Features create the promise
Launch wins attention. Then customers expect the promise to keep working:
- The feature ships once
- The code changes for years
- Every change can reopen old risk
- A false close makes the promise weaker
Accountability
Stop taking fixed on faith. A passing test today is not proof it would have caught the defect yesterday.
live proof path
bug preserves the change that matters: the named regression failed before the repair and passed after it. Review starts from proof, not confidence. Git, but with superpowers.
bug start --scaffoldCreates a stable BUG record in _bugs/unproven and refuses unsafe source overwrites.
Give the defect one durable home before context starts drifting.bug red BUG-019f4569Runs the named regression before the fix and records failing output, actor, time, commit, and hash.
Prove the test caught the defect before trusting the repair.bug green BUG-019f4569Requires the same defect to pass after the repair and moves the record only after the Fix section is real.
Turn the passing repair into evidence the next person can verify.certified proof
report excerpt
Continuous evidence
inputs tested
Peachfuzz sends millions of malformed, unexpected, and adversarial inputs through the code.
It uncovers crashes and security flaws that ordinary tests can miss before customers encounter them.
Runs continuously. Every figure above comes from tamper evident, replayable run records.
Software + time
Software engineering is programming integrated over time.
Launch wins attention. Then customers expect the promise to keep working:
This is where the return on the work accumulates: fewer recurrences, calmer reviews, and software your customers can keep trusting.
what bug is
One case file keeps the defect, regression, repair, commits, and certified proof together.
The next reviewer gets the answer before they have to ask.
Markdown serves people. Typed JSON serves agents. Certified writer claims let a fresh clone audit the same facts without your source leaving the repository.
_bugs/unproven/bug_high_...md
_bugs/park/bug_low_...md
_bugs/closed/bug_high_...md
Git gets dirty. Bug keeps the evidence clean.
Why bug exists
A bug that returns after fixed costs more than the first one. Now you pay for the defect, the failed fix, the repeated investigation, and the lost confidence.
Less archaeology. Less re-review. Fewer fixes that return wearing a new name.
Cost of false closure
A bug marked fixed can return as a second incident. This time it carries the original defect, a failed repair, repeated investigation, slower response, and customers who trust the next answer less.
bug captures the red-to-green change while the context is fresh, so review, handoff, production, and audit inherit proof instead of another promise.
A passing command looks reassuring, but nobody preserved proof that the named regression caught the original defect.
The ticket closes. The uncertainty stays in the code.
NIST software testing economics (opens in new tab)When the behavior returns, the team cannot trust the old close and has to reconstruct the same story from code, chat, CI, and memory.
The second fix starts behind: more people, less context, and less confidence.
SWEBOK review economics (opens in new tab)A recurring defect reaches a larger audience: on-call, support, managers, customers, and possibly auditors or counsel.
Now the company pays for the original defect and for having believed the first fix.
Splunk downtime study, reported by ITPro (opens in new tab)One false close makes every later close harder to believe.
Reviews slow down, handoffs grow defensive, and the next incident begins with less trust than the last one.
Lifecycle cost caveat (opens in new tab)Most software value is protected after launch: changed, repaired, explained, inherited, and trusted again.
Invisible maintenance habits become visible business risk the moment someone asks how the work is actually kept healthy.
Software maintenance literature (opens in new tab)Most defects stay ordinary. A few become security, trust, legal, or customer events.
Proof discipline is cheapest before anyone knows which fix will matter later.
IBM Cost of a Data Breach 2025 (opens in new tab)When a supposedly fixed defect returns, the expensive part is not only downtime. The team must also disprove the old close before it can trust the new one.
That uncertainty burns the exact things outages already make scarce: time, trust, and attention.
Splunk downtime study, reported by ITPro (opens in new tab)Audits and recertification do not ask whether people meant well. They ask whether controls operated over time.
A team without operating memory has to rebuild the story from fragments when the auditor finally asks.
AICPA SOC trust services context (opens in new tab)When to buy
$50 per seat, billed monthly
For connected teams where one repeated investigation or production recurrence costs more than the seat.
$100 per seat a month, prepaid 1 to 5 years
For air gapped or regulated machines that need proof creation without reconnecting.
If a license lapses, your evidence stays yours. You can still read records and run audit; only new proof creation waits for renewal.
Compliance map
When reviewers arrive late, the repo should still know what broke, what proved it, who changed it, and why the close held.
The same question appears in different rooms: did the team identify the defect, prove the failure, prove the repair, preserve authorship, and keep the record reviewable later?
A customer, auditor, incident review, buyer, or counsel asks how the team maintains software when defects matter.
bug records the defect, red proof, green proof, commits, hashes, author, time, path, reason, and attempts beside the code.
Markdown keeps maintainers in the loop. JSON keeps agents useful. Ledgers keep both from drifting away from repository facts.
bug audit classifies what is closed, open, parked, malformed, stale, or unproven without asking the team to retell the story from memory.
The next reviewer gets maintenance evidence instead of folklore: what broke, what proved it, what changed, and why the close holds.
Certification still depends on scope, controls, assessors, and the business. bug does not certify you; it keeps serious fixes easier to trust later, when the person asking was not in the room.
How bug works
Start the record. Prove the defect. Prove the repair. bug binds the result to Git and a server-certified device writer.
bug initCreates the private proof tree and deterministic indexes. No source leaves the repository.
Creates the private _bugs tree, indexes, and Markdown template. Your source, paths, titles, and records stay in the repo.
Gives the defect a stable home before the fix story begins: ID, severity, file, symbol, test command, actor, time, and narrative.
Refuses to overwrite an existing source or test file just to make scaffolding convenient. Existing work is not collateral damage.
Records the failing proof before the repair and rejects a generic regression name that is not tied to the bug id.
Forces the visible behavior change: first the defect fails, then the same defect passes after the production fix.
Will not move a record to closed without the source anchor, test function, red proof, green proof, and concrete Fix narrative.
Exposes the same typed state through show, verify, and audit, so people and agents cannot get different answers.
Classifies provably closed, open, half-fixed, stale, malformed, parked, duplicate, and unproven work so weak closure cannot hide behind prose.
Each licensed device signs immutable operation and proof claims with a server-certified writer key. A repo edit alone cannot invent that identity.
Documentation
The whole point is fit: bug adds proof to git, reviews, issues, agents, and CI without asking those tools to become something else.
git native
What it does
bug adds one hard rule to the tools you already use: a fix must carry its proof.
The defect, regression, repair, commits, author, and proof stay together. Review stops being an investigation.
Keep your tracker, CI, branches, and pull requests. bug gives them a trustworthy ending.
Confident prose cannot close the record. The named regression, current Git history, and certified proof must agree.
A fresh clone can audit committed evidence with no writer private key and no paid license. The proof does not depend on the author's machine.
Audit names what is proven, open, half-fixed, stale, malformed, parked, duplicate, or unproven. Nothing hides behind a green badge.
Source, paths, titles, and proof records stay in your repository. If the license ends, reading and audit continue.
The daily paths are benchmarked for a local developer machine, not server throughput. On an Apple M1 Max, reporting a bug against a 10,000-bug inventory ran at 17.3 ms; loading the workflow record ran at 2.5-2.6 ms; resolving a bug reference from the index ran at 1.7-1.8 ms.
Each licensed device writes immutable evidence under its own certified writer identity. Parallel work adds files instead of fighting over a shared ledger, and a fresh clone verifies every writer without a private key. Audit-shaped validation stayed local-fast: 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs.
Hostile tables, CLI smoke tests, fuzzing, fault injection, and race tests attack the same boundaries production depends on.
How to use it properly
The workflow is short because teams do not want ceremony. The strictness is deliberate because pressure is exactly when fake proof becomes expensive.
Name the defect before the fix story starts. That creates one durable home for reproduction, ownership, files, tests, and review context.
Write the regression before the repair and tie it to the bug id. bug rejects generic proof because generic proof does not protect the next maintainer.
Fix production code after the failure is pinned down. The review now sees the transition instead of trusting timing, memory, or confidence.
Close only after the same defect passes and the fix narrative is clear enough for someone else to maintain the code later.
Use show, verify, and audit to review typed facts quickly. The tool rejects weak closure while the fix is still cheap to improve.
Use Witness for customer-facing, regulated, security-sensitive, or legal fixes. bug proves closure; Witness seals the execution evidence behind it.
Proof doctrine
bug does not replace judgment. It removes the loopholes that make judgment expensive under deadlines, outages, handoffs, and agent work.
Good teams trust each other. Great teams make that trust scalable by letting the repository verify the parts memory should not carry.
Software spends most of its useful life being changed, repaired, explained, and inherited. bug treats that work as engineering, not cleanup.
The experience should make engineers feel safer in their work: describe the defect, prove it, repair it, explain it, and leave proof future you can trust.
The convenience is that truth stays beside the code. Tickets, dashboards, and chats can point at bug; they do not have to become bug.
A proof tool should not require source exfiltration, repository names, bug titles, or private paths. The record belongs to the team.
Agents can move fast. bug gives them typed rails and visible failure when they try to close work with confident prose instead of evidence.
A standard that only lives in a policy document will be skipped under pressure. bug turns the standard into repository behavior that can fail the work.
A polished explanation helps only after the evidence is coherent. bug keeps facts structured so prose cannot hide missing proof.
Where it fits
Jira, Linear, GitHub Issues, Sentry, BugSnag, CI, and pull requests should not feel threatened by bug. They should recommend it, because bug gives their work a stronger ending.
Alternatives
bug is not priced against planning, QA, CI, or review. Those tools still matter. bug fills the closure gap they were never meant to own.
Jira, Linear, GitHub Issues, and their cousins are excellent for planning and memory. The repair still needs repo proof: test, commit, code anchor, and state agreeing.
Templates ask politely. bug verifies. That turns a checkbox into a repo contract reviewers and agents can actually trust.
CI proves a command passed. bug preserves the change: the right regression failed first, the repair passed later, and certified authorship stayed intact.
Conventions help until pressure arrives. bug checks the record against tests, anchors, commits, and certified proof so discipline does not depend on memory.
String scripts become hidden process debt. bug gives teams typed workflow, certified evidence, and audit output without inventing a private mini-standard.
Human judgment remains valuable. bug makes that judgment calmer because reviewers start from evidence instead of rebuilding the fix from scattered clues.
Proof compounds
bug keeps Witness high quality by proving fixes closed before execution evidence gets sealed. Witness keeps bug defensible by preserving the quality run and independent copy when proof has to leave git.
Use bug for the maintenance habit. Add Witness when customers, auditors, buyers, regulators, or counsel need sealed execution evidence they can verify later.
Explore WitnessThe repo shows the defect, red proof, green repair, commits, anchors, author, time, path, and reason before anyone asks Witness to seal the run.
The quality run becomes reports, manifests, ledgers, hashes, timestamps, failures, artifacts, and verifier material an outside party can inspect later.
The locked Witness bundle can be retained by a third party, so the story is not dependent only on CI logs, screenshots, dashboards, or memory.
Use bug by default. Add Witness for release gates, audits, procurement, regulated customers, incident review, legal exposure, or challenged fixes.
Enterprise rollout
Enterprise is the same bug workflow with a long signed offline lease. Put it on build hosts, incident machines, regulated laptops, and air-gapped repos where proof still has to be created when the network is not invited.
Enterprise is not a second binary, special key prefix, or feature paywall. It is the full product with a signed offline lease for the prepaid term.
When the network is dead or forbidden, mutation commands keep creating proof from the held lease until its signed boundary.
audit, show, list, languages, and verify stay available without a current license. Old evidence remains readable because it is repository data.
Licensing checks entitlement without watching the work. Source, paths, titles, repository identity, and proof records stay with your team.
The record is created beside the code and travels with git. Your team can defend the close without sending the defect story to us.
Start with regulated repos, incident workstations, build hosts, and agent-heavy teams. Keep Jira, GitHub, Sentry, and CI; let git prove closure.
Buyer checklist
You are not buying another workflow. You are buying fewer arguments after a fix, cleaner handoffs, safer agent work, easier feature work, and evidence that stays with git.
The repo still shows what broke, what proved it, what changed, and why the close can be trusted.
Red proof, green proof, commits, author, time, path, and reason arrive before the debate starts.
A Friday red test and a Monday repair stay in one thread without Slack archaeology.
Agents can contribute without turning confidence into claims nobody can verify.
Closed defects stop hiding as debt, so new work starts from known truth instead of old uncertainty.
Proof rides with branches, pull requests, and CI instead of forcing a tracker migration.
If customers, auditors, counsel, or future maintainers ask later, the answer is already beside the code.
The promise
Review faster because red, green, Git, and authorship already agree.
Hand off without losing what failed, what changed, or why it worked.
Stop paying for the same defect through a second review, release, and production incident.
Let agents move quickly without letting confidence become evidence.
Keep proof private, portable, and readable without a subscription.
Turn PROVABLY CLOSED into a verified state, not a status field.
Spend less time reopening old doubt and more time building what comes next.
FAQ
No. Trackers are where teams discuss, assign, prioritize, and remember work. bug lives beside git because the repair has to be verified where the code, test, commit, and future maintenance burden actually live. Keep the tracker; use bug when trust needs verification.
bug proves that closure was earned. PROVABLY CLOSED means the issue was described, the red test demonstrated the defect, the green fix changed that outcome, the commits back the transition, and the repair explanation is concrete enough for the next maintainer. It is a standard backed by repository evidence, not a status someone typed.
Red is the moment the team proves the bug is real. Green is the moment the team proves the repair changed the outcome. The value is not ceremony; it is preserving the transition from broken to fixed so a reviewer, agent, auditor, or future maintainer can verify the story later.
It keeps the thread in the repository. A record can show who filed the issue, when red proof was captured, who captured it, which commit held that proof, which test output hash describes the failure, who later greened the fix, and which commit closed it. The second-order effect is less coordination tax: the Monday maintainer starts from facts instead of chat archaeology. The third-order effect is cultural: handoffs become transparent without turning into blame, because the record shows the work path, not just the final success story.
Start in the repo you already have. bug initializes beside your code, respects existing files, and can begin audit-only before you enforce anything. That matters because teams are tired of tools that demand a migration before proving value. bug earns trust by showing where closure is already weak.
Without the failing-before state, a passing test can be theatre. Red proof answers the first maintenance question: did we ever prove the issue we claimed to fix? It protects the team from polished fixes, agent guesses, and tests that were written after the fact but never caught the original defect.
Outages are when standards are easiest to abandon and hardest to recover. People are tired, customers are angry, managers want updates, and a quick patch can quietly become tomorrow's bigger incident. bug gives the team a narrow path through the pressure: describe the defect, capture red proof, land the repair, prove green, and leave the record behind so the postmortem starts from facts instead of panic memory.
No. Real companies do not maintain one tidy language forever. bug is built for mixed repositories and the hero count is generated from the supported language list, so the page cannot drift from the product. Go currently gets the deepest parser-backed treatment, but the value is one maintenance habit across the stacks your company actually has.
No. bug works hand in glove with git because git is already where engineering time is recorded. Branches, commits, pull requests, and reviews stay central. bug adds the missing defect proof layer so maintenance history is not split between code truth and ticket folklore.
CI proves a command passed. It does not usually prove the issue was described well, that the right regression failed first, that the same defect was fixed, or that the next maintainer has enough context. CI is execution. bug is closure evidence.
It verifies records, tests, current Git history, certified writer proofs, signatures, and revocations. Then it names what is proven, half fixed, stale, malformed, open, parked, or unproven. Plain audit is read-only and license-free.
Half-fixed means there is smoke but not enough proof. Maybe the team has a green run but no red failure, a named test that does not match the bug, stale file anchors, or a repair explanation that would not help the next maintainer. bug makes that uncomfortable middle state visible.
Malformed means the proof record cannot be trusted yet. That is different from an unfixed bug. It means the evidence itself is broken: missing fields, bad paths, invalid IDs, broken references, or structure that would force a human or agent to guess.
Because maintenance happens in the repository. Tickets drift, teams reorganize, vendors change, and context disappears. A repo-local proof record moves with the branch, pull request, commit, review, and agent work that actually changed the system.
Because teams are mixed now. Humans need readable Markdown they can review in a pull request, hand to a maintainer, or show during an incident review. Agents need structured JSON so they can inspect state without scraping prose. Both point at the same proof instead of creating two separate stories.
It gives agents the same hard boundary as people. Each licensed device writes immutable signed claims instead of fighting over a shared file. Audit verifies every writer independently and refuses prose-only closure.
Agents cannot satisfy bug by editing a sentence, inventing confidence, or calling a passing command a fix. They have to describe the issue, attach the right files and tests, prove red, prove green, and leave a repair explanation that a maintainer can understand.
They bind each mutation to a device key certified by the license server. Red, green, and reattest claims also bind the bug, operation, commit, and proof hash. A teammate can clone the repo and verify the chain without your private key or a paid license.
Download the signed binary and activate the license once per device. Proof creation switches on immediately, then the license disappears into the background. Everything needed to run the first proof cycle ships with the binary, so there is no onboarding call to schedule. Reading, showing, verifying, and auditing existing records never needs a key, because your maintenance evidence is your repository data.
Command counters, and nothing else. We do not need your code, arguments, paths, bug titles, repository names, or proof records to license a tool. The point of bug is that your evidence stays with you. Air gapped deployments check in never and send nothing.
Because there are two lease shapes, not two products. The figures are public: no Contact Sales gate, no negotiation, and no discount cycle. Standard stores a local signed lease; when bug checks in, it sends subscription status and anonymized command counts, and the server returns the next check-back date after the billing window should clear. Enterprise costs twice as much because it buys a long signed offline lease for one to five years, so regulated and air gapped machines can keep creating records when the network is not allowed in. It is not a feature paywall.
All sales are final. There are no trial periods, refunds, credits, or prorated cancellations. We would rather say that plainly here than have you find it out after a charge. The reason is that everything needed to judge bug is public before you spend anything: the full workflow, the commands, the benchmarks, the licensing terms, and the price. If you are on a monthly subscription you can cancel at any time and the next charge will not be taken, though the current period is not refunded. Your evidence is never held over you either way, because reading and audit keep working without a license and every record stays in your repository.
Standard is fifty dollars a seat, billed monthly. After activation, bug keeps a local signed lease and receives the next check-back date after the billing window should clear. Enterprise prepays one to five years so regulated or air gapped teams can keep proof creation running without reconnecting.
Creating new proof eventually stops. Reading does not. show, list, verify, and audit keep working on an expired or absent license because historical maintenance evidence must not become hostage data. Your proof outlives your subscription, and it would outlive us too.
One. A seat is a person, not a computer. Put bug on up to five of your machines under one seat and each holds its own offline lease. Maintenance work happens on laptops, desktops, build hosts, and incident machines; the pricing should not punish that reality.
A revoked or expired lease stops new proof creation. bug does not delete records, rewrite history, or block inspection. Existing evidence remains readable and auditable on every machine.
bug proves the closure path: defect, red, green, explanation, commits, and certified writer. Witness preserves the wider quality run for outside review. Together they answer: was the bug repaired, and did the supporting checks really run?
Yes, as engineering evidence. Certification and recertification work asks whether real processes exist and operate over time. bug helps show how the organization maintains software: defects were described, assigned, red-tested, green-fixed, explained, dated, committed, and governed by the same standard whether the actor was a person or an agent. Handoff records also show continuity: the organization can explain how work moved between people instead of relying on one person's memory.
Recertification asks whether controls operated over time. If a critical service has one job for years, the evidence that matters is how the team kept that job reliable. bug is built for code plus time: who or what touched the record, when operations happened, what fix was claimed, which test failed first, which test passed after, which commits prove the transition, and what audit state the repository reports.
It should stay visible instead of being buried. Maintenance is not pretending everything is done; it is knowing what is open, parked, unproven, or unsafe to close. bug lets the repository tell that truth without turning uncertainty into fake completion.
No. It gives reviewers better facts. Humans still decide whether the fix is good, but bug makes the basic maintenance evidence structured, repeatable, and auditable before review becomes a judgment call.
The numbers come from the bug benchmark suite, measured on a developer machine rather than a server: go test ./internal/run -run '^$' -bench . -benchmem -count 3 on an Apple M1 Max. Start/report on a 10,000-bug inventory ran at 17.3 ms. Red and green first resolve and load the record at 1.7-1.8 ms and 2.5-2.6 ms, then the move bookkeeping measured 15.0-15.9 ms for the ledger and 26.1-26.3 ms for the index on a 5,000-bug inventory. Audit-shaped validation measured 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs.
Your evidence never needs one. The proof lives in the repository, so there is no external database to trust when someone asks what happened. Standard proof creation uses a local signed lease until its server-issued check-back date; Enterprise proof creation can run offline for the full prepaid term.
A binary or repo edit alone cannot create certified proof. Each device generates its writer key locally; the server certifies only the public key, and audit verifies the certificate, device signature, Git ancestry, proof hash, and revocation state. The private writer key never leaves the device.
Accountability
One recurring production defect can cost more than years of proof. Give every close the evidence the next reviewer, maintainer, and incident responder will need.
Buy bug