Impact analysis
Answer one question for the team: given what changed, what else has to change?
The output is the developer-facing half of the delivery flow. Its twin is
delivery-digest, which says the same thing to a
Product Owner. Never mix the two audiences in one file.
Paths
This skill uses the default compass layout below. When the host project puts an
artifact somewhere else, use the host path and say so in the report.
| Artifact |
Default path |
| Specs |
specs/ |
| Decisions |
docs/decisions/ |
| Delivery outputs |
docs/delivery/ |
Read the change first
git diff --stat <base>...HEAD # committed work
git status --short # work in progress
git diff <base> # the actual patch
<base> is whatever the user names (a branch, a tag, HEAD~5). If they do not
name one, ask — guessing the base makes every number in the report wrong.
Never claim an impact you have not opened the file to confirm. A grep hit is
a lead, not a finding.
The seven impact axes
Walk all seven. Report none explicitly for the ones that came back empty —
a silent axis reads as "not checked".
- Behaviour — what a user or a caller can now do, or can no longer do.
Breaking changes get their own line.
- Contracts — API routes, methods, status codes, payloads, DTOs, shared
types, events, queue message shapes. Any consumer of a changed contract is an
impact even if its own files are untouched. See
api-contract-sync.
- Data — schema changes, migrations, backfills, indexes, retention. Say
whether the migration is reversible.
- Configuration — env vars, feature flags, secrets, infrastructure values.
An added variable must land on every surface: validation schema,
.env
example, deployment config. See
env-var-sync.
- Security & privacy — authn/authz, ownership checks on by-id paths, input
validation, injection surface, logging of sensitive values, new dependencies.
- Operations — build, CI, deployment order, rollback path, observability
(does a new failure mode have a signal?).
- Delivery artifacts — the documents listed below.
Documents to check for staleness
For each, state up to date, stale — <what to change>, or not affected.
| Artifact |
Default path |
Goes stale when |
| Specs |
specs/ |
behaviour changed, or a requirement is now implemented |
| Decisions |
docs/decisions/ |
a choice was made or reversed that no ADR records |
| API contracts |
the OpenAPI source and request collection |
any route, payload, status code or auth rule moved |
| Data models |
docs/data-models/ |
a table, column, relation or enum changed |
| Diagrams |
docs/diagrams/ |
a component, container or dependency appeared or vanished |
| Network flows |
docs/infra/network-flows.json |
a new port, protocol, source or destination is required |
| Design system |
design.md |
tokens, components or UI rules changed |
| Assignments |
docs/delivery/assignments.json |
scope moved between profiles, or a gate cleared |
| Module docs |
**/README.md, **/DESIGN.md |
a module's public API, files or configuration changed |
Output
File: docs/delivery/impacts/<YYYY-MM-DD>-<kebab-slug>.md
---
title: <one line, what this change is>
date: <YYYY-MM-DD>
base: <the base reference>
audience: dev
---
# <title>
## Change set
<n> files, +<insertions> / −<deletions>. Commits: <n>.
One line per meaningful group of files — not a file listing.
## Impacts
### Behaviour
### Contracts
### Data
### Configuration
### Security & privacy
### Operations
Each axis: findings, or `None.`
## Documents to update
| Document | State | Action |
| --- | --- | --- |
## Action plan
Ordered checklist. Each item names a file or a command, and an owner profile
when `docs/delivery/assignments.json` says who owns that scope.
- [ ] …
## Risks
What could still break, and how you would notice.
## Validation
The commands that prove this change works, and their result:
`passed` | `failed` | `partial` | `not run` + reason.
Rules
- Order the action plan by dependency, not by severity. A blocked item first is
a stalled plan.
- An item nobody can act on is a risk, not a task.
- If the diff is truncated, say so and name what you did not read.
- Do not fix anything from this skill. It produces the plan; a separate task
executes it.
- Do not commit or push. The user commits.
1---2name: impact-analysis3description: Analyse what changed since a base git reference and produce the developer action plan — technical impacts, blast radius, and the exact project documents that are now stale. Use when the user asks for the impact of a change, what a branch breaks, what a diff affects, which docs to update after a change, or a technical action plan before merging.4license: MIT5---67# Impact analysis89Answer one question for the team: **given what changed, what else has to change?**1011The output is the developer-facing half of the delivery flow. Its twin is12[`delivery-digest`](../delivery-digest/SKILL.md), which says the same thing to a13Product Owner. Never mix the two audiences in one file.1415## Paths1617This skill uses the default compass layout below. When the host project puts an18artifact somewhere else, use the host path and say so in the report.1920| Artifact | Default path |21| --- | --- |22| Specs | `specs/` |23| Decisions | `docs/decisions/` |24| Delivery outputs | `docs/delivery/` |2526## Read the change first2728```bash29git diff --stat <base>...HEAD # committed work30git status --short # work in progress31git diff <base> # the actual patch32```3334`<base>` is whatever the user names (a branch, a tag, `HEAD~5`). If they do not35name one, ask — guessing the base makes every number in the report wrong.3637**Never claim an impact you have not opened the file to confirm.** A grep hit is38a lead, not a finding.3940## The seven impact axes4142Walk all seven. Report `none` explicitly for the ones that came back empty —43a silent axis reads as "not checked".44451. **Behaviour** — what a user or a caller can now do, or can no longer do.46 Breaking changes get their own line.472. **Contracts** — API routes, methods, status codes, payloads, DTOs, shared48 types, events, queue message shapes. Any consumer of a changed contract is an49 impact even if its own files are untouched. See50 [`api-contract-sync`](../api-contract-sync/SKILL.md).513. **Data** — schema changes, migrations, backfills, indexes, retention. Say52 whether the migration is reversible.534. **Configuration** — env vars, feature flags, secrets, infrastructure values.54 An added variable must land on every surface: validation schema, `.env`55 example, deployment config. See56 [`env-var-sync`](../../knowledge/instincts/env-var-sync.md).575. **Security & privacy** — authn/authz, ownership checks on by-id paths, input58 validation, injection surface, logging of sensitive values, new dependencies.596. **Operations** — build, CI, deployment order, rollback path, observability60 (does a new failure mode have a signal?).617. **Delivery artifacts** — the documents listed below.6263## Documents to check for staleness6465For each, state `up to date`, `stale — <what to change>`, or `not affected`.6667| Artifact | Default path | Goes stale when |68| --- | --- | --- |69| Specs | `specs/` | behaviour changed, or a requirement is now implemented |70| Decisions | `docs/decisions/` | a choice was made or reversed that no ADR records |71| API contracts | the OpenAPI source and request collection | any route, payload, status code or auth rule moved |72| Data models | `docs/data-models/` | a table, column, relation or enum changed |73| Diagrams | `docs/diagrams/` | a component, container or dependency appeared or vanished |74| Network flows | `docs/infra/network-flows.json` | a new port, protocol, source or destination is required |75| Design system | `design.md` | tokens, components or UI rules changed |76| Assignments | `docs/delivery/assignments.json` | scope moved between profiles, or a gate cleared |77| Module docs | `**/README.md`, `**/DESIGN.md` | a module's public API, files or configuration changed |7879## Output8081File: `docs/delivery/impacts/<YYYY-MM-DD>-<kebab-slug>.md`8283```markdown84---85title: <one line, what this change is>86date: <YYYY-MM-DD>87base: <the base reference>88audience: dev89---9091# <title>9293## Change set9495<n> files, +<insertions> / −<deletions>. Commits: <n>.96One line per meaningful group of files — not a file listing.9798## Impacts99100### Behaviour101### Contracts102### Data103### Configuration104### Security & privacy105### Operations106107Each axis: findings, or `None.`108109## Documents to update110111| Document | State | Action |112| --- | --- | --- |113114## Action plan115116Ordered checklist. Each item names a file or a command, and an owner profile117when `docs/delivery/assignments.json` says who owns that scope.118119- [ ] …120121## Risks122123What could still break, and how you would notice.124125## Validation126127The commands that prove this change works, and their result:128`passed` | `failed` | `partial` | `not run` + reason.129```130131## Rules132133- Order the action plan by dependency, not by severity. A blocked item first is134 a stalled plan.135- An item nobody can act on is a **risk**, not a task.136- If the diff is truncated, say so and name what you did not read.137- Do not fix anything from this skill. It produces the plan; a separate task138 executes it.139- Do not commit or push. The user commits.
me-cedric