.com/DariuszNewecki/CORE

Credit: the PromptModel artifact pattern was inspired by Ruben Hassid's prompt engineering work.