godaudits 2.18.0

Change safety as a separate evidence claim

godaudits 2.18.0 adds a deterministic, diff-scoped blast-radius review without changing repository audit scores or the AUDIT.json schema.

Added

• godaudits blast-radius plan, validate, apply, render, and evidence.
• Static impact routing across reverse references, public contracts, database schemas, dependency versions and patches, configuration flags, serialization, cross-language readers, lifecycle ordering, caches, generated artifacts, public entry points, and changed audit evidence.
• One or two explicit safety facts with a five-level proof ladder from assertion through running-app reproduction.
• Confirmed risks with separate likelihood and consequence, cleared risks with invalidation conditions, and a compiled blocked, unproven, or pass merge disposition.
• Proof-results binding to the exact base commit, head commit, and patch hash under review.
• Separate change-review and proof-results schemas, complete operating documentation, fixtures, and regression coverage.

Safety and correctness

• Static planning and proof import never execute recorded commands.
• Executable proof requires named authority, capability, environment, and isolation, and must match the authorization boundary.
• The before-merge proof must run the exact command chosen during planning.
• Shared redaction now covers bare GitHub, OpenAI-style, and Google API credential forms.
• Runtime verification no longer reads the unreachable finding.runtime_probe property from the closed AUDIT.json schema.

Verification

• 181 tests passed.
• 9 benchmark cases passed.
• 17 seeded detector cases passed.
• 5 evaluation suites passed.
• Pinned schema validators, official Agent Skills validation, package dry run, and runtime doctor passed.

See CHANGELOG.md and the change-safety contract for the complete details.