Ripwire blast-radius gate: a leaf change scores 1 file and 2 symbols, from a captured run

redhat-et/ripwire is a zero-dependency C++23 CLI and MCP server that tells a coding agent the blast radius of a change and which tests reach it. We wrapped it as bun run blast, which refuses to open a PR when changed or impacted files or symbols pass a threshold. Our report scored a leaf change at 1 changed file, 2 impacted symbols and 1 test to run against limits of 12 files and 40 symbols, and that report comes from a captured ripwire output, so CI never builds or runs ripwire itself.

The catch

bun run report reads tests/fixtures/captured/leaf-pr-context-and-gate.xml and hands the parsed result to the gate as an override. The ripwire_bin field in reports/blast.json says upstream/build/ripwire because the report script writes that path for portability. The binary was not executed to produce the numbers. The live path needs CMake 3.24 or newer and a C++23 compiler to build ripwire from the submodule, and the README walks through that build.

Ripwire's own output header says every count is a floor and never a total. The gate compares those floors against --max-files and --max-symbols, so a change can sit under the limits while touching more than ripwire printed. The 12 and 40 defaults are lab choices, and you should tune them on your own repo.

RESULTS.md records the upstream CI run as still in progress when it was written, so we make no claim about ripwire's own light test set at the pin.

What we ran (keyless)

bun install
bun test
bun run report
git -C upstream rev-parse HEAD
# expect: a87470c7e9acd7bde56c40300b1c2745de603a96

From reports/blast.json, written on October 13, 2026, for the leaf change in tests/fixtures/sample-repo:

The refused case lives in the tests. The core fixture changes src/core.ts, and ripwire's captured output pulls in src/mid.ts, src/leaf.ts and three tests (core, leaf and mid). With --max-files 2 the gate exits 1 and names impacted_files in its reasons. A ripwire path that does not exist exits 2. RESULTS.md records 13 tests passing, bun audit with 0 vulnerabilities, and the lab CI green in about 19 s.

How it is wired

The gate sits right before gh pr create. bun run blast --base origin/main --run-tests calls ripwire with --pr-context and --test-gate, parses the XML into reports/blast.json, and with --run-tests runs each listed test through bun test. A failed required test also refuses the PR. Exit 0 opens the PR, exit 1 means split the change or ask for review, and exit 2 means the tool failed and the PR stays closed. The blast-radius-before-pr skill tells the agent to honor those codes.

Minilab (open source)

Upstream is redhat-et/ripwire (2,447 stars, Apache-2.0, C++, as of October 14, 2026), pinned at a87470c7. Clone the lab with submodules and run bun test and bun run report. Build ripwire with CMake and run bun run blast --base origin/main on a real branch to replace the captured numbers with your own.

bun install && bun test && bun run report