Blast Radius

Every disclosed reason shipmoor blast can print and what to do about each: missing acceptance file, unknown item id, absent path, a verifies join that derives nothing, an empty graph on a repo you thought was governed, a comment-only edit that suspected, a refused re-pin, and the usage errors for a malformed store or config.

The three link kinds (realizes, documents, verifies), why verifies edges are derived every run and never stored, content pins and what identity means, the committed .shipmoor/links.yaml store and its committed-means-approved mechanic, how to author a realizes link, and the three freshness states a derived edge can carry.

Run shipmoor blast on a repo with no graph, read the gaps it reports, author your first realizes link, watch the run pin it, then make a one-sided change and see it classify as suspect. About ten minutes, no Claim Check run required.

Blast Radius answers one question about a change: what else does it touch? It walks a committed link graph to report which acceptance obligations became suspect because their realizing code moved, which checks verify the touched behavior, and which code became suspect because an obligation changed while the code did not. No lexical inference, ever: every link is authored by a human or minted from causal evidence.

shipmoor blast --gaps reports what was never governed, in four lists: changed code with no links, obligations with no check, obligations with no realizes entry, and the documented surface. Why every list prints its count including zero, why the fourth is disclosed rather than counted, and how to work the list down.

Blast Radius is advisory by default and needs no configuration. The one key, blast.suspect_threshold, turns suspects into an opt-in CI ratchet. Covers the off/warn/fail values, the YAML boolean trap around `off` and how it is handled, why an unrecognised value is a loud error, and what never affects the exit code.

The complete shipmoor blast surface: the positional target, the --staged/--diff/--all/--from/--to selectors, --gaps, --repin, --no-write, --terse, --json, --no-color, the three exit codes, the blast.v1 report and its fixed destination, and the blast: config block.

The classification truth table (silent, suspect with the stale side named, in sync, unresolvable), why direction is read from the diff rather than configured, how to read the run screen and its provenance labels, and the two ways a pin ever moves: automatic when both endpoints move together, and the explicit recorded --repin.