Impact analysis example
What breaks when you change RedwoodJS (packages/api)?
Real arc impact output on RedwoodJS (packages/api) — same structure as the homepage demo. Know blast radius before you merge.
Project: RedwoodJS (packages/api) · Score: 95.3/100 (Excellent architecture) · 31 modules · 42 edges
Engineering decision simulation
Validation procedure 01 · merge vs. hold before output
Before arc impact
You plan a change to a high fan-in module in RedwoodJS (packages/api). Would you merge without knowing blast radius?
Typical answer: hold — need dependency context.
After arc impact
Structured output below: score, hotspots, corridors, and high-risk modules — same field schema as the homepage proof.
Decision: confirm hold, narrow change, or inspect paths first.
Published as part of the validation record. Run locally: arc impact <file-you-are-changing>
Architectural Risk Map
Where risk accumulates by control surface — drill down Surface → Substrate → Mechanism → Evidence.
See control surfaces →Dependency evidence
Architecture visualization
Diagrams are generated from ArcSight analysis data. Dependency graph and risk map show key modules; subsystem view shows high-level structure.
Architecture score & metrics
Score: 95.3/100 · Stability: 51/100 · Status: healthy · Confidence: 100%
- Dependency cycles: 8
Modules to inspect
One row per module. Fan-in is direct dependents. Blast radius is downstream modules reachable from that file.
- src/auth/verifiers/common9 dependents
- src/cache/clients/BaseClient4 dependents
- src/auth/verifiers/base64Sha1Verifier1 dependents
- src/auth/verifiers/base64Sha256Verifier1 dependents
- src/auth/verifiers/jwtVerifier1 dependents
- src/auth/verifiers/secretKeyVerifier1 dependents
- src/auth/verifiers/sha1Verifier1 dependents
- src/auth/verifiers/sha256Verifier1 dependents
- src/auth/verifiers/common10 modules
- src/auth/verifiers/base64Sha1Verifier10 modules
- src/auth/verifiers/base64Sha256Verifier10 modules
- src/auth/verifiers/jwtVerifier10 modules
- src/auth/verifiers/secretKeyVerifier10 modules
- src/auth/verifiers/sha1Verifier10 modules
- src/auth/verifiers/sha256Verifier10 modules
- src/auth/verifiers/skipVerifier10 modules
| Module | Fan-in | Blast | Risk |
|---|---|---|---|
| src/auth/verifiers/common | 9 | 10 | LOW |
| src/auth/verifiers/base64Sha1Verifier | 1 | 10 | LOW |
| src/auth/verifiers/base64Sha256Verifier | 1 | 10 | LOW |
| src/auth/verifiers/jwtVerifier | 1 | 10 | LOW |
| src/auth/verifiers/secretKeyVerifier | 1 | 10 | LOW |
| src/auth/verifiers/sha1Verifier | 1 | 10 | HIGH |
| src/auth/verifiers/sha256Verifier | 1 | 10 | HIGH |
| src/auth/verifiers/skipVerifier | 1 | 10 | HIGH |
| src/auth/verifiers/timestampSchemeVerifier | 1 | 10 | HIGH |
| src/cache/clients/BaseClient | 4 | 4 | CRITICAL |
CLI workflow
Scan → Fix → Finish → Watch. Nothing else required.
arc scanFind issuesarc fixApply fixesarc finishResolve remainingarc watchKeep clean
Key takeaways
- •Architecture score 95.3/100 indicates a healthy structure with room to reduce cycles and violations.
- •Structural scan reports dependency cycles — inspect impact paths before refactors that cross module boundaries.
- •High fan-in modules are change-risk zones; run
arc explain <path>before refactoring. - •Run the full workflow (analyze, hotspots, explain, impact, snapshot, drift) in your repo for deterministic architecture insights.
Run ArcSight on your repo
Install the CLI and run analyze, then hotspots and explain for the same workflow.
This case study is generated from ArcSight analysis data. View short analysis. View all analyses