Not yet generally available. Blast Radius ships in Shipmoor CLI 0.9.0, which is still in the release process. This page describes shipped behavior on the release candidate; the command is not on the stable channel yet.
Synopsis
shipmoor blast [target]target is the project directory or repo root, defaulting to the current directory.
The change surface is resolved through the same shared selectors that scan, review, claim-check, and test-evidence use, so a selector means the same thing everywhere. The default surface is the working-tree diff.
Flags
| Flag | What it does |
|---|---|
--staged | Read the staged changes only (index vs HEAD). |
--diff SPEC | Read a raw Git diff spec, such as main...HEAD. |
--all | Read the whole tree, not just the change surface. |
--from REF | Range base ref (merge-base), given together with --to. |
--to REF | Range head ref, given together with --from. |
--gaps | Show what was never governed, in four lists. See Gaps. |
--repin LINK-ID | Re-pin a suspect link at its current endpoint identities and record the event in the committed store. Repeatable; one link id per occurrence. |
--no-write | Do not write the store. Suppresses the automatic re-pin and makes --repin a dry run; the intended change is disclosed, never applied. Also suppresses the report file. |
--terse | Print only the one-line summary, for a CI status line. |
--json | Also write the blast.v1 report as JSON to stdout, so it can be piped. |
--no-color | Disable terminal color. |
The selector flags are mutually exclusive.
A malformed committed store and a malformed config are both usage errors, not warnings. An unreadable store must never read as an empty graph, and an unparseable config must never silently downgrade an opted-in ratchet.
Exit codes
| Code | When |
|---|---|
0 | The default. Suspects are advisory: they are reported and the run still exits clean. |
1 | This run classified at least one suspect and the repo set blast.suspect_threshold: fail. |
2 | A usage error: a bad selector, a malformed committed store, or a malformed config. |
Unresolvable links, gaps, and rerun advisories never affect the exit code under any threshold. They are disclosed unknowns and disclosed absences, and a run that failed on them would punish exactly the repos that have not adopted the feature yet.
The three surfaces agree
--terse condenses the headline counts to one line for a CI log. --json emits the whole report. The default human screen shows counts, then findings, then the exit.
All three read the same numbers, so they cannot disagree. The renderer holds no logic: every count it prints is the length of a list it was handed.
The blast.v1 report
A reporting run writes the versioned report to .shipmoor/blast.v1.json, beside the link store, and the foot line names the file it wrote.
--json additionally emits it on stdout. The bytes on stdout and the bytes on disk are the same serialization, so a piped report and a saved one can never differ.
--repin is a mutation verb: it reports what it re-pinned and writes no run report.
The destination is fixed
There is no flag to send the report somewhere else, and that is deliberate. A report is written by swapping a whole file into place, so a caller-named destination is a way to atomically overwrite approved state such as the committed link store or the frozen acceptance set. Guarding a named path proved to be the wrong shape of answer, so the input was removed instead.
Redirect the stream if you want the report elsewhere:
shipmoor blast --json . > /tmp/blast.v1.json--no-write suppresses the report file exactly as it suppresses the store write: the run still reports everything on screen, writes nothing to the working tree, and says report not written (--no-write) on the foot line. A destination that cannot be written is disclosed the same way and never claimed as written. The write is atomic, so a failure part-way through leaves the previous report intact rather than a truncated one.
What it carries
The classification of every link with its provenance, the derived verifies edges with their freshness, the four gaps lists, the run’s disclosures, the resolved threshold, and the exit code.
Two runs over an unchanged repo produce byte-identical output. There is no timestamp, no duration, and no ordering that depends on anything but repo state.
Every non-reproducible value lives in one run_context block. Dropping that key yields a portable payload that hashes stably, which is how a later composition will wrap a blast report as evidence. A check outcome is wrapped the same way today, with the volatile fields stripped before hashing.
The full contract is frozen in the package as report_schema.md.
Do not commit it
Unlike the link store in the same directory, the report is generated, not authored. No human reviews it and every run overwrites it wholesale, so ignore it rather than commit it — the same treatment the scan cache gets:
.shipmoor/blast.v1.jsonKeep the entry targeted. A broad .shipmoor/ entry would also ignore .shipmoor/links.yaml, and an ignored link store breaks the approval mechanic the whole feature rests on: committing the store is what approves it.
A repo that does not ignore the report will simply see it as a changed file on the following run. That is harmless: it is classed as a Shipmoor control artifact and never counts as ungoverned code, and the count settles after one run rather than growing.
Config block
Full detail on Configuration and exit semantics.
schema_version: 1
blast:
suspect_threshold: warn # off | warn | fail| Key | Default | What it controls |
|---|---|---|
blast.suspect_threshold | warn | Whether a suspect fails the run. off and warn both exit 0 and differ only in the summary line’s tone; neither hides a finding. fail is the opt-in ratchet. |
The verifies join also reads claim_check.runners.test, because the rung it calls binds only a check something can run. Without a runner configured, no edges are derived and the run says so rather than presenting an empty graph as a clean one.
What is on disk afterward
The committed store .shipmoor/links.yaml, carrying any pins the run recorded, and the blast.v1 report at .shipmoor/blast.v1.json. Nothing else. No daemon, no database, no network.