Map Codebase
Overview
A methodical exploration workflow that produces an evidence-cited map of a codebase
area. Replaces ad-hoc grep with a disciplined four-step pass: scope, list, read,
diagram. The output is a short artifact you can attach to a plan or design doc —
file paths, line numbers, call directions, and the questions you couldn't answer
from reading. The skill's value is enforcing that every claim about the code is
backed by a specific file:line citation, not a memory or pattern-match. Senior ICs
and tech leads use it to bound the blast radius of a change before they propose it.
When to Use
- Before writing a plan that touches more than one module
- When inheriting a codebase area you didn't author
- When a teammate asks "how does X work" and you don't have a confident answer with citations
- Before a refactor, to enumerate everything that calls the code you're about to change
- When debugging crosses a boundary you don't fully understand (auth, ORM, framework internals)
When NOT to Use
- The change is single-file and you've already read the file
- You're modifying code you wrote yourself within the last week
- The "exploration" is really a one-line lookup that
Grep answers in 5 seconds
Process
Step 1: Scope
Goal: Pin down what you are mapping and what you explicitly are not.
Inputs: A task, plan, or question that triggered the need to explore.
Actions:
- Write one sentence:
I am mapping <X> in order to <Y>. X is concrete (a feature,
a module, a request path). Y is the decision the map will support.
- Write one sentence naming what is out of scope:
I am not mapping <Z>.
This prevents the exploration from sprawling.
- Set a time box. 30 minutes for a single feature, 90 minutes for a subsystem.
Output: A two-sentence scope statement at the top of your scratch artifact.
Step 2: List entry points
Goal: Enumerate every place execution can enter the area being mapped.
Inputs: The scope statement.
Actions:
- Find route handlers, controllers, CLI commands, queue consumers, scheduled jobs,
or event listeners that touch the area.
Grep for the framework's routing
primitives.
- List each entry point as
<file:line> — <what triggers it>.
- If the count exceeds 10, return to Step 1. Your scope is too wide.
Output: A bullet list of entry points with file:line citations.
Step 3: Trace and read
Goal: Read the actual code at each entry point and the immediate calls outward,
collecting facts.
Inputs: The entry-points list.
Actions:
- For each entry point, read the function body. No skimming — line by line.
- Note every call out of that function: which module, which function, which
file:line.
- Follow each call one level deep. Then stop and decide if you need a second
level. Most maps don't.
- Record surprises. Lines that don't do what their name suggests, defensive code
that hints at a past bug, configuration that controls behavior implicitly.
- Record questions. Things you couldn't answer from reading — these become the
"Open" section of the output.
Output: A flat list of facts, each in form <file:line> — <what this code does>,
plus a short list of open questions.
Step 4: Diagram and write up
Goal: Compress the trace into a single artifact a teammate can read in 3 minutes.
Inputs: The trace from Step 3.
Actions:
- Write the artifact in Markdown with these sections:
- Scope (the Step 1 sentences)
- Entry points (the Step 2 list)
- Call graph (a small ASCII diagram or nested bullet list with file:line)
- Surprises (each in form
<file:line> — <what surprised me>)
- Open questions (each in form
<question> — <where you'd need to look>)
- Save it. Even if it's a scratch file in
/tmp. The artifact is the deliverable.
- If the map is for a plan or design doc, link it; do not paraphrase it.
Output: A Markdown artifact at a known path. Maximum 300 lines.
Rationalizations
| Excuse |
Why it sounds reasonable |
Why it's wrong |
What to do instead |
| "I already know how this works." |
You may have read this code before. Re-reading feels like wasted time. |
Memory drift is real and unsensed. The function you remember was three commits ago; the current version has a different signature, a new branch, or a defensive check that changes behavior. The bugs that hit hardest in unfamiliar areas are usually in the code the engineer was sure they knew. |
Read the file at the actual current commit before you cite it. If your memory matches what's there, the read takes 60 seconds. If it doesn't, you just avoided a confident wrong answer in your plan. |
| "Grep is enough — I don't need to read the function." |
Grep does locate code. For a one-line lookup, that's the whole job. |
Grep tells you where something appears, not what it does. A function that grep matches on cache.get may also delete on cache miss, may wrap a remote call, may log to a different sink. Citing the file:line without reading it is asserting behavior you haven't verified. |
After Grep finds the call site, open the file and read the function body. Cite file:line in your map only after reading. |
| "Two levels deep is enough — I don't need to follow further." |
Going arbitrarily deep is how exploration sprawls. Time-boxing is correct. |
The trap is stopping deep enough to feel productive but not deep enough to answer the actual scope question. If your scope was "what does this endpoint do," and the second level is a generic ORM call, the answer is still incomplete. |
Re-read your Step 1 scope sentence. If your current trace doesn't answer the in order to <Y> clause, you haven't gone deep enough on the calls that matter. Don't go deeper on calls that don't. |
| "I'll write it up later — let me just keep exploring." |
Writing while exploring breaks flow. |
"Later" usually means after the next task arrives, by which point the trace is gone from working memory. The map ends up reconstructed from a fuzzy recollection, with citations the engineer "thinks are right." That's the same failure mode as not mapping at all. |
Open the artifact file at Step 1 and append as you trace. The artifact is grown, not written at the end. If you finish the trace and the artifact is empty, you're going to write it from memory, badly. |
| "ASCII diagrams are silly — text is fine." |
Some maps genuinely don't need a diagram. Pure prose can carry. |
A diagram-free writeup of a multi-entry-point system is hard to scan and hard to verify. The reader has to mentally reconstruct the call graph from prose. They won't. They'll skim, miss something, and your map becomes a thing nobody actually used. |
If there are 3+ entry points or 2+ modules in the scope, draw the call graph. ASCII is fine. Half the value of mapping is the picture in someone else's head, not the prose in yours. |
Evidence Requirements
| Checkpoint |
Required artifact |
What "no evidence" looks like |
| End of Step 1 |
Two-sentence scope statement at top of artifact |
"I'm exploring the auth module." |
| End of Step 2 |
Bulleted entry-points list with file:line on every row |
"There are a bunch of routes that hit this." |
| End of Step 3 |
Flat trace with file:line on every fact |
"It looks like the cache is checked first, then the DB." |
| End of Step 4 |
Markdown artifact saved at a known path with all 5 sections, ≤300 lines |
"I have a good mental model now." |
If the artifact does not exist as a file you could send to a teammate, you have not
mapped the codebase. You have read some code.
Red Flags
- Your map exceeds 300 lines. Your scope was too wide; return to Step 1.
- More than half the entries in your trace cite the same file. You are reading one
file, not mapping a system.
- Your "Open questions" section is empty. You either understand everything (rare,
suspicious) or you stopped recording uncertainty.
- You wrote the artifact in past tense ("I explored…") instead of present tense
("This module routes…"). The first version is a journal entry; the second is a
map a teammate can use.
- A claim in the artifact has no file:line citation. The reader has to take it on
faith.
References
- Michael Feathers, Working Effectively with Legacy Code (Prentice Hall, 2004),
Chapter 16 "I Don't Understand the Code Well Enough to Change It" — the
scratch-refactoring and effect-sketch techniques are the source of the
diagram-as-deliverable principle in Step 4.
1---2name: map-codebase3description: Use when entering an unfamiliar codebase or area, before making non-trivial changes, when onboarding to a new system, or when planning a refactor that touches multiple modules. Activate for keywords like "explore", "map", "find where", "trace", "how does X work", "what calls Y", "scope of change". Produces an evidence-cited map of the relevant area with file:line references for every claim. Always cite the file and line you read -- never assert behavior you have not verified by reading.4---56# Map Codebase78## Overview910A methodical exploration workflow that produces an evidence-cited map of a codebase11area. Replaces ad-hoc grep with a disciplined four-step pass: scope, list, read,12diagram. The output is a short artifact you can attach to a plan or design doc —13file paths, line numbers, call directions, and the questions you couldn't answer14from reading. The skill's value is enforcing that every claim about the code is15backed by a specific file:line citation, not a memory or pattern-match. Senior ICs16and tech leads use it to bound the blast radius of a change before they propose it.1718## When to Use1920- Before writing a plan that touches more than one module21- When inheriting a codebase area you didn't author22- When a teammate asks "how does X work" and you don't have a confident answer with citations23- Before a refactor, to enumerate everything that calls the code you're about to change24- When debugging crosses a boundary you don't fully understand (auth, ORM, framework internals)2526## When NOT to Use2728- The change is single-file and you've already read the file29- You're modifying code you wrote yourself within the last week30- The "exploration" is really a one-line lookup that `Grep` answers in 5 seconds3132## Process3334### Step 1: Scope3536**Goal:** Pin down what you are mapping and what you explicitly are not.3738**Inputs:** A task, plan, or question that triggered the need to explore.3940**Actions:**41421. Write one sentence: `I am mapping <X> in order to <Y>.` X is concrete (a feature,43 a module, a request path). Y is the decision the map will support.442. Write one sentence naming what is **out of scope**: `I am not mapping <Z>.`45 This prevents the exploration from sprawling.463. Set a time box. 30 minutes for a single feature, 90 minutes for a subsystem.4748**Output:** A two-sentence scope statement at the top of your scratch artifact.4950### Step 2: List entry points5152**Goal:** Enumerate every place execution can enter the area being mapped.5354**Inputs:** The scope statement.5556**Actions:**57581. Find route handlers, controllers, CLI commands, queue consumers, scheduled jobs,59 or event listeners that touch the area. `Grep` for the framework's routing60 primitives.612. List each entry point as `<file:line> — <what triggers it>`.623. If the count exceeds 10, return to Step 1. Your scope is too wide.6364**Output:** A bullet list of entry points with file:line citations.6566### Step 3: Trace and read6768**Goal:** Read the actual code at each entry point and the immediate calls outward,69collecting facts.7071**Inputs:** The entry-points list.7273**Actions:**74751. For each entry point, read the function body. No skimming — line by line.762. Note every call out of that function: which module, which function, which77 file:line.783. Follow each call one level deep. Then stop and decide if you need a second79 level. Most maps don't.804. Record surprises. Lines that don't do what their name suggests, defensive code81 that hints at a past bug, configuration that controls behavior implicitly.825. Record questions. Things you couldn't answer from reading — these become the83 "Open" section of the output.8485**Output:** A flat list of facts, each in form `<file:line> — <what this code does>`,86plus a short list of open questions.8788### Step 4: Diagram and write up8990**Goal:** Compress the trace into a single artifact a teammate can read in 3 minutes.9192**Inputs:** The trace from Step 3.9394**Actions:**95961. Write the artifact in Markdown with these sections:97 - **Scope** (the Step 1 sentences)98 - **Entry points** (the Step 2 list)99 - **Call graph** (a small ASCII diagram or nested bullet list with file:line)100 - **Surprises** (each in form `<file:line> — <what surprised me>`)101 - **Open questions** (each in form `<question> — <where you'd need to look>`)1022. Save it. Even if it's a scratch file in `/tmp`. The artifact is the deliverable.1033. If the map is for a plan or design doc, link it; do not paraphrase it.104105**Output:** A Markdown artifact at a known path. Maximum 300 lines.106107## Rationalizations108109| Excuse | Why it sounds reasonable | Why it's wrong | What to do instead |110|---|---|---|---|111| "I already know how this works." | You may have read this code before. Re-reading feels like wasted time. | Memory drift is real and unsensed. The function you remember was three commits ago; the current version has a different signature, a new branch, or a defensive check that changes behavior. The bugs that hit hardest in unfamiliar areas are usually in the code the engineer was sure they knew. | Read the file at the actual current commit before you cite it. If your memory matches what's there, the read takes 60 seconds. If it doesn't, you just avoided a confident wrong answer in your plan. |112| "Grep is enough — I don't need to read the function." | Grep does locate code. For a one-line lookup, that's the whole job. | Grep tells you *where* something appears, not *what it does*. A function that grep matches on `cache.get` may also delete on cache miss, may wrap a remote call, may log to a different sink. Citing the file:line without reading it is asserting behavior you haven't verified. | After Grep finds the call site, open the file and read the function body. Cite file:line in your map only after reading. |113| "Two levels deep is enough — I don't need to follow further." | Going arbitrarily deep is how exploration sprawls. Time-boxing is correct. | The trap is stopping deep enough to feel productive but not deep enough to answer the actual scope question. If your scope was "what does this endpoint do," and the second level is a generic ORM call, the answer is still incomplete. | Re-read your Step 1 scope sentence. If your current trace doesn't answer the `in order to <Y>` clause, you haven't gone deep enough on the calls that matter. Don't go deeper on calls that don't. |114| "I'll write it up later — let me just keep exploring." | Writing while exploring breaks flow. | "Later" usually means after the next task arrives, by which point the trace is gone from working memory. The map ends up reconstructed from a fuzzy recollection, with citations the engineer "thinks are right." That's the same failure mode as not mapping at all. | Open the artifact file at Step 1 and append as you trace. The artifact is grown, not written at the end. If you finish the trace and the artifact is empty, you're going to write it from memory, badly. |115| "ASCII diagrams are silly — text is fine." | Some maps genuinely don't need a diagram. Pure prose can carry. | A diagram-free writeup of a multi-entry-point system is hard to scan and hard to verify. The reader has to mentally reconstruct the call graph from prose. They won't. They'll skim, miss something, and your map becomes a thing nobody actually used. | If there are 3+ entry points or 2+ modules in the scope, draw the call graph. ASCII is fine. Half the value of mapping is the *picture* in someone else's head, not the prose in yours. |116117## Evidence Requirements118119| Checkpoint | Required artifact | What "no evidence" looks like |120|---|---|---|121| End of Step 1 | Two-sentence scope statement at top of artifact | "I'm exploring the auth module." |122| End of Step 2 | Bulleted entry-points list with file:line on every row | "There are a bunch of routes that hit this." |123| End of Step 3 | Flat trace with file:line on every fact | "It looks like the cache is checked first, then the DB." |124| End of Step 4 | Markdown artifact saved at a known path with all 5 sections, ≤300 lines | "I have a good mental model now." |125126If the artifact does not exist as a file you could send to a teammate, you have not127mapped the codebase. You have read some code.128129## Red Flags130131- Your map exceeds 300 lines. Your scope was too wide; return to Step 1.132- More than half the entries in your trace cite the same file. You are reading one133 file, not mapping a system.134- Your "Open questions" section is empty. You either understand everything (rare,135 suspicious) or you stopped recording uncertainty.136- You wrote the artifact in past tense ("I explored…") instead of present tense137 ("This module routes…"). The first version is a journal entry; the second is a138 map a teammate can use.139- A claim in the artifact has no file:line citation. The reader has to take it on140 faith.141142## References143144- Michael Feathers, *Working Effectively with Legacy Code* (Prentice Hall, 2004),145 Chapter 16 "I Don't Understand the Code Well Enough to Change It" — the146 scratch-refactoring and effect-sketch techniques are the source of the147 diagram-as-deliverable principle in Step 4.
duthaho