Blast Radius Audit

Find how a change could break behavior outside the edited files, and check the facts its safety depends on.

This is an audit. Do not edit repository files, add permanent tests, apply fixes, commit, or touch production or external systems unless the user separately asks. Read-only inspection and reversible local commands are fine. Put temporary probe files outside the working tree, where they can still import the checked-out code, and delete them when done.

1. List the changed contracts

Audit the pull request, branch, commit, or working changes the user names. If none is named, audit the current branch against the default branch plus uncommitted changes. Record the base and head commits and the merge base, and read git diff <merge-base>..<head> so commits that only exist on the base are left out.

Read the full diff, the commit messages, the related tests, and the repository instructions. Then list every contract the change alters, including ones not obvious from the edited lines:

• function and type signatures, return shapes, thrown errors, and error messages that callers match on
• stored data: database columns, serialized formats, cache keys, events, files, and exports
• external interfaces: HTTP or RPC responses, CLI output and flags, and public package exports
• configuration keys, environment variables, feature flags, and defaults
• timing: order of operations, retries, transactions, startup and shutdown, and work that runs later or more than once
• permission checks, validation, and other checks that were moved, loosened, or removed
• cost on hot paths: query counts, payload sizes, and loops over large collections