Appendix B — Engineering Moves

B.10 Make Hidden Dependencies Queryable

Problem. Cross-cutting mechanisms depend on assumptions about the substrate they inspect. When those dependencies remain implicit, a substrate change can either break many controls at once or silently invalidate part of their coverage.

Move. Represent consequential dependencies explicitly so the impact of a proposed change can be queried before it lands.

Figure B.10-1 fans a change out to its dependents.

C.10 Make hidden dependencies queryable: compute what a substrate change touches before it lands A proposed change targets a substrate node. Three things depend on that node and interpret the change differently: one control blocks it, another control is unaffected, and a model derives from it. Because each dependent declares its assumption explicitly, the set of affected dependents — the blast radius — is a query computed before the change lands, rather than a grep-and-read exercise afterward. CHANGE X proposed SUBSTRATE NODE CONTROL A blocks CONTROL B unaffected MODEL C derives BLAST RADIUS Declare each dependency as typed metadata on the dependent. Change impact becomes a graph query over declared dependencies.
Figure B.10-1. Impact as a graph query. A proposed change reaches a substrate node; typed dependency edges identify the controls and models that depend on it, and their union defines the affected set.

Example — Control blast radius. Each control declares its substrate dependencies as structured metadata. A query identifies which controls depend on a proposed substrate change and how each relation should be interpreted.

Example — Traceability. Symbol-anchored traceability applies the same move across engineering artifacts. Model elements, lints, code, proofs, and registries join through derived, re-checked edges. The resulting graph lets engineers query what a change affects and inspect why.

Related mechanisms: Control ↔ substrate dependency · Computed Control Blast Radius · Governance Graph · Symbol-anchored traceability · Derived Traceability.

© James C. Davis, 2026–present