Graphify trial on aspire-digital-group monorepo
Context
Evaluated safishamsi/graphify — a codebase-to-knowledge-graph tool with 31 language extractors. Decision gate from aios-workflow: adopt if ≥2 new cross-coupling facts surface; reject otherwise.
Detail
Run summary
| Metric | Value |
|---|---|
| Files extracted | 435 |
| Words analyzed | ~154,954 |
| Nodes | 2,209 |
| Edges | 2,935 |
| Communities | 220 (161 shown, 59 thin omitted) |
| Extraction quality | 98% extracted / 2% inferred / 0% ambiguous |
| Token cost | $0 (AST-only, no LLM) |
| Wall-clock time | ~12 seconds |
| Output size | 3.3 MB total (graph.json 1.6 MB + graph.html 1.6 MB + GRAPH_REPORT.md 32 KB) |
| Commit baseline | 207d15be |
Top god-nodes (most-connected core abstractions)
| # | Symbol | Edges | Where | Significance |
|---|---|---|---|---|
| 1 | requireRole() | 32 | apps/aspire-staff-portal/src/lib/authz.ts:5 | Aspire Hub role-gating — most depended-on code |
| 2 | authenticate() | 27 | auth flow entry | Second-most depended-on |
| 3 | hasScope() | 25 | OAuth scope check | Third-most |
| 4 | cn() | 24 | packages/ui/lib/utils.ts | Tailwind class merge (expected) |
| 5 | compilerOptions | 18 | TS configs | tsconfig inheritance |
| 6 | ReportsPage() | 16 | Reports component | Cross-app reuse worth investigating |
| 7 | sendTelegramMessage() | 15 | Telegram helper | Confirms Telegram is THE primary comms |
| 8 | buildTodayPreset() | 15 | Date helper | Widely reused date logic |
| 9 | AGENTS.md (Aspire Hub) | 15 | Doc file | Graphify treats docs as nodes (15 backlinks) |
| 10 | hashToken() | 14 | packages/utils/encryption.ts | Shared security primitive |
Cross-coupling facts surfaced (gate criterion — ≥2 needed)
- ✅ NEW — Aspire Hub's auth function blast radius is large + quantified for the first time.
requireRole()32 edges,authenticate()27,hasScope()25. Any refactor of authz touches ~80+ call sites.
- ✅ NEW — Telegram comms is the single most-used comms primitive (
sendTelegramMessage()15 edges). Reinforces the Telegram Bot Pattern (LOCKED in MEMORY.md). Suggests an opportunity for a typednotify()abstraction inpackages/notifications/.
- ✅ NEW — 8 communities (3, 4, 6, 9, 10, 11, 12, 14) have near-identical
@aspire/*dependency footprints. Possible interpretations: - Consolidation opportunity (shared
apps/_template/orpackages/app-shell/) - OR confirmation of a stable shared-packages pattern (no action needed)
- Investigate before refactoring
- 🟡 Expected (not new):
hashToken()shared across multiple OAuth endpoints.
- 🟡 Interesting (not actionable):
AGENTS.mddoc has 15 backlinks because graphify treats markdown sections as graph nodes.
Verdict
ADOPT as quarterly audit step. 3 of 5 reported findings were genuinely new (gate required ≥2).
Operating rules
- Add
graphify-out/to each audited repo's.gitignore(build artifact) - Run quarterly via
external/improve-codebase-architectureskill — NOT daily workflow - Do NOT wire the graphify MCP into agents by default
- Re-run after major refactors to verify complexity moved, not just relocated
Next audit targets
- [ ]
zinga-pms(largest Next.js standalone) - [ ]
alby-studio(auth + storefront + Stripe Connect coupling) - [ ] MCP servers batch 1 (5-8 servers at a time)
- [ ] Re-run on
aspire-digital-groupafter next major refactor
Open questions
- Should the 8-app shared-deps cluster be consolidated into a
packages/app-shell/, or is it a stable healthy pattern? - Does the auth-function blast radius warrant breaking authz into smaller modules, or is the centralization actually a feature?
- Worth merging multiple repo graphs via
graphify merge-graphsto see cross-repo flows?
Provenance
Tool: graphifyy v0.8.13 (PyPI; CLI command graphify). Source repo: https://github.com/safishamsi/graphify. Trial output (gitignored): ~/Desktop/Claude/projects/aspire-digital-group/graphify-out/.
Related
🔗 Relationships
graph LR
graphify_trial_2026_05_20["graphify-trial-2026-05-20"]:::self
graphify_trial_2026_05_20 --> aios_workflow["aios-workflow"]
classDef self fill:#715EE3,color:#fff,stroke:#291F50;