Starting point
You inherited a codebase nobody explains
Where you are
The team that wrote it is gone. It builds, the tests pass, and you are about to change something without knowing what else it touches or why it was written that way.
You run Compiler, Example-Based Tests. Already closed: wrong logic, not internally consistent. 2 of 19 doubts.
Add in this order
Each step closes a doubt the previous ones left open.
-
Hotspot Analysis Architecture closes nobody knows where the risk sits
Compiling and passing say nothing about where the trouble sits. One run over twelve months of git history ranks the modules that are both complex and constantly changed, which is where your first change is most likely to hurt and where the rest of this list should point.
-
Dependency Graph Architecture closes nobody knows where the coupling is
The hotspot says where to look; the graph says what a change there reaches. Fan-in on the hot modules and the cycle list are the two numbers you need before touching anything, and an import rule that refuses an edge is the cheapest reading of them.
-
Decision Provenance Human Comprehension closes nobody can find out why
You now know where the coupling is and still not why. Pick one line in the top hotspot that looks wrong and trace it with git blame and git log -S; how far back the reason survives is the reading, and it costs twenty minutes per question.
-
Snapshot Tests Behavioral closes unintended change
You are about to change code you do not understand, and the inherited tests encode the previous team's intentions. Recording the current output of the hot module freezes behaviour you cannot yet judge, so the diff tells you when a change touched something you did not mean to.
-
Mutation Testing Test Effectiveness closes unasserted execution
The snapshots guard what you froze; the inherited suite is the rest of your net, and passing only says it ran. One mutation run on the top hotspot tells you whether those tests would notice a wrong answer, and its no-coverage column tells you which code they never saw at all.
-
Smoke Tests Behavioral closes does not run where deployed
Every step so far happens before deploy. Your first release is the first time the runbook is followed by someone who did not write it, and four requests against the fresh deploy find the missing config value in minutes rather than from a user.
After these steps: 8 of 19 doubts closed. Still untouched: unjudged observation, unspecified property, wrong specification, missing behavior, emergent failure, untested conditions, correlated blind spot, late effects, unreached by tests, falls over with a dependency, cannot carry the load.
What not to add yet
-
It closes the same doubt as decision provenance, and you are already the subject. A single run with no control subsystem is an anecdote, and the anecdote is your own week.
-
Also closes the coupling doubt, and finds pairs the dependency graph cannot see. Run it after the graph, because the finding is a pair that changes together with no import edge between them, and you need the edges first to know which pairs those are.