blast-radius

name	blast-radius
role	entrypoint
description	Analyzes code change impact with risk scoring and affected-node mapping. Use before merging to understand what a change touches and what lacks test coverage.
model_hint	standard
tags	["code-review","impact-analysis","risk-scoring"]
tools	[]
dependencies	["imbue:review-core","imbue:structured-output"]

Blast Radius Analysis

Analyze the impact of current code changes using the code knowledge graph.

When NOT To Use

• Reading the changed code for defects (use pensive:bug-review)
• The code graph is missing or stale (use gauntlet:graph-build)

Prerequisites

This skill requires the gauntlet plugin for graph data. Check if it's available:

GRAPH_QUERY=$(find ~/.claude/plugins -name "graph_query.py" -path "*/gauntlet/*" 2>/dev/null | head -1)

If gauntlet is not installed (GRAPH_QUERY is empty): Fall back to a manual impact analysis using git diff and grep to trace imports and call sites. Skip graph steps and go directly to step 3 (manual mode).

If gauntlet is installed but no graph.db exists: Tell the user: "Run /gauntlet-graph build first."

Steps

1. Show current changes: Run git diff --stat to show the user what files changed.

2. Run impact analysis (requires gauntlet):

   python3 "$GRAPH_QUERY" \
       --action impact --base-ref HEAD --depth 2
   

   Fallback tier 1 (sem available, no gauntlet): Use sem for cross-file dependency tracing:

   if command -v sem &>/dev/null; then
     sem impact --json <changed-file>
   fi
   

   This traces real function-level dependencies instead of filename matching. See leyline:sem-integration for detection patterns.

   Fallback tier 2 (no sem, no gauntlet): Trace callers of changed functions with rg (or grep):

   # Prefer rg for speed; fall back to grep
   if command -v rg &>/dev/null; then
     git diff --name-only HEAD | while read f; do
       stem="${f%.*}"; stem="${stem##*/}"
       [ -z "$stem" ] && continue  # skip dotfiles (.gitignore etc.)
       rg -l "$stem" . 2>/dev/null
     done | sort -u
   else
     git diff --name-only HEAD | while read f; do
       stem="${f%.*}"; stem="${stem##*/}"
       [ -z "$stem" ] && continue  
       grep -rl  . 2>/dev/null
      |  -u
   
   

Verify Findings Are Grounded (blast-radius:findings-verified)

Every finding must cite a real location and a verbatim anchor. Write findings to .review/findings.json and confirm each citation resolves:

python plugins/imbue/scripts/citation_verifier.py \
  --findings .review/findings.json --repo-root .

Drop or label UNVERIFIED any finding the verifier fails (exit 1); only verified findings enter the report. See Skill(imbue:review-core) Step 5 and Skill(imbue:structured-output) for the schema.

Exit Criteria

• Results table lists every affected node with a File (file:line) and verbatim Anchor column.
• Overall risk level (low/medium/high) is displayed based on the maximum risk score.
• Every reported finding carries a Location + verbatim Anchor confirmed by citation_verifier.py (exit 0), or unverified findings were dropped or labeled UNVERIFIED.

Risk Scoring Model

Five weighted factors (sum capped at 1.0):

Factor	Weight	Meaning
Test gap	0.30	No test coverage
Security	0.20	Auth/crypto/SQL keywords
Flow participation	0.25	Part of execution flows
Cross-community	0.15	Called from other modules
Caller count	0.10	High fan-in function