BlindSpot: Verified Codebase Risk Mapper

THE PROBLEM A new developer joining a codebase and a reviewer trying to find risky, undertested code are usually solving two separate problems with two separate manual efforts. Onboarding means hours of reading through files with no map. Finding what's actually dangerous to touch means guessing, or waiting for something to break in production first. THE SOLUTION BlindSpot does both in one pass, against any repo. It computes real risk scores per function — combining cyclomatic complexity, git commit churn, and whether any test references the function — then uses IBM Bob to: (1) explore the codebase with a parallel subagent and write a plain-English architecture overview with a diagram, (2) generate real pytest tests for the riskiest, least-tested functions, and (3) check whether the existing documentation still matches what the code actually does. WHAT MAKES IT DIFFERENT Most AI-generated reports are shipped as-is. BlindSpot's doc-drift step doesn't just generate plausible-sounding claims — it verifies each candidate finding by actually running the relevant code before including it. In our demo run, three confident-sounding drift findings were generated, and all three were proven false on verification. The final report says so honestly, instead of padding itself with unverified claims to look more impressive. BlindSpot also splits its own work deliberately: all the countable, mechanical analysis (complexity scoring, git history, HTML report rendering) runs as plain Python with zero AI cost. IBM Bob is only invoked for the parts that genuinely require understanding — architecture explanation, test generation, and verified drift analysis. TARGET USERS Any developer joining an unfamiliar codebase, any solo maintainer of a growing project, and any code reviewer who wants to know where the real risk is before approving a PR. RESULTS FROM OUR DEMO RUN Run against a real open-source Flask application (not written by us): 137 functions analyzed across 34 files. 18 tests generated for the 5 riskiest functions — 5 initially failed, revealing two genuine bugs (a cross-session SQLAlchemy identity conflict, and a mock patched at the wrong import location), both diagnosed and fixed. All 3 doc-drift candidates were verified and correctly retracted when they didn't reproduce. Total cost: 3.68 of 40 available Bobcoins.