diff --git a/.github/workflows/dead-code.yml b/.github/workflows/dead-code.yml
new file mode 100644
index 000000000..b3020f96c
--- /dev/null
+++ b/.github/workflows/dead-code.yml
@@ -0,0 +1,24 @@
+name: Dead code
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  fallow:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
+        with:
+          version: 10.13.1
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: git fetch origin main
+      - run: npm run quality:dead-code
+        env:
+          FALLOW_BASE_REF: origin/main
diff --git a/AGENTS.md b/AGENTS.md
index 9396b8f34..d2fb0dd2f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,10 @@
 # Repository Guidelines
 
+## Code cleanup
+
+- Run `pnpm run quality:dead-code` after TypeScript or JavaScript removals. CI checks new findings on pull requests.
+- For cross-file removals, refresh Graphify and inspect callers before deleting. Confirm framework registrations in current source.
+
 ## Project Structure & Module Organization
 - `crates/`: Rust workspace crates — `server` (API + bins), `db` (SQLx models/migrations), `executors`, `services`, `utils`, `git` (Git operations), `api-types` (shared API types for local + remote), `review` (PR review tool), `deployment`, `local-deployment`, `remote`.
 - `packages/local-web/`: Local React + TypeScript app entrypoint (Vite, Tailwind). Shell source in `packages/local-web/src`.
@@ -54,5 +59,3 @@ Do not manually edit shared/remote-types.ts, instead edit crates/remote/src/bin/
 ## Security & Config Tips
 - Use `.env` for local overrides; never commit secrets. Key envs: `FRONTEND_PORT`, `BACKEND_PORT`, `HOST` 
 - Dev ports and assets are managed by `scripts/setup-dev-environment.js`.
-
-
diff --git a/package.json b/package.json
index ae7443c78..1c1a3c2c1 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
     "npx-cli/dist/**"
   ],
   "scripts": {
+    "quality:dead-code": "npx --yes fallow@2.89.0 audit --base ${FALLOW_BASE_REF:-main} --gate new-only",
     "lint": "pnpm run local-web:lint && pnpm run ui:lint && pnpm run backend:lint && node scripts/check-unused-i18n-keys.mjs",
     "format": "pnpm run backend:format && pnpm run web-core:format && pnpm run local-web:format && pnpm run remote-web:format",
     "check": "pnpm run local-web:legacy-path-guard && pnpm run local-web:check && pnpm run remote-web:check && pnpm run web-core:check && pnpm run ui:check && pnpm run backend:check",