How to review a pull request's blast radius with a code graph

What is a code review blast radius?

A blast radius is the affected neighborhood around a change. It includes direct callers, transitive consumers, shared types, route boundaries, tests, operational configuration, and documentation that may need to change with the code.

• A small diff can change a shared interface with many consumers.
• A large diff can be locally contained if it does not cross architectural boundaries.
• Impact can include non-code behavior such as contracts and operational assumptions.

Why is the pull request diff not enough?

The diff shows additions and deletions but not the dependency paths entering or leaving the changed code. Reviewers must reconstruct those paths manually unless a graph or code intelligence tool provides them.

• Diff tools do not automatically identify distant callers.
• Search finds strings but not every semantic dependency.
• A graph can surface paths that are easy to miss in a folder-oriented review.

How does a code graph expose impact?

A code graph stores files, symbols, imports, calls, and documentation links as nodes and edges. Starting from changed symbols, reviewers can traverse incoming and outgoing relationships to build an impact list.

• Identify direct callers and reverse dependencies.
• Follow multi-hop paths into route handlers or data-access modules.
• Connect changed code to design notes and tests.
• Use confidence labels to separate extracted edges from inferred relationships.

What is a practical graph-assisted PR review workflow?

Build or refresh the graph for the reviewed commit, map changed symbols to nodes, inspect reverse dependencies and architecture boundaries, then read every high-impact source file and run the related tests.

• Generate the changed-symbol list from the pull request.
• Trace affected nodes with a bounded depth.
• Rank findings by user-facing behavior, shared interfaces, and missing test coverage.
• Attach source paths and evidence to every review concern.

How do you query the blast radius in Graphify?

Use Graphify's affected command from the changed symbol, then inspect the resulting paths in graph.json or the interactive report. Adjust depth and relation filters to avoid returning an unusable list.

• Start with the smallest symbol that represents the changed contract.
• Trace call or reference relationships depending on the codebase.
• Refresh the graph after large rebases, directory moves, or generated-code changes.

What are the limits of graph-based review?

A graph may miss dynamic dispatch, runtime registrations, external services, feature-flag behavior, and deployment-specific configuration. The reviewer must use tests, traces, and source evidence to close those gaps.

• Graph edges are a map of candidate impact.
• Inferred or ambiguous edges need explicit source verification.
• Runtime behavior and user impact require tests or observability.