Overview

Not yet generally available. Blast Radius ships in Shipmoor CLI 0.9.0, which is still in the release process. This page describes shipped behavior on the release candidate; the command is not on the stable channel yet.

shipmoor blast answers one question about a change: what else does it touch?

Given the change surface, it walks the committed link graph and reports which acceptance obligations became suspect because their realizing code moved, which checks verify the touched behavior and should re-run, which doc sections are now stale candidates, and, in the other direction, which code became suspect because an obligation or a doc section changed while the code did not.

It is a standalone command, a peer to scan, review, claim-check, and test-evidence in the same shipmoor binary.

The problem it solves

A coding agent changes app/login.py. The diff is clean, the tests are green, the review finds nothing. Nobody notices that AC-04 — the acceptance obligation that code was written to satisfy — still describes the old behavior. Or the reverse: someone edits an obligation to sharpen what the system promises, and the code that realizes it is never touched.

Neither of these is a bug in the ordinary sense. There is nothing to catch in the diff, because the defect is not in the change. It is in the relationship between the change and everything the change was supposed to stay consistent with.

That relationship is not recoverable after the fact. A reviewer looking at a two-file diff has no way to know which obligations, checks, and doc sections used to line up with those files. Blast Radius exists because that knowledge has to be recorded while it is still known, and then checked mechanically on every change.

The one law: no lexical inference, ever

This is the shortest and most important thing to understand about the feature.

Every link is authored by a human, or minted from causal evidence when an obligation graduates to the deterministic floor, or it does not exist. Nothing in Blast Radius compares an obligation’s words to a file’s name. There is no fuzzy matching, no embedding similarity, no “these look related” heuristic anywhere in the graph.

The visible cost is a sparser graph on a repo that has adopted neither authoring nor Claim Check. That cost is deliberate. A guessed link is worse than a missing one: it produces a suspect the reader cannot trust and cannot act on, and it teaches people to ignore the output. A missing link shows up as a gap, and the gap is the authoring demand.

If you take one thing from this page: a suspect from Blast Radius always rests on a relationship somebody recorded on purpose.

Where links come from

Link supply grows two ways, and only two ways.

You author them. You add an entry to .shipmoor/links.yaml naming an obligation and the code paths that realize it. You write the endpoints; the run writes the content pins. See The link model.

Claim Check runs mint them. When an obligation graduates to the deterministic floor — decided satisfied through a bound check — that round’s change surface is causal evidence for which code realizes it, and the run mints or refreshes a realizes pin labeled minted. You get links as a by-product of gating changes you were already gating.

A repo’s graph is thin on day one and thickens with every round it runs. That accumulation is the point. The repo gets permanently easier to reason about, and the work that thickens it is work you were doing anyway.

What a run reports

$ shipmoor blast
Blast radius  working tree vs HEAD · 2 files changed
  suspect 1 · rerun advised 0 · ungoverned 1 · in sync 0 · silent 0

  suspect       ac-01.realizes.login · AC-01 realizes app/login.py · code moved, obligation unchanged · minted (claim-check graduation)
  ungoverned    config/limits.py · changed with no links

exit 0 · suspects at warn (set blast.suspect_threshold: fail to gate) · report .shipmoor/blast.v1.json

Headline counts first, then one line per finding, then the exit. Every line carries its provenance, because a reader should never have to guess what kind of evidence a claim rests on: a stored link names authored or minted, and a derived verifies edge names tag join.

There is no ranking and no severity. A suspect is a suspect. See Reading the output.

Advisory by default

Blast Radius exits 0 even when it finds suspects. Suspects are reported, and the run still passes.

This is not timidity. A feature whose whole premise is a graph you have to build cannot start by failing the builds of every repo that has not built one yet. A repo that wants the ratchet opts in with one config key, and then a pull request that edits an obligation without touching its realizing code fails, with the suspect link as the witness. See Configuration and exit semantics.

Unresolvable links, gaps, and rerun advisories never affect the exit code under any threshold. They are disclosed unknowns and disclosed absences.

Availability

shipmoor blast is a paid feature, gated on the blast_radius entitlement, exactly like review and claim-check. A caller without an active IC subscription gets the upgrade guidance and the command does not run. See Plans & tiers.

The entitlement is checked before the engine is loaded, so the Community binary path never imports the Blast Radius engine at all.

What is live, and what is not

Live: the committed link graph, the classifier, authored realizes declarations, run-time verifies edges from the tag join, gaps mode, the blast.v1 report, and the advisory exit semantics with an opt-in CI ratchet.

Deferred, and disclosed as such in the output rather than hidden:

• Doc sections are compared at whole-file granularity. Section-level anchors arrive with docs verification, and the documented-surface gaps list is disclosed as not-checked rather than rendered as an empty list that would claim the run looked.
• Fix-packet actions, verdict integration, and CI and IDE surfaces arrive with the loop composition, where a suspect becomes something your agent is handed rather than something you read.

Where to go next

• Quickstart — author one link and read your first report, in about ten minutes.
• The link model and the committed store — link kinds, pins, content identity, and how to author.
• Classification and re-pinning — silent, suspect, in sync, and the two ways a pin moves.
• Gaps — what was never governed, in four lists.
• Configuration and exit semantics — the CI ratchet.
• CLI reference — every flag, exit code, and the blast.v1 report.
• Troubleshooting — the disclosed reasons and what to do about each.