Off Grid Software
Buy now

Accountability

Git-native proof your bug fix holds.

Stop taking fixed on faith. A passing test today is not proof it would have caught the defect yesterday.

  • Learning curve Nothing new to learn
  • Red proof Test fails before the fix
  • Green proof Same test passes after
  • Audit Weak closure stays visible
  • Review Proof arrives with the fix
  • Handoff Context outlives the author
  • Agents Claims meet the same gate
  • Trust Certified writer identity
  • Verify Any clone can verify it
  • Ownership Evidence stays in your repo
  • Adoption Keep git, CI, and tracker
  • Coverage 50 language families

live proof path

Git keeps the history. bug keeps the proof.

ready

bug preserves the change that matters: the named regression failed before the repair and passed after it. Review starts from proof, not confidence. Git, but with superpowers.

  1. Start the record bug start --scaffold

    Creates a stable BUG record in _bugs/unproven and refuses unsafe source overwrites.

    Give the defect one durable home before context starts drifting.
    waiting
  2. Capture red proof bug red BUG-019f4569

    Runs the named regression before the fix and records failing output, actor, time, commit, and hash.

    Prove the test caught the defect before trusting the repair.
    locked
  3. Prove the repair bug green BUG-019f4569

    Requires the same defect to pass after the repair and moves the record only after the Fix section is real.

    Turn the passing repair into evidence the next person can verify.
    locked

certified proof

red commit
ec033cd · regression fails
green commit
684eb13 · same test passes
writer
device identity certified · proof signed

report excerpt

Status
PROVABLY CLOSED
Test
go test ./... -run TestBug019f4569...
Red At
local machine time
Green At
local machine time
_bugs after audit waiting
  • _bugs/ repo-local maintenance proof
  • BUG_ID_LEDGER.tsv allocated IDs
  • _index/ rebuildable record locations
  • _writers/ certificates + immutable signed claims
  • c842.../proof-BUG-019f4569...json writer, commit, operation, proof hash
  • closed/ records that earned closure
  • bug_medium_019f4569...normalize-drops-whitespace-only-input.md PROVABLY CLOSED
  • unproven/ empty after green

Continuous evidence

— inputs tested

— of continuous fuzzing

Awaiting live evidence.

Last sealed
—
Peachy since
—
packages
—
targets
—

What it tests

Peachfuzz sends millions of malformed, unexpected, and adversarial inputs through the code.

Why it matters

It uncovers crashes and security flaws that ordinary tests can miss before customers encounter them.

Runs continuously. Every figure above comes from tamper evident, replayable run records.

what bug is

What stays with the fix.

One case file keeps the defect, regression, repair, commits, and certified proof together.

The next reviewer gets the answer before they have to ask.

Proof travels with the code.

Markdown serves people. Typed JSON serves agents. Certified writer claims let a fresh clone audit the same facts without your source leaving the repository.

  • Review without reconstructing the story.
  • Hand off without losing the why.
  • Audit without trusting the machine that wrote it.
Record
one durable case per defect
Writer
identity certified · evidence signed
Audit
your clones keep verifying

One record. Three readers. Change who is asking and the evidence does not move.

codebase trust, verified

_bugs

Repository evidence tree

BUG-019f21eb high / unproven

record exists; evidence still missing

_bugs/unproven/bug_high_...md

BUG-019f21f1 low / parked

explicitly deferred, not quietly forgotten

_bugs/park/bug_low_...md

BUG-019eb648 high / provably_closed

red, green, Git, and certified proof agree

_bugs/closed/bug_high_...md

  • _index rebuildable record locations
  • _writers certificates + signed evidence
  • unproven new records needing evidence
  • open described defects in flight
  • closed proof accepted
  • park explicitly deferred work

Git gets dirty. Bug keeps the evidence clean.

Go JavaScript TypeScript Python C C++ Swift C# Java Perl PHP SQL Rust Zig Ruby Kotlin Dart Scala R Shell Lua Objective-C Lisp Haskell Assembly Visual Basic Pascal Fortran COBOL Ada Julia Groovy Clojure Elixir Erlang F# PowerShell Racket OCaml Nim Crystal V Solidity Terraform Make Dockerfile YAML Vue Svelte Delphi

repo proof pass

What one audit pass checks.

Repository closure proof ready for review.

certified writers

BUG

AUDITING
  • REPO local-first · records under _bugs/ · no external database
  • PROOF red regression · green repair · certified writer · current git history
  • AGENTS typed reports · hard gates · no prose-only closure
  • RECORDS CLASSIFIED

    all states · fixed · half-fixed · stale · malformed · unproven

    100%
  • RED REQUIRED

    failing proof · regression must fail before the fix

    100%
  • GREEN REQUIRED

    passing proof · fix must pass the named test

    100%
  • ANCHORS VALIDATED

    source + tests · bug IDs, files, symbols, and commits agree

    86%
  • WRITERS CERTIFIED

    Ed25519 · each device signs its own immutable proof

    72%
  • RATCHET ENFORCED

    no backslide · proof quality moves upward package by package

    64%
MODE
AUDIT
CLOSURE
RED/GREEN
OUTPUT
JSON + MD
WRITER
CERTIFIED

Software + time

Launch is a moment. Maintenance is the product.

Software engineering is programming integrated over time.

Google Distinguished Engineer Titus Winters

Features create the promise

Launch wins attention. Then customers expect the promise to keep working:

  • The feature ships once
  • The code changes for years
  • Every change can reopen old risk
  • A false close makes the promise weaker

Maintenance keeps the promise

This is where the return on the work accumulates: fewer recurrences, calmer reviews, and software your customers can keep trusting.

  • Defects reproduced before repair
  • Fixes proven against current Git history
  • Authorship certified
  • Handoffs that survive the author
  • Evidence future teams can audit

Forengineerswho thinkin time& space.

Code ages. Truth travels. Maintenance earns the renewal because your customer can see the fix stayed fixed, adapted, inherited, and trusted again.

Why bug exists

Fixed should mean fixed.

A bug that returns after fixed costs more than the first one. Now you pay for the defect, the failed fix, the repeated investigation, and the lost confidence.

  • Agents move fast. bug keeps confidence from outrunning proof.
  • Reviews start with red, green, commits, and authorship already tied together.
  • Handoffs keep the why, so the next engineer does not repeat the investigation.
  • Weak closure is caught before the same defect returns to production with a larger audience.
  • Audits sample durable evidence instead of asking the team to recreate it.
  • The result compounds: less rework, calmer incidents, and more room for new work.

Less archaeology. Less re-review. Fewer fixes that return wearing a new name.

Cost of false closure

Stop paying for the same bug twice.

A bug marked fixed can return as a second incident. This time it carries the original defect, a failed repair, repeated investigation, slower response, and customers who trust the next answer less.

bug captures the red-to-green change while the context is fresh, so review, handoff, production, and audit inherit proof instead of another promise.

  1. Repeat the investigation

    again

    When the behavior returns, the team cannot trust the old close and has to reconstruct the same story from code, chat, CI, and memory.

    The second fix starts behind: more people, less context, and less confidence.

    SWEBOK review economics (opens in new tab)
  2. Pay the trust tax

    after

    One false close makes every later close harder to believe.

    Reviews slow down, handoffs grow defensive, and the next incident begins with less trust than the last one.

    Lifecycle cost caveat (opens in new tab)

Maintenance is where software lives

80-90% Maintenance is where software lives

Most software value is protected after launch: changed, repaired, explained, inherited, and trusted again.

Invisible maintenance habits become visible business risk the moment someone asks how the work is actually kept healthy.

Software maintenance literature (opens in new tab)

Bad tail events need evidence

$4.4M Bad tail events need evidence

Most defects stay ordinary. A few become security, trust, legal, or customer events.

Proof discipline is cheapest before anyone knows which fix will matter later.

IBM Cost of a Data Breach 2025 (opens in new tab)

A recurring outage compounds the bill

$15K/min A recurring outage compounds the bill

When a supposedly fixed defect returns, the expensive part is not only downtime. The team must also disprove the old close before it can trust the new one.

That uncertainty burns the exact things outages already make scarce: time, trust, and attention.

Splunk downtime study, reported by ITPro (opens in new tab)

Audits reward operating memory

SOC 2 Audits reward operating memory

Audits and recertification do not ask whether people meant well. They ask whether controls operated over time.

A team without operating memory has to rebuild the story from fragments when the auditor finally asks.

AICPA SOC trust services context (opens in new tab)

When to buy

Three rungs. One public price.

Solo

30 days free

$69 USD a month for the whole team, billed monthly after the trial

For teams who want the proof workflow and are content holding every record themselves.

  • All proof commands: start, red, green, audit
  • Markdown for people; JSON for agents
  • Certified writer proof beside Git history
  • Unlimited machines and unlimited people
  • You hold every proof; nothing is kept on your behalf

Attested

Countersigned

$314 USD a month for the whole team

For teams who need someone outside the company to confirm the record held.

  • Everything in Solo
  • Countersigned proof an outside reviewer can check
  • One year of custody held on your behalf
  • Independent timestamps anchored outside Offgrid
  • Your source never leaves your machines

Archive

Offline

$559 USD a month for the whole team, or prepaid 1 to 5 years

For regulated and air gapped work where the record has to outlive the project.

  • Everything in Attested
  • Five years of custody held on your behalf
  • One to five year signed offline lease
  • Air-gap request JSON and lease import
  • No reconnect during the prepaid term

If a license lapses, your evidence stays yours. You can still read records and run audit; only new proof creation waits for renewal.

Compliance map

Compliance asks for proof, not promises.

When reviewers arrive late, the repo should still know what broke, what proved it, who changed it, and why the close held.

The same question appears in different rooms: did the team identify the defect, prove the failure, prove the repair, preserve authorship, and keep the record reviewable later?

  1. 01 Business pressure

    A customer, auditor, incident review, buyer, or counsel asks how the team maintains software when defects matter.

  2. 02 Repo-local proof

    bug records the defect, red proof, green proof, commits, hashes, author, time, path, reason, and attempts beside the code.

  3. 03 Human and agent records

    Markdown keeps maintainers in the loop. JSON keeps agents useful. Ledgers keep both from drifting away from repository facts.

  4. 04 Audit pass

    bug audit classifies what is closed, open, parked, malformed, stale, or unproven without asking the team to retell the story from memory.

  5. 05 Review confidence

    The next reviewer gets maintenance evidence instead of folklore: what broke, what proved it, what changed, and why the close holds.

SOC 2 Type II

What it is
SOC 2 asks whether controls operated over time. Enterprise buyers often treat it as table stakes before trusting a SaaS vendor.
How bug helps
bug turns maintenance into sampled evidence: report, red proof, green proof, commits, hashes, author, time, path, and reason.
Reviewers get
Reviewers can inspect whether defect response and change follow-up happened, instead of rebuilding the story from tickets and chat.
Private by design
Proof stays in your repo. We do not need source, bug titles, repository names, paths, or customer data to make the record useful.

ISO/IEC 27001

What it is
ISO 27001 cares about a managed security program that survives change, surveillance audits, and recurring corrective action.
How bug helps
bug makes remediation inspectable: the nonconformity or defect is described, reproduced, repaired, explained, and classified by audit.
Reviewers get
Assessors get stable maintenance evidence for corrective action without asking engineers to reconstruct old fixes under pressure.
Private by design
Records remain local and readable. Expired licenses do not hold history hostage; existing evidence can still be read and audited.

FedRAMP

What it is
FedRAMP is evidence-heavy because authorization and continuous monitoring keep asking whether security work actually happened.
How bug helps
bug gives POA&M and defect closure a repo-native trail: failed state, fixed state, commits, certified writers, and an audit classification.
Reviewers get
Assessors can review closure evidence as part of recurring maintenance instead of trusting a spreadsheet row that says fixed.
Private by design
Offline leases let air gapped machines keep creating proof during the prepaid term without reconnecting for every close.

CMMC

What it is
CMMC asks defense suppliers to show disciplined handling of system integrity and controlled information environments.
How bug helps
bug records how flaws are identified, reproduced, corrected, and closed, with enough structure for both humans and agents.
Reviewers get
Assessors can sample maintenance work and see proof of correction rather than a policy claim that defects are handled.
Private by design
The evidence lives beside the code and can be produced without sending source or controlled information to Off Grid.

HIPAA

What it is
HIPAA reviews care less about slogans and more about what happened when software behavior could affect protected health information.
How bug helps
bug gives sensitive fixes a dated record: issue, reproduction, repair, test proof, commits, actors, paths, and rationale.
Reviewers get
Reviewers can ask what changed, who changed it, how it was verified, and whether the closure record still agrees with git.
Private by design
Bug records can prove the maintenance path without collecting PHI, secrets, source code, or private customer data.

SSDF and federal attestation

What it is
Secure development attestations become stronger when teams can show technical evidence behind the signature.
How bug helps
bug turns vulnerability and defect response into a structured record of description, red proof, green proof, code anchors, and certified claims.
Reviewers get
Reviewers get machine-readable JSON and human-readable Markdown tied to git, so attestation has evidence behind it.
Private by design
The tool strengthens your repo's memory without becoming a surveillance system or an external tracker.

Certification still depends on scope, controls, assessors, and the business. bug does not certify you; it keeps serious fixes easier to trust later, when the person asking was not in the room.

How bug works

Three commands. One trustworthy close.

Start the record. Prove the defect. Prove the repair. bug binds the result to Git and a server-certified device writer.

Accountability lifecycle private proof tree ready
current command bug init

Creates the private proof tree and deterministic indexes. No source leaves the repository.

  1. _bugs/ private state lives beside the code
  2. attempt survives interruption certified operation claim written first
  3. _bugs/unproven/BUG-019f4891...md one defect gets one durable home
  4. refused: existing test file unsafe scaffold overwrite rejected
  5. refused: test name missing bug id generic regression name rejected
  6. red: Score averages non-empty input failing proof tied to commit 60286e57
  7. green: divisor repair holds passing proof tied to commit b66758c3
  8. _bugs/closed/bug_medium_019f4891...md audit moves the case after proof agrees
  9. read and audit outlive the subscription your licensed machines keep verifying the chain
Creates

A durable case file

Creates the private _bugs tree, indexes, and Markdown template. Your source, paths, titles, and records stay in the repo.

Creates

A case file before the fix

Gives the defect a stable home before the fix story begins: ID, severity, file, symbol, test command, actor, time, and narrative.

Refuses

Unsafe source overwrite

Refuses to overwrite an existing source or test file just to make scaffolding convenient. Existing work is not collateral damage.

Refuses

Nameless red proof

Records the failing proof before the repair and rejects a generic regression name that is not tied to the bug id.

Creates

The red-to-green transition

Forces the visible behavior change: first the defect fails, then the same defect passes after the production fix.

Refuses

Weak closure

Will not move a record to closed without the source anchor, test function, red proof, green proof, and concrete Fix narrative.

Creates

Reviewer-ready state

Exposes the same typed state through show, verify, and audit, so people and agents cannot get different answers.

Refuses

Ambiguous audit state

Classifies provably closed, open, half-fixed, stale, malformed, parked, duplicate, and unproven work so weak closure cannot hide behind prose.

Certified

Accountable authorship

Each licensed device signs immutable operation and proof claims with a server-certified writer key. A repo edit alone cannot invent that identity.

Documentation

Use bug without changing how your team works.

The whole point is fit: bug adds proof to git, reviews, issues, agents, and CI without asking those tools to become something else.

Repo-local guide

git native

What it does

Proof where work already happens.

bug adds one hard rule to the tools you already use: a fix must carry its proof.

  • One answer, beside the code

    The defect, regression, repair, commits, author, and proof stay together. Review stops being an investigation.

  • Git stays the workbench

    Keep your tracker, CI, branches, and pull requests. bug gives them a trustworthy ending.

  • Agents face a hard gate

    Confident prose cannot close the record. The named regression, current Git history, and certified proof must agree.

  • Trust travels

    A fresh clone can audit committed evidence with no writer private key and no paid license. The proof does not depend on the author's machine.

  • Weak closure stays visible

    Audit names what is proven, open, half-fixed, stale, malformed, parked, duplicate, or unproven. Nothing hides behind a green badge.

  • Private and never hostage

    The authoritative proof stays in your repository. Attested and Archive add an encrypted tenant-private custody copy; if the license ends, local reading and audit continue.

  • Scales without becoming a ceremony

    The daily paths are benchmarked for a local developer machine, not server throughput. On an Apple M1 Max, reporting a bug against a 10,000-bug inventory ran at 17.3 ms; loading the workflow record ran at 2.5-2.6 ms; resolving a bug reference from the index ran at 1.7-1.8 ms. A separate real-filesystem proof launched 10,000 concurrent writers, each streaming a distinct 10 MiB create-only file through Primitive Filestore: 97.656 GiB written, every destination SHA-256 matched the source, and the profiled one-shot benchmark measured 448.78 MB/s. That is a measured floor on that machine, not a universal ceiling.

  • Supports multi-agent work

    Each licensed device writes immutable evidence under its own certified writer identity. Parallel work adds files instead of fighting over a shared ledger, and a fresh clone verifies every writer without a private key. The measured 10,000 concurrent writers path adds no Bug mutex, queue, worker pool, or admission gate; Go and the real filesystem retain ownership of concurrency. Audit-shaped validation stayed local-fast: 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs.

  • Quality is built in

    Hostile tables, CLI smoke tests, fuzzing, fault injection, and race tests attack the same boundaries production depends on.

How to use it properly

A small habit with a hard stop.

The workflow is short because teams do not want ceremony. The strictness is deliberate because pressure is exactly when fake proof becomes expensive.

  • 1. Start the record

    Name the defect before the fix story starts. That creates one durable home for reproduction, ownership, files, tests, and review context.

  • 2. Make red real

    Write the regression before the repair and tie it to the bug id. bug rejects generic proof because generic proof does not protect the next maintainer.

  • 3. Repair after evidence

    Fix production code after the failure is pinned down. The review now sees the transition instead of trusting timing, memory, or confidence.

  • 4. Make green explain itself

    Close only after the same defect passes and the fix narrative is clear enough for someone else to maintain the code later.

  • 5. Inspect before trust

    Use show, verify, and audit to review typed facts quickly. The tool rejects weak closure while the fix is still cheap to improve.

  • 6. Seal the bigger story when needed

    Use Witness for customer-facing, regulated, security-sensitive, or legal fixes. bug proves closure; Witness seals the execution evidence behind it.

Proof doctrine

Strict where strictness pays.

bug does not replace judgment. It removes the loopholes that make judgment expensive under deadlines, outages, handoffs, and agent work.

  • Trust, then verify

    Good teams trust each other. Great teams make that trust scalable by letting the repository verify the parts memory should not carry.

  • Maintenance is the product life

    Software spends most of its useful life being changed, repaired, explained, and inherited. bug treats that work as engineering, not cleanup.

  • Confidence comes from proof

    The experience should make engineers feel safer in their work: describe the defect, prove it, repair it, explain it, and leave proof future you can trust.

  • Git remains central

    The convenience is that truth stays beside the code. Tickets, dashboards, and chats can point at bug; they do not have to become bug.

  • No surveillance bargain

    A proof tool should not require source exfiltration, repository names, bug titles, or private paths. The record belongs to the team.

  • Agent-ready, not agent-naive

    Agents can move fast. bug gives them typed rails and visible failure when they try to close work with confident prose instead of evidence.

  • Standards that can be enforced

    A standard that only lives in a policy document will be skipped under pressure. bug turns the standard into repository behavior that can fail the work.

  • Clear facts beat clever prose

    A polished explanation helps only after the evidence is coherent. bug keeps facts structured so prose cannot hide missing proof.

Where it fits

Keep your tools. Give them closure.

Jira, Linear, GitHub Issues, Sentry, BugSnag, CI, and pull requests should not feel threatened by bug. They should recommend it, because bug gives their work a stronger ending.

  • Keep Jira, Linear, GitHub Issues, or your tracker for planning.
  • Keep Sentry or BugSnag for production detection.
  • Keep CI for execution.
  • Keep git as the transition history.
  • Use bug to prove the issue moved from report to red regression to green repair to maintainer-ready explanation.
  • Let every existing tool link to the proof instead of trying to become the proof.

Alternatives

Keep the tools. Remove the doubt.

bug is not priced against planning, QA, CI, or review. Those tools still matter. bug fills the closure gap they were never meant to own.

  • Issue trackers alone

    Jira, Linear, GitHub Issues, and their cousins are excellent for planning and memory. The repair still needs repo proof: test, commit, code anchor, and state agreeing.

  • Pull request templates

    Templates ask politely. bug verifies. That turns a checkbox into a repo contract reviewers and agents can actually trust.

  • CI checks only

    CI proves a command passed. bug preserves the change: the right regression failed first, the repair passed later, and certified authorship stayed intact.

  • Commit message discipline

    Conventions help until pressure arrives. bug checks the record against tests, anchors, commits, and certified proof so discipline does not depend on memory.

  • Custom scripts

    String scripts become hidden process debt. bug gives teams typed workflow, certified evidence, and audit output without inventing a private mini-standard.

  • Manual QA signoff

    Human judgment remains valuable. bug makes that judgment calmer because reviewers start from evidence instead of rebuilding the fix from scattered clues.

Proof compounds

Two tools. One standard.

bug keeps Witness high quality by proving fixes closed before execution evidence gets sealed. Witness keeps bug defensible by preserving the quality run and independent copy when proof has to leave git.

Use bug for the maintenance habit. Add Witness when customers, auditors, buyers, regulators, or counsel need sealed execution evidence they can verify later.

bug keeps closure honest

The repo shows the defect, red proof, green repair, commits, anchors, author, time, path, and reason before anyone asks Witness to seal the run.

Witness keeps proof portable

The quality run becomes reports, manifests, ledgers, hashes, timestamps, failures, artifacts, and verifier material an outside party can inspect later.

Off Grid can hold the copy

The locked Witness bundle can be retained by a third party, so the story is not dependent only on CI logs, screenshots, dashboards, or memory.

Add it when proof leaves git

Use bug by default. Add Witness for release gates, audits, procurement, regulated customers, incident review, legal exposure, or challenged fixes.

Archive rollout

Air-gapped proof without a new process.

Archive is the same bug workflow with five years of custody and a long signed offline lease. Put it on build hosts, incident machines, regulated laptops, and air-gapped repos where proof still has to be created when the network is not invited.

Same product, longer lease

Archive is not a second binary, special key prefix, or feature paywall. It is the full product with a signed offline lease for the prepaid term.

Air-gapped machines keep closing

When the network is dead or forbidden, mutation commands keep creating proof from the held lease until its signed boundary.

Inspection is never hostage

audit, show, list, languages, and verify stay available without a current license. Old evidence remains readable because it is repository data.

One licensing surface

Licensing checks entitlement without watching the work. Hosted custody is a separate authenticated upload of signed proof, never source files or raw command output.

Proof stays private

The record is created beside the code and travels with git. Source, paths, titles, repository identity, and proof records stay with your team. Your team can defend the close without sending the defect story to us.

Roll out where risk is real

Start with regulated repos, incident workstations, build hosts, and agent-heavy teams. Keep Jira, GitHub, Sentry, and CI; let git prove closure.

Buyer checklist

Questions worth asking before the next fix has to be believed.

You are not buying another workflow. You are buying fewer arguments after a fix, cleaner handoffs, safer agent work, easier feature work, and evidence that stays with git.

Memory fades

The repo still shows what broke, what proved it, what changed, and why the close can be trusted.

Review gets calmer

Red proof, green proof, commits, author, time, path, and reason arrive before the debate starts.

Handoffs survive Monday

A Friday red test and a Monday repair stay in one thread without Slack archaeology.

Agents stay bounded

Agents can contribute without turning confidence into claims nobody can verify.

Features move easier

Closed defects stop hiding as debt, so new work starts from known truth instead of old uncertainty.

Git stays home

Proof rides with branches, pull requests, and CI instead of forcing a tracker migration.

If customers, auditors, counsel, or future maintainers ask later, the answer is already beside the code.

The promise

The fix explains itself.

  • Review faster because red, green, Git, and authorship already agree.

  • Hand off without losing what failed, what changed, or why it worked.

  • Stop paying for the same defect through a second review, release, and production incident.

  • Let agents move quickly without letting confidence become evidence.

  • Keep proof private, portable, and readable without a subscription.

  • Turn PROVABLY CLOSED into a verified state, not a status field.

  • Spend less time reopening old doubt and more time building what comes next.

FAQ

Straight answers.

Is this a replacement for Jira, Linear, or GitHub Issues?

No. Trackers are where teams discuss, assign, prioritize, and remember work. bug lives beside git because the repair has to be verified where the code, test, commit, and future maintenance burden actually live. Keep the tracker; use bug when trust needs verification.

What does bug actually prove?

bug proves that closure was earned. PROVABLY CLOSED means the issue was described, the red test demonstrated the defect, the green fix changed that outcome, the commits back the transition, and the repair explanation is concrete enough for the next maintainer. It is a standard backed by repository evidence, not a status someone typed.

What is the red and green workflow?

Red is the moment the team proves the bug is real. Green is the moment the team proves the repair changed the outcome. The value is not ceremony; it is preserving the transition from broken to fixed so a reviewer, agent, auditor, or future maintainer can verify the story later.

How does bug help with engineering handoffs?

It keeps the thread in the repository. A record can show who filed the issue, when red proof was captured, who captured it, which commit held that proof, which test output hash describes the failure, who later greened the fix, and which commit closed it. The second-order effect is less coordination tax: the Monday maintainer starts from facts instead of chat archaeology. The third-order effect is cultural: handoffs become transparent without turning into blame, because the record shows the work path, not just the final success story.

How hard is it to adopt?

Start in the repo you already have. bug initializes beside your code, respects existing files, and can begin audit-only before you enforce anything. That matters because teams are tired of tools that demand a migration before proving value. bug earns trust by showing where closure is already weak.

Why is red proof so important?

Without the failing-before state, a passing test can be theatre. Red proof answers the first maintenance question: did we ever prove the issue we claimed to fix? It protects the team from polished fixes, agent guesses, and tests that were written after the fact but never caught the original defect.

How does bug help during an outage?

Outages are when standards are easiest to abandon and hardest to recover. People are tired, customers are angry, managers want updates, and a quick patch can quietly become tomorrow's bigger incident. bug gives the team a narrow path through the pressure: describe the defect, capture red proof, land the repair, prove green, and leave the record behind so the postmortem starts from facts instead of panic memory.

Does this only work for Go projects?

No. Real companies do not maintain one tidy language forever. bug is built for mixed repositories and the hero count is generated from the supported language list, so the page cannot drift from the product. Go currently gets the deepest parser-backed treatment, but the value is one maintenance habit across the stacks your company actually has.

Does bug fight our git workflow?

No. bug works hand in glove with git because git is already where engineering time is recorded. Branches, commits, pull requests, and reviews stay central. bug adds the missing defect proof layer so maintenance history is not split between code truth and ticket folklore.

Why not just rely on CI?

CI proves a command passed. It does not usually prove the issue was described well, that the right regression failed first, that the same defect was fixed, or that the next maintainer has enough context. CI is execution. bug is closure evidence.

What does bug audit do?

It verifies records, tests, current Git history, certified writer proofs, signatures, and revocations. Then it names what is proven, half fixed, stale, malformed, open, parked, or unproven. Plain audit is read-only, and the right to keep reading and auditing what you already produced survives your subscription on the machines it already covered.

What does half-fixed mean?

Half-fixed means there is smoke but not enough proof. Maybe the team has a green run but no red failure, a named test that does not match the bug, stale file anchors, or a repair explanation that would not help the next maintainer. bug makes that uncomfortable middle state visible.

What does malformed mean?

Malformed means the proof record cannot be trusted yet. That is different from an unfixed bug. It means the evidence itself is broken: missing fields, bad paths, invalid IDs, broken references, or structure that would force a human or agent to guess.

Why keep bug records in the repository?

Because maintenance happens in the repository. Tickets drift, teams reorganize, vendors change, and context disappears. A repo-local proof record moves with the branch, pull request, commit, review, and agent work that actually changed the system.

Why both Markdown and JSON?

Because teams are mixed now. Humans need readable Markdown they can review in a pull request, hand to a maintainer, or show during an incident review. Agents need structured JSON so they can inspect state without scraping prose. Both point at the same proof instead of creating two separate stories.

Is this agent-safe?

It gives agents the same hard boundary as people. Each licensed device writes immutable signed claims instead of fighting over a shared file. Audit verifies every writer independently and refuses prose-only closure.

How does bug stop agents from cutting corners?

Agents cannot satisfy bug by editing a sentence, inventing confidence, or calling a passing command a fix. They have to describe the issue, attach the right files and tests, prove red, prove green, and leave a repair explanation that a maintainer can understand.

What are certified writer proofs for?

They bind each mutation to a device key certified by the license server. Red, green, and reattest claims also bind the bug, operation, commit, and proof hash. A teammate on your licensed machines can clone the repo and verify the chain without your private key and without an active subscription.

How do I get started after buying?

Download the signed binary and activate the license once per device. Proof creation switches on immediately, including on day one of the thirty-day free trial, then the license disappears into the background. Everything needed to run the first proof cycle ships with the binary, so there is no onboarding call to schedule. Reading, showing, verifying, and auditing existing records never needs a key, because your maintenance evidence is your repository data.

What usage data do you collect?

The routine license check-in carries five things and no more: entitlement status, the registered device identifier, the binary version and build hash, per-command counts since the last check-in, and crash, activation, and abuse-prevention signals about the binary itself. It never carries source, arguments, file paths, bug titles, repository or branch names, test output, or proof records. Attested and Archive custody is a separate authenticated path: bug uploads the signed proof selected for custody and its integrity metadata into encrypted tenant-private storage, never the repository or captured command output. Air-gapped deployments check in never and upload nothing.

Why are there three prices?

Because there are three rungs of custody, not three proof workflows or a feature paywall. The figures are public: no Contact Sales gate, negotiation, or discount cycle. Solo keeps proof in your repository and receives a signed check-back date after the billing window should clear. Attested adds a countersignature and one year of encrypted tenant-private cloud custody, so someone outside your company can confirm the record we held. Archive retains the same signed proof for five years and adds a long signed offline lease for one to five years, so regulated and air-gapped machines can keep creating local records when the network is not allowed in. The binary manages its signing identity; customers do not provision a KMS, HSM, or separate uploader.

Do you offer a trial or refunds?

A trial, yes. Refunds, no. Solo comes with a one-time thirty-day free trial with every proof command switched on: start, red, green, and audit, on every machine your team uses, with nothing held back. We take a payment method up front so the subscription converts without interrupting your work, and nothing is charged during those thirty days. Cancel before day thirty and you are not billed at all. The trial is one per customer and covers Solo only, because the prepaid Archive lease is a prepaid offline term rather than a monthly subscription. After the trial converts, all sales are final: there are no refunds, credits, or prorated cancellations, and cancelling stops the next charge rather than returning the current period. We would rather say that plainly here than have you find it out after a charge. Everything needed to judge bug is public before you spend anything anyway: the full workflow, the commands, the benchmarks, the licensing terms, and the price. Your evidence is never held over you either way, because reading and audit keep working without a license and every record stays in your repository.

How does billing work?

Solo is $69 US dollars a month for your whole team, however many people and machines that is, and the first thirty days are free. The trial starts the day you activate, runs on a card we do not charge, and converts to the monthly rate on day thirty-one unless you cancel first. After activation, bug keeps a local signed lease and receives the next check-back date after the billing window should clear, during the trial exactly as afterward. The prepaid Archive lease has no trial because it prepays one to five years so regulated or air gapped teams can keep proof creation running without reconnecting.

What happens if we stop paying?

Creating new proof eventually stops. Reading does not. show, list, verify, and audit keep working on an expired or absent license because historical maintenance evidence must not become hostage data. Your proof outlives your subscription, and it would outlive us too.

I work on several machines. How many licenses do I need?

One organization license. Solo, Attested, and Archive are flat prices for the whole team, with no per-person or per-machine multiplier. Each machine still registers and holds its own signed lease so a shared credential remains detectable without turning device count into the billing meter.

What happens to license abusers?

A revoked or expired lease stops new proof creation. bug does not delete records, rewrite history, or block inspection. Existing evidence remains readable and auditable on every machine.

How does bug work with Witness?

bug proves the closure path: defect, red, green, explanation, commits, and certified writer. Witness preserves the wider quality run for outside review. Together they answer: was the bug repaired, and did the supporting checks really run?

Can bug help with compliance or enterprise review?

Yes, as engineering evidence. Certification and recertification work asks whether real processes exist and operate over time. bug helps show how the organization maintains software: defects were described, assigned, red-tested, green-fixed, explained, dated, committed, and governed by the same standard whether the actor was a person or an agent. Handoff records also show continuity: the organization can explain how work moved between people instead of relying on one person's memory.

How does this help with SOC 2 or ISO recertification?

Recertification asks whether controls operated over time. If a critical service has one job for years, the evidence that matters is how the team kept that job reliable. bug is built for code plus time: who or what touched the record, when operations happened, what fix was claimed, which test failed first, which test passed after, which commits prove the transition, and what audit state the repository reports.

What happens if a bug cannot be fixed yet?

It should stay visible instead of being buried. Maintenance is not pretending everything is done; it is knowing what is open, parked, unproven, or unsafe to close. bug lets the repository tell that truth without turning uncertainty into fake completion.

Does this replace human review?

No. It gives reviewers better facts. Humans still decide whether the fix is good, but bug makes the basic maintenance evidence structured, repeatable, and auditable before review becomes a judgment call.

Will it slow down with thousands of bugs or a fleet of agents?

The numbers come from the bug benchmark suite, measured on a developer machine rather than a server: go test ./internal/run -run '^$' -bench . -benchmem -count 3 on an Apple M1 Max. Start/report on a 10,000-bug inventory ran at 17.3 ms. Red and green first resolve and load the record at 1.7-1.8 ms and 2.5-2.6 ms, then the move bookkeeping measured 15.0-15.9 ms for the ledger and 26.1-26.3 ms for the index on a 5,000-bug inventory. Audit-shaped validation measured 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs. The 10,000 concurrent writers proof wrote 97.656 GiB through Primitive Filestore at 448.78 MB/s and every destination SHA-256 matched the source; its exact commands, raw results, and CPU and memory profiles are retained under test_results.

Does it require a server?

Creating, reading, verifying, and auditing local proof does not depend on a proof server: the authoritative record lives in the repository. Solo uses a local signed lease until its server-issued check-back date. Attested and Archive use Off Grid only for the independently held encrypted copy, and Archive can create local proof offline for its prepaid lease term. If our custody service is unavailable, your repository evidence remains readable and verifiable.

Could Off Grid, or anyone with the binary, forge a closure proof?

A binary or repo edit alone cannot create certified proof. Each device generates its writer key locally; the server certifies only the public key, and audit verifies the certificate, device signature, Git ancestry, proof hash, and revocation state. The private writer key never leaves the device.

Accountability

Make the next close one you can defend.

One recurring production defect can cost more than years of proof. Give every close the evidence the next reviewer, maintainer, and incident responder will need.