UCM
Open Source Probabilistic Code Impact Analysis
Possible Architecture for Reliable Knowledge in Agentic AI
Paritosh Kulkarni · CTO, Attian AI
github.com/paritoshk/ucm-core
Check out my website
Quick
show
of hands
How many of you have asked an LLM or AI agent: 'how confident are you about that?' : and gotten back a meaningless 'I'm quite confident' with zero calibration/reasoning? 👋
How many of you have watched an agent/coding LLM generate a full test suite, pass every single test with flying colors : and then your code broke in production because it gamed its own tests? 👋
These are the same problem. The agent has no mechanism to know what it doesn't know.
The Problem
You Deploy on Friday. Tests Pass.
"Monday morning: payments are broken."
You changed validateToken() — but didn't know processPayment depends on it 2 hops away. In a microservice codebase, knowing what to test is harder than writing the tests.

📊 Real stat: the marimo case study found 182 transitive impacts from a single runtime file change.
What UCM Does
Code Confidence in 30 Seconds
1 · Scan
Ingests your codebase and builds a Bayesian dependency graph — entities, edges, and confidence scores.
2 · Answer
"I changed X — what else breaks, and how confident are you?" Propagates uncertainty across the full call chain.
3 · Generate
Produces test plans with confidence scores and explanation chains so you know exactly what to focus on.
UCM Explained
UCM in a Nutshell
You change a function. UCM answers three critical questions: what else might break (impact), how confident are we (trust), and what should you test (intent). It achieves this by building a dynamic dependency graph of your codebase and running a reverse Breadth-First Search from the changed node, decaying confidence at each hop.
Why these three math models — what problem does each solve?
1
Noisy-OR
Problem: Multiple weak signals → one score
Without it: You'd naive-multiply (e.g., 0.8 × 0.7 = 0.56), leading to overly pessimistic results. Noisy-OR gives a more realistic 0.94, correctly inferring that if either path confirms it, it's likely real.
2
Temporal Decay
Problem: Facts go stale at different rates
Without it: An import edge from two years ago and one from yesterday would receive the same weight. Temporal decay ensures older, potentially dead or less relevant code connections carry less weight.
3
Chain Confidence
Problem: Impact attenuates with distance
Without it: A 10-hop transitive dependency would seem as risky as a direct import. Research (e.g., Meta) shows that beyond ~10 hops, signal often degrades into noise, which this model accounts for.
UCM Architecture Diagram
Source code, Git diffs, Linear/Jira, and API logs {FEED} into ucm-ingest, → parsers normalize the inputs into VecUcmEvent. → events are persisted in EventStore, an append-only log designed for idempotent replay and causation chains so the system can reconstruct history reliably.
Data is materialized into UcmGraph, → as a petgraph StableGraph with SCIP-based identity, N
Noisy-OR edge aggregation, and temporal decay to reduce the influence of older or weaker relationships. → graph powers analyze_impact(), → performs a reverse BFS from the changed node while decaying confidence at each hop to produce DecisionTrace and impacted Changed entities
generate_test_intent() converts the analysis into actionable testing guidance: must test, should test, key risks, and coverage gaps.
Final result is emitted as JSON and delivered through the API, CLI, or Dashboard for downstream use.
Context
Why This Belongs at a Postman Meetup
"APIs are only as reliable as the context agents use to call them."
What Postman Solves
Single-API freshness — changelog alerts, spec sync, contract testing.
What UCM Solves
Cross-system confidence propagation across the full dependency chain.
The Missing Layer
API v2.3 ships a breaking change
The compliance doc referencing v2.2 is now suspect
UCM flags it — with a confidence score — before your agent calls it wrong
UCM is the missing layer between API tooling and agent reliability.
Bayesian Confidence Propagation
Confidence Decay Across Hops
validateToken ──(95%)──
  1. Noisy-OR fusion
P(edge) = 1 − Π(1 − P(source_i)) S
2. Temporal decay (confidence is not timeless)
confidence(t) = base × exp(−λ × days_since_verified)
3. Chain confidence (BFS propagation
P(A impacts C) = Π edge_weight_i along path
MATH EXPLAINED
Architecture
Rust + Axum + API-First
ucm-core
Graph engine + Bayesian math. Powered by petgraph.
ucm-ingest
Parsers for code, git, Jira, and Linear.
ucm-reason ← THE LLM LAYER that feeds in the JSON
BFS impact engine + test intent generation.
ucm-api ← WHAT YOU SEE IN POSTMAN (RUST Server
Axum REST server — 13 endpoints. This is your Postman surface.
ucm-cli
Terminal interface for local workflows. - COMING SOON
Hexagonal architecture: core logic isolated from infrastructure. Event-sourced: state is fully replayable from the canonical event log.
🔴 Live Demo
Postman Hitting the UCM API
This is the centerpiece. Open Postman — not slides.

🎙️ Step 4 narration: "I told the engine I changed validateToken. It found authMiddleware at 95% (direct import), processPayment at 76% (2 hops), and flagged JIRA-AUTH-42 as ambiguous — Jira says OAuth2 but middleware still uses JWT."
Validation
Real Validation: marimo Case Study
Scale Metrics
1,108
Python Files
Scanned across the marimo codebase
8,117
Entities
Discovered and indexed
14,582
Edges
Built in the dependency graph
78%
Connected
Largest connected component of graph
5-Scenario Blast Radius Test
UI slider plugin → 0 impacts ✅
Correctly identified as isolated. No false positives.
Runtime module → 182 impacts ✅
Correctly flagged as high-blast-radius. Exactly what you need to know before deploying.
The engine correctly distinguishes isolated leaf nodes from central runtime components — without any manual labeling.
MARIMO (as seen on github)
Integrations : FUTURE
Linear & Jira : Postman in the Workflow
Future Next Steps
Deeper Linear and Jira sync to keep requirements, issues, and code references continuously aligned
Expanded Postman automation for collection imports, monitor health checks, and release-time validation
Smarter impact analysis to surface blast radius, risk scoring, and likely breakpoints before deployment
More connected workflows across UCM, tickets, APIs, and alerts so teams can move from change to confidence faster
Linear / Jira → Graph Edges
01
POST /linear/connect — connect your workspace
02
POST /ingest/linear — pull 50 issues as Requirement nodes
03
Jira tickets and Linear issues now have graph edges to the code they reference
04
Example: JIRA-AUTH-42 → validateToken at 70% confidence
Postman in the Loop
Postman Collection
Your full API testing surface — ship it, import it, use it.
Postman Monitors
Scheduled /health + /graph/stats checks — always know your graph is live.
Postman Flows
Chain POST /ingest/code → POST /impact → alert on high-risk changes automatically.
Collection V3
Version your UCM collection in git alongside your code.

"Every time you push code, Postman can automatically ask UCM: what just broke?"
Roadmap
Open Source
The UCM Roadmap
Building the Future of Code Confidence Together
Advanced Ingestion
LSIF/SCIP support for real-time, precise code indexing beyond regex.
LLM-Powered Summaries
AI-generated explanations for impact reports, making complex changes understandable.
Postman Collection V3
Native support for Postman Collections, streamlining API contract validation.
CI/CD Plugin
Automated impact reports and confidence scores directly on pull requests.
We're actively seeking OSS contributors to help us accelerate these initiatives and expand UCM's capabilities.
Open Source · Roadmap · CTA
MIT Licensed. Built for Agentic Systems. (Try Railway hosted API)
What's Live Today
github.com/paritoshk/ucm-core
Deployed on Railway: try it from Postman right now
Dashboard on Vercel with React Flow graph visualization (included)
Get Involved
⭐ Star Us
github.com/paritoshk/ucm-core
🔧 Try in Postman
Import the collection → hit IMPACT
💬 Work With Us
Custom knowledge & context management. Automate tests for your AI agentic systems.
CASE STUDY
Email
Made with