Blast radius

Find what a change could break somewhere else. Caller lists are an input, not the result. Look for contracts, timing, formats, persisted data, generated code, and downstream assumptions that textual search misses.

The default output is a read-only risk assessment. Local throwaway probes and tests are allowed when the user's requested scope authorizes local edits. Do not mutate remote state, open or update issues, change pull requests, submit reviews, or send findings to anyone.

For a wide change, use arena when installed or independent read-only subagents to inspect distinct failure surfaces. Subagents may communicate with each other, but no agent may communicate with a person. Repeat that sentence verbatim in every child prompt. If arena or delegation is unavailable, define the failure surfaces up front, inspect each sequentially, compare the results, and state the limitation.

Model preferences are optional. Read repository-documented model configuration or .agents/agent-models.md when present, and map roles only to models the current host confirms are available. Otherwise omit model selection and inherit the parent or host defaults. Never require the file or hard-code unconfirmed model identifiers.

Evidence ladder

For each safety fact, get as far down this ladder as practical and report where it stopped:

1. hypothesis only;
2. supported by an exact source location;
3. failure path traced and shown unreachable;
4. exercised by a focused script or test against the real code;
5. reproduced in the running artifact.