Find the bodies.

See what the code shows a change reaches — before review.

When someone asks “what static evidence does this change reach?”, TraceMap answers from the repository instead of memory. It scans code into rule-backed facts and assembles a bounded review packet for contracts, endpoints, dependencies, and SQL surfaces — with a rule ID, evidence tier, coverage label, and file span on every row, and honest gaps where the analysis stops. Runs locally. Reproducible.

It is static evidence, not runtime proof: it shows what the code shows and marks where it cannot be sure. No LLM calls, embeddings, vector databases, or prompt-based classification in the scanner or reducer.

Show me the outputs Run the demo

scan-manifest.json
facts.ndjson
index.sqlite
report.md
logs/analyzer.log

ruleId: contract.delta.impact.v2
tier: Tier2Structural
commitSha: 5e7fe17
classification: NeedsReview

4 evidence tiers

5 scan artifacts

0 AI calls in scanner

First look

Start with the page that matches the question in front of you.

1 Manager asks what this solves.

Use the manager packet to frame static evidence, gaps, limitations, and human review before anyone claims impact or safety.

2 Reviewer needs the packet.

Read the packet guide to follow rule IDs, evidence tiers, coverage labels, source spans, and limitations.

3 Someone needs to see it.

Open public-safe proof assets that make generated report shapes scannable without replacing the source artifacts.

4 Engineer wants to run it.

Run the checked-in demo and inspect public-safe summaries before drilling into local-only artifacts.

5 Mobile reviewer asks about Swift.

Open the Swift v0 evidence lane and pinned real-world smoke proof for static evidence discovery over public app samples.

Evidence journey

The public site now has a deliberate path from question to proof.

OrientStart with the manager packet when the question is why TraceMap matters to a team.

InspectUse the packet guide and capability matrix to keep claims tied to proof paths and status labels.

ShowUse proof assets and proof upgrades to make demo evidence visible without publishing raw internals.

RunUse the demo walkthrough to regenerate the public-safe evidence from checked-in samples, or view the current result.

SwiftUse the Swift evidence lane and real-world smoke proof to inspect the shipped static Swift v0 boundary.

Who it helps

TraceMap turns review questions into evidence packets.

Engineering managers

Use the manager packet to see which contracts, routes, packages, gaps, and coverage labels shaped the review.

Reviewers

Start from the packet guide, rule IDs, evidence tiers, commit SHAs, and line spans when deciding what needs human attention.

Tool builders

Use the output artifacts to consume stable JSON, NDJSON, SQLite, and Markdown without depending on prompts or hidden model state.

Evidence model

No conclusion without evidence.

Tier 1

Semantic

Compiler-resolved symbol evidence where the language adapter can prove identity.

Tier 2

Structural

Known framework, project, endpoint, package, SQL, config, or DTO patterns.

Tier 3

Syntax or text

Useful static clues when semantic proof is not available.

Tier 4

Unknown

Analysis gaps, unavailable sections, reduced coverage, or unable-to-prove cases.

Artifacts

The scanner emits files people and machines can inspect.

scan-manifest.jsonRepo, commit, scanner, build, and coverage metadata.

facts.ndjsonRule-backed facts with evidence tiers and source spans.

index.sqliteQueryable facts, symbols, relationships, surfaces, and flows.

report.mdHuman-readable summary with coverage and known gaps.

logs/analyzer.logAnalyzer diagnostics for partial or failed project loading.

Need something you can hand to a reviewer?

The evidence packet guide shows how to read a generated TraceMap packet without losing the rule IDs, evidence tiers, coverage labels, commit SHA, and limitations behind the summary. The manager packet gives leaders the same bounded evidence story before anyone claims impact or safety.

Workflows

Static evidence for contract and dependency review.

Scan

Index .NET, TypeScript, JVM, Python, and Swift repositories into deterministic facts.

Reduce

Compare contract deltas against indexed evidence and label reduced coverage honestly.

Combine

Merge many indexes with source provenance for cross-repo dependency reports.

Paths and reverse

Trace bounded static evidence from endpoints to surfaces, or from surfaces back to roots.

Diff and impact

Compare snapshots and summarize changed static evidence without claiming runtime behavior.

Release review

Assemble a release-oriented packet from coverage, impact, contract, and gap evidence.

Get started

Run the checked-in public demo.

The demo scans sample repositories, writes a generated artifact bundle, and produces public-shareable summaries without local absolute paths.

git clone https://github.com/joefeser/tracemap.git
cd tracemap
./scripts/demo-public.sh

dotnet run --project src/dotnet/TraceMap.Cli -- scan \
  --repo samples/modern-sample \
  --out .tracemap

Boundaries

TraceMap keeps the claim narrow.

No raw source snippets are stored by default.
No failed or partial scan is reported as clean.
No runtime traffic, production usage, deployment state, or release approval is inferred.
No impact conclusion is emitted without a rule ID and supporting evidence.

Source of truth

Open source, testable, and intentionally inspectable.

Evidence tiers Scan outputs Workflows Examples Capabilities Manager packet Demo proof assets Demo walkthrough Blog Docs First-look path Use cases Limitations Product requirements Validation guide Rule catalog GitHub repository