Prosecution. Devil's advocate. Then a verdict.

The scanner says “nothing imports this.” That is the prosecution. Before an agent proposes a deletion, a second deterministic layer plays devil's advocate: it checks named counter-hypotheses against real repository artifacts — crontab, Dockerfile, serverless handlers, CI scripts, reflection, feature flags — and returns file:line evidence. The judge combines both sides into remove, verify, or keep, plus the one next check that settles it.

The judge itself is deterministic — no LLM. Optional counsel is a second devil's advocate over the judge's packet: it may confirm, escalate, or overturn a remove, and it cannot strengthen a verify. Still never file bodies, still once, still cached.

Why this exists

The most expensive false positive in dead-code cleanup is not a FastAPI route (framework detection already handles that). It is a hidden live path: a nightly job, a Lambda handler string, a Makefile target, a feature flag that is off today. Agents that delete those “unused” files are fast and wrong. The judge is the due-diligence layer that keeps developer velocity high without trading away safety.

The fixture, judged

deadpath judge fixtures/deadapp prints this table (also the default MCP output for deadpath.judge, and what plugins render to the user):

Counter-hypotheses (the devil's advocate)

Each hypothesis has a strength, a confidence penalty, and a next-check template. Evidence is redacted and truncated. Overlap with scan signals (a name already seen in config) halves the judge's own penalty so the same fact is not priced twice.

Identification check

A finding can be “correctly unused” of the wrong thing. Before a remove verdict, the judge asks whether the identifier is trustworthy.

Corner cases, due diligence

These are the cases that produce the worst incidents when a scanner (or an agent) is believed blindly. Each has a named hypothesis and a required human check — never an automatic deletion.

Security lens

Dead code is not just clutter. Unused endpoints, leftover eval, pickle.loads, verify=False, and secret-like literals are unmonitored attack surface — they are not in the live path, so they are not in the on-call dashboard either. The judge scans the finding's definition (or the whole orphan file) for markers and reports line numbers only. Values are redacted by the same patterns used everywhere else (sk-, AKIA, ghp_, PEM keys, JWT-shaped tokens, password = "…").

Workflows surface security_first findings before anything else. That is the secure-code mechanism: the cheapest security win in a cleanup backlog is deleting code that is both unused and risky, after validation, with explicit approval.

Developer velocity

Due diligence that costs an hour per finding will not be used. The judge is built so the cheap cases stay cheap:

• Quick wins — remove + trivial size (≤ 60 lines, ≤ 1 objection) get a ~2 minute estimate. Agents are told to take those first.
• One next check — never “read the repo”. The strongest objection names a file:line; that is the only extra read.
• Keep is skip — findings the judge ruled keep are listed once in the workflow and omitted from verify/edit. Re-arguing them is the most common token sink.
• Tabular plugin output — Claude Code, Cursor and Codex render GitHub-flavoured markdown tables natively. The plugin loop is: call deadpath.judge (or deadpath.scan with format: "table") and show the table as-is. No prose rewrite, no second crawl.
• Never deletes — a remove verdict is permission to propose a patch after validation, not to write the filesystem.

Effort is trivial / small / large from line count of the target plus the number of sustained objections. It is a planning hint, not a promise.

CLI and MCP

deadpath judge  [PATH] [--format table|md|json] [--no-memory] [--no-judge]
deadpath scan   [PATH] [--format table|md|json|sarif]
deadpath plan   [PATH] [--format table|md|json]
deadpath workflow [PATH] [--format table|md|json]

table is a markdown table: sev · confidence · kind · target · judge · devil's advocate · next check · security · effort. MCP deadpath.judge defaults to that table. md adds the case-file write-up (prosecution, defense, identification, security, next check) under the table. JSON is the machine envelope. Scan still defaults to markdown for humans and JSON for MCP; pass format: "table" when the agent is presenting to a user.

Pass --no-judge (or MCP judge: false) to see raw scan confidence. The threshold --min-confidence applies to the scan score so a keep verdict cannot hide the finding — the evidence is the point.

What this layer will not do

• It will not call a model. Detection and judgement are deterministic; the model is a later, optional second opinion on warn findings only.
• It will not delete, rewrite, or open a pull request.
• It will not print secret values, file bodies, or more than a 110-character redacted snippet per evidence line.
• It will not pretend a name-precision language is certain. Identification records that cap; verdicts stay at verify/keep.