Fallout: Guardian of Blast-Radius

In any development team, a code change can pass all of its own tests and still break something in production. That happens because unit tests only check the file that changed, not the project as a whole. If a function's signature changes, or a model field gets removed, other files that depended on that piece can end up broken without anyone noticing before the merge — especially on small teams without someone dedicated to reviewing the impact of every Pull Request. Fallout is a CLI tool that analyzes the "blast radius" of a change before it's merged: what was modified, who else in the project depends on that piece, whether the documentation is now outdated, and whether test coverage exists for the change. It works with zero configuration on JavaScript, TypeScript, and Python projects, detecting: - Exports that were removed or had their signature changed, while still being used elsewhere - Model fields (Django, SQLAlchemy, Prisma) removed but still referenced - Drift between the OpenAPI spec and the actual routes in the code - New environment variables missing from .env.example - Modified modules with no test coverage With that evidence in hand, Fallout issues a verdict (BLOCK, REVIEW, or OK) and generates a prompt ready to hand off to IBM Bob. From there, Bob 2.0 does what a script can't: it reads the project's real architecture, runs 3 subagents in parallel (impact verification, documentation fixes, and missing test generation), and delivers a branch with the proposed fixes without ever touching the original branch. Designed for small teams or independent developers who do not have a formal impact review process in place before each merge and who need an automated safety net that does not interfere with their daily workflow. The developer runs: node bin/guardian.mjs analyze --repo <project> --run-tests before merging their branch. If the risk is high, they run: node bin/guardian.mjs prompt --repo <project> --copy which automatically prepares the message with all the collected evidence and copies it to the clipboard. That message gets pasted straight into Bob 2.0, in "PR Guardian" mode, with nothing to write by hand. Fallout doesn't try to replace human judgment or act as an AI that decides on its own: its job is to gather concrete, verifiable evidence (diffs, cross-references, real test results), and let Bob interpret that evidence through 3 specialized roles, each with write permissions restricted to its own scope — the Analyst only reads, the Docs Guardian only edits documentation, the Test Synthesizer only edits tests. This division of responsibility reduces the risk of an autonomous agent making unwanted changes outside its lane. By combining a fast static analysis (seconds) with Bob's reasoning only when it's actually needed, Fallout avoids spending AI compute on low-risk changes, and focuses the subagents' work exactly where the local analysis detected a real threat.