| name | dependency-risk |
| description | Sweep the active work for dependencies and risks — blocking chains mapped, single points of failure named, each real risk given an owner and a trigger, theatre avoided. |
| disable-model-invocation | true |
Dependency & risk sweep
Find what can sink the current plan before it does. The output is a short list of real risks with owners — ten "medium likelihood / medium impact" rows nobody rereads is risk theatre, and this ritual refuses to produce it.
1. Map the dependency chains
From the board and tracker (via the board skill): blocking edges among active and next-iteration items, cross-epic dependencies, and anything waiting on the outside world (a vendor, another team, an approval). The codebase-memory graph adds the technical layer: two "independent" tickets whose blast radii overlap the same module are a hidden dependency — surface it as an ordering suggestion or a merge.
Flag the shapes that hurt: chains longer than three (one slip moves the whole line), diamonds converging on one ticket, and any external wait without a date.
2. Name the risks
For each epic in flight, ask four questions: What assumption, if wrong, kills this? Who is the only person who can do X (bus factor)? What external thing must happen on time? What's the cost of the worst technical unknown? Keep only risks that pass the bar: plausible this quarter and worth acting on now. Everything else is noted in one line and dropped.
3. Assign and arm
Each surviving risk gets: an owner (a person, never "the team"), a mitigation or contingency (one concrete action), and a trigger — the observable event that says the risk is materializing ("vendor API still unsigned by the 15th"). File each as an issue labelled risk; blocking-chain fixes become reordered edges on the board.
Done when: every active epic was swept, every filed risk has owner + action + trigger, and the closing summary fits in five lines — chains flagged, risks filed, risks dropped.
