Accountability

Git-native proof your bug fix holds.

Stop taking fixed on faith. A passing test today is not proof it would have caught the defect yesterday.

  • Learning curve Nothing new to learn
  • Red proof Test fails before the fix
  • Green proof Same test passes after
  • Audit Weak closure stays visible
  • Review Proof arrives with the fix
  • Handoff Context outlives the author
  • Agents Claims meet the same gate
  • Trust Certified writer identity
  • Verify Any clone can verify it
  • Ownership Evidence stays in your repo
  • Adoption Keep git, CI, and tracker
  • Coverage 50 language families

live proof path

Git keeps the history. bug keeps the proof.

ready

bug preserves the change that matters: the named regression failed before the repair and passed after it. Review starts from proof, not confidence. Git, but with superpowers.

  1. Start the record bug start --scaffold

    Creates a stable BUG record in _bugs/unproven and refuses unsafe source overwrites.

    Give the defect one durable home before context starts drifting.
    waiting
  2. Capture red proof bug red BUG-019f4569

    Runs the named regression before the fix and records failing output, actor, time, commit, and hash.

    Prove the test caught the defect before trusting the repair.
    locked
  3. Prove the repair bug green BUG-019f4569

    Requires the same defect to pass after the repair and moves the record only after the Fix section is real.

    Turn the passing repair into evidence the next person can verify.
    locked

certified proof

red commit
ec033cd · regression fails
green commit
684eb13 · same test passes
writer
device identity certified · proof signed

report excerpt

Status
PROVABLY CLOSED
Test
go test ./... -run TestBug019f4569...
Red At
local machine time
Green At
local machine time
_bugs after audit waiting
  • _bugs/ repo-local maintenance proof
  • BUG_ID_LEDGER.tsv allocated IDs
  • _index/ rebuildable record locations
  • _writers/ certificates + immutable signed claims
  • c842.../proof-BUG-019f4569...json writer, commit, operation, proof hash
  • closed/ records that earned closure
  • bug_medium_019f4569...normalize-drops-whitespace-only-input.md PROVABLY CLOSED
  • unproven/ empty after green

Continuous evidence

of continuous fuzzing

inputs tested

Last sealed
Peachy since
packages
targets

What it tests

Peachfuzz sends millions of malformed, unexpected, and adversarial inputs through the code.

Why it matters

It uncovers crashes and security flaws that ordinary tests can miss before customers encounter them.

Runs continuously. Every figure above comes from tamper evident, replayable run records.

Software + time

Launch is a moment. Maintenance is the product.

Software engineering is programming integrated over time.

Google Distinguished Engineer Titus Winters

Features create the promise

Launch wins attention. Then customers expect the promise to keep working:

  • The feature ships once
  • The code changes for years
  • Every change can reopen old risk
  • A false close makes the promise weaker

Maintenance keeps the promise

This is where the return on the work accumulates: fewer recurrences, calmer reviews, and software your customers can keep trusting.

  • Defects reproduced before repair
  • Fixes proven against current Git history
  • Authorship certified
  • Handoffs that survive the author
  • Evidence future teams can audit

what bug is

What stays with the fix.

One case file keeps the defect, regression, repair, commits, and certified proof together.

The next reviewer gets the answer before they have to ask.

Proof travels with the code.

Markdown serves people. Typed JSON serves agents. Certified writer claims let a fresh clone audit the same facts without your source leaving the repository.

  • Review without reconstructing the story.
  • Hand off without losing the why.
  • Audit without trusting the machine that wrote it.
Record
one durable case per defect
Writer
identity certified · evidence signed
Audit
any clone can verify
_bugs

Repository evidence tree

BUG-019f21eb high / unproven

record exists; evidence still missing

_bugs/unproven/bug_high_...md

BUG-019f21f1 low / parked

explicitly deferred, not quietly forgotten

_bugs/park/bug_low_...md

BUG-019eb648 high / provably_closed

red, green, Git, and certified proof agree

_bugs/closed/bug_high_...md

  • _index rebuildable record locations
  • _writers certificates + signed evidence
  • unproven new records needing evidence
  • open described defects in flight
  • closed proof accepted
  • park explicitly deferred work

Git gets dirty. Bug keeps the evidence clean.

Go JavaScript TypeScript Python C C++ Swift C# Java Perl PHP SQL Rust Zig Ruby Kotlin Dart Scala R Shell Lua Objective-C Lisp Haskell Assembly Visual Basic Pascal Fortran COBOL Ada Julia Groovy Clojure Elixir Erlang F# PowerShell Racket OCaml Nim Crystal V Solidity Terraform Make Dockerfile YAML Vue Svelte Delphi

Why bug exists

Fixed should mean fixed.

A bug that returns after fixed costs more than the first one. Now you pay for the defect, the failed fix, the repeated investigation, and the lost confidence.

  • Agents move fast. bug keeps confidence from outrunning proof.
  • Reviews start with red, green, commits, and authorship already tied together.
  • Handoffs keep the why, so the next engineer does not repeat the investigation.
  • Weak closure is caught before the same defect returns to production with a larger audience.
  • Audits sample durable evidence instead of asking the team to recreate it.
  • The result compounds: less rework, calmer incidents, and more room for new work.

Less archaeology. Less re-review. Fewer fixes that return wearing a new name.

Cost of false closure

Stop paying for the same bug twice.

A bug marked fixed can return as a second incident. This time it carries the original defect, a failed repair, repeated investigation, slower response, and customers who trust the next answer less.

bug captures the red-to-green change while the context is fresh, so review, handoff, production, and audit inherit proof instead of another promise.

  1. Repeat the investigation

    When the behavior returns, the team cannot trust the old close and has to reconstruct the same story from code, chat, CI, and memory.

    The second fix starts behind: more people, less context, and less confidence.

    SWEBOK review economics (opens in new tab)
  2. Pay the trust tax

    One false close makes every later close harder to believe.

    Reviews slow down, handoffs grow defensive, and the next incident begins with less trust than the last one.

    Lifecycle cost caveat (opens in new tab)

Maintenance is where software lives

80-90% Maintenance is where software lives

Most software value is protected after launch: changed, repaired, explained, inherited, and trusted again.

Invisible maintenance habits become visible business risk the moment someone asks how the work is actually kept healthy.

Software maintenance literature (opens in new tab)

Bad tail events need evidence

$4.4M Bad tail events need evidence

Most defects stay ordinary. A few become security, trust, legal, or customer events.

Proof discipline is cheapest before anyone knows which fix will matter later.

IBM Cost of a Data Breach 2025 (opens in new tab)

A recurring outage compounds the bill

$15K/min A recurring outage compounds the bill

When a supposedly fixed defect returns, the expensive part is not only downtime. The team must also disprove the old close before it can trust the new one.

That uncertainty burns the exact things outages already make scarce: time, trust, and attention.

Splunk downtime study, reported by ITPro (opens in new tab)

Audits reward operating memory

SOC 2 Audits reward operating memory

Audits and recertification do not ask whether people meant well. They ask whether controls operated over time.

A team without operating memory has to rebuild the story from fragments when the auditor finally asks.

AICPA SOC trust services context (opens in new tab)

When to buy

Two lease shapes. One public price.

Standard

Popular

$50 per seat, billed monthly

For connected teams where one repeated investigation or production recurrence costs more than the seat.

  • All proof commands: start, red, green, audit
  • Markdown for people; JSON for agents
  • Certified writer proof beside Git history
  • One license covers up to five machines
  • Server-set check-back date after billing clears

Enterprise

Offline

$100 per seat a month, prepaid 1 to 5 years

For air gapped or regulated machines that need proof creation without reconnecting.

  • Same proof commands as Standard
  • One to five year signed offline lease
  • Air-gap request JSON and lease import
  • No reconnect during the prepaid term
  • Existing records stay readable and auditable

If a license lapses, your evidence stays yours. You can still read records and run audit; only new proof creation waits for renewal.

Compliance map

Compliance asks for proof, not promises.

When reviewers arrive late, the repo should still know what broke, what proved it, who changed it, and why the close held.

The same question appears in different rooms: did the team identify the defect, prove the failure, prove the repair, preserve authorship, and keep the record reviewable later?

  1. 01 Business pressure

    A customer, auditor, incident review, buyer, or counsel asks how the team maintains software when defects matter.

  2. 02 Repo-local proof

    bug records the defect, red proof, green proof, commits, hashes, author, time, path, reason, and attempts beside the code.

  3. 03 Human and agent records

    Markdown keeps maintainers in the loop. JSON keeps agents useful. Ledgers keep both from drifting away from repository facts.

  4. 04 Audit pass

    bug audit classifies what is closed, open, parked, malformed, stale, or unproven without asking the team to retell the story from memory.

  5. 05 Review confidence

    The next reviewer gets maintenance evidence instead of folklore: what broke, what proved it, what changed, and why the close holds.

SOC 2 Type II

What it is
SOC 2 asks whether controls operated over time. Enterprise buyers often treat it as table stakes before trusting a SaaS vendor.
How bug helps
bug turns maintenance into sampled evidence: report, red proof, green proof, commits, hashes, author, time, path, and reason.
Reviewers get
Reviewers can inspect whether defect response and change follow-up happened, instead of rebuilding the story from tickets and chat.
Private by design
Proof stays in your repo. We do not need source, bug titles, repository names, paths, or customer data to make the record useful.

ISO/IEC 27001

What it is
ISO 27001 cares about a managed security program that survives change, surveillance audits, and recurring corrective action.
How bug helps
bug makes remediation inspectable: the nonconformity or defect is described, reproduced, repaired, explained, and classified by audit.
Reviewers get
Assessors get stable maintenance evidence for corrective action without asking engineers to reconstruct old fixes under pressure.
Private by design
Records remain local and readable. Expired licenses do not hold history hostage; existing evidence can still be read and audited.

FedRAMP

What it is
FedRAMP is evidence-heavy because authorization and continuous monitoring keep asking whether security work actually happened.
How bug helps
bug gives POA&M and defect closure a repo-native trail: failed state, fixed state, commits, certified writers, and an audit classification.
Reviewers get
Assessors can review closure evidence as part of recurring maintenance instead of trusting a spreadsheet row that says fixed.
Private by design
Offline leases let air gapped machines keep creating proof during the prepaid term without reconnecting for every close.

CMMC

What it is
CMMC asks defense suppliers to show disciplined handling of system integrity and controlled information environments.
How bug helps
bug records how flaws are identified, reproduced, corrected, and closed, with enough structure for both humans and agents.
Reviewers get
Assessors can sample maintenance work and see proof of correction rather than a policy claim that defects are handled.
Private by design
The evidence lives beside the code and can be produced without sending source or controlled information to Off Grid.

HIPAA

What it is
HIPAA reviews care less about slogans and more about what happened when software behavior could affect protected health information.
How bug helps
bug gives sensitive fixes a dated record: issue, reproduction, repair, test proof, commits, actors, paths, and rationale.
Reviewers get
Reviewers can ask what changed, who changed it, how it was verified, and whether the closure record still agrees with git.
Private by design
Bug records can prove the maintenance path without collecting PHI, secrets, source code, or private customer data.

SSDF and federal attestation

What it is
Secure development attestations become stronger when teams can show technical evidence behind the signature.
How bug helps
bug turns vulnerability and defect response into a structured record of description, red proof, green proof, code anchors, and certified claims.
Reviewers get
Reviewers get machine-readable JSON and human-readable Markdown tied to git, so attestation has evidence behind it.
Private by design
The tool strengthens your repo's memory without becoming a surveillance system or an external tracker.

Certification still depends on scope, controls, assessors, and the business. bug does not certify you; it keeps serious fixes easier to trust later, when the person asking was not in the room.

How bug works

Three commands. One trustworthy close.

Start the record. Prove the defect. Prove the repair. bug binds the result to Git and a server-certified device writer.

Accountability lifecycle private proof tree ready
current command bug init

Creates the private proof tree and deterministic indexes. No source leaves the repository.

  1. _bugs/ private state lives beside the code
  2. attempt survives interruption certified operation claim written first
  3. _bugs/unproven/BUG-019f4891...md one defect gets one durable home
  4. refused: existing test file unsafe scaffold overwrite rejected
  5. refused: test name missing bug id generic regression name rejected
  6. red: Score averages non-empty input failing proof tied to commit 60286e57
  7. green: divisor repair holds passing proof tied to commit b66758c3
  8. _bugs/closed/bug_medium_019f4891...md audit moves the case after proof agrees
  9. audit stays read-only and license-free any clone can verify the certified writer chain
Creates

A durable case file

Creates the private _bugs tree, indexes, and Markdown template. Your source, paths, titles, and records stay in the repo.

Creates

A case file before the fix

Gives the defect a stable home before the fix story begins: ID, severity, file, symbol, test command, actor, time, and narrative.

Refuses

Unsafe source overwrite

Refuses to overwrite an existing source or test file just to make scaffolding convenient. Existing work is not collateral damage.

Refuses

Nameless red proof

Records the failing proof before the repair and rejects a generic regression name that is not tied to the bug id.

Creates

The red-to-green transition

Forces the visible behavior change: first the defect fails, then the same defect passes after the production fix.

Refuses

Weak closure

Will not move a record to closed without the source anchor, test function, red proof, green proof, and concrete Fix narrative.

Creates

Reviewer-ready state

Exposes the same typed state through show, verify, and audit, so people and agents cannot get different answers.

Refuses

Ambiguous audit state

Classifies provably closed, open, half-fixed, stale, malformed, parked, duplicate, and unproven work so weak closure cannot hide behind prose.

Certified

Accountable authorship

Each licensed device signs immutable operation and proof claims with a server-certified writer key. A repo edit alone cannot invent that identity.

Documentation

Use bug without changing how your team works.

The whole point is fit: bug adds proof to git, reviews, issues, agents, and CI without asking those tools to become something else.

Repo-local guide

git native

What it does

Proof where work already happens.

bug adds one hard rule to the tools you already use: a fix must carry its proof.

  • One answer, beside the code

    The defect, regression, repair, commits, author, and proof stay together. Review stops being an investigation.

  • Git stays the workbench

    Keep your tracker, CI, branches, and pull requests. bug gives them a trustworthy ending.

  • Agents face a hard gate

    Confident prose cannot close the record. The named regression, current Git history, and certified proof must agree.

  • Trust travels

    A fresh clone can audit committed evidence with no writer private key and no paid license. The proof does not depend on the author's machine.

  • Weak closure stays visible

    Audit names what is proven, open, half-fixed, stale, malformed, parked, duplicate, or unproven. Nothing hides behind a green badge.

  • Private and never hostage

    Source, paths, titles, and proof records stay in your repository. If the license ends, reading and audit continue.

  • Scales without becoming a ceremony

    The daily paths are benchmarked for a local developer machine, not server throughput. On an Apple M1 Max, reporting a bug against a 10,000-bug inventory ran at 17.3 ms; loading the workflow record ran at 2.5-2.6 ms; resolving a bug reference from the index ran at 1.7-1.8 ms.

  • Supports multi-agent work

    Each licensed device writes immutable evidence under its own certified writer identity. Parallel work adds files instead of fighting over a shared ledger, and a fresh clone verifies every writer without a private key. Audit-shaped validation stayed local-fast: 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs.

  • Quality is built in

    Hostile tables, CLI smoke tests, fuzzing, fault injection, and race tests attack the same boundaries production depends on.

How to use it properly

A small habit with a hard stop.

The workflow is short because teams do not want ceremony. The strictness is deliberate because pressure is exactly when fake proof becomes expensive.

  • 1. Start the record

    Name the defect before the fix story starts. That creates one durable home for reproduction, ownership, files, tests, and review context.

  • 2. Make red real

    Write the regression before the repair and tie it to the bug id. bug rejects generic proof because generic proof does not protect the next maintainer.

  • 3. Repair after evidence

    Fix production code after the failure is pinned down. The review now sees the transition instead of trusting timing, memory, or confidence.

  • 4. Make green explain itself

    Close only after the same defect passes and the fix narrative is clear enough for someone else to maintain the code later.

  • 5. Inspect before trust

    Use show, verify, and audit to review typed facts quickly. The tool rejects weak closure while the fix is still cheap to improve.

  • 6. Seal the bigger story when needed

    Use Witness for customer-facing, regulated, security-sensitive, or legal fixes. bug proves closure; Witness seals the execution evidence behind it.

Proof doctrine

Strict where strictness pays.

bug does not replace judgment. It removes the loopholes that make judgment expensive under deadlines, outages, handoffs, and agent work.

  • Trust, then verify

    Good teams trust each other. Great teams make that trust scalable by letting the repository verify the parts memory should not carry.

  • Maintenance is the product life

    Software spends most of its useful life being changed, repaired, explained, and inherited. bug treats that work as engineering, not cleanup.

  • Confidence comes from proof

    The experience should make engineers feel safer in their work: describe the defect, prove it, repair it, explain it, and leave proof future you can trust.

  • Git remains central

    The convenience is that truth stays beside the code. Tickets, dashboards, and chats can point at bug; they do not have to become bug.

  • No surveillance bargain

    A proof tool should not require source exfiltration, repository names, bug titles, or private paths. The record belongs to the team.

  • Agent-ready, not agent-naive

    Agents can move fast. bug gives them typed rails and visible failure when they try to close work with confident prose instead of evidence.

  • Standards that can be enforced

    A standard that only lives in a policy document will be skipped under pressure. bug turns the standard into repository behavior that can fail the work.

  • Clear facts beat clever prose

    A polished explanation helps only after the evidence is coherent. bug keeps facts structured so prose cannot hide missing proof.

Where it fits

Keep your tools. Give them closure.

Jira, Linear, GitHub Issues, Sentry, BugSnag, CI, and pull requests should not feel threatened by bug. They should recommend it, because bug gives their work a stronger ending.

  • Keep Jira, Linear, GitHub Issues, or your tracker for planning.
  • Keep Sentry or BugSnag for production detection.
  • Keep CI for execution.
  • Keep git as the transition history.
  • Use bug to prove the issue moved from report to red regression to green repair to maintainer-ready explanation.
  • Let every existing tool link to the proof instead of trying to become the proof.

Alternatives

Keep the tools. Remove the doubt.

bug is not priced against planning, QA, CI, or review. Those tools still matter. bug fills the closure gap they were never meant to own.

  • Issue trackers alone

    Jira, Linear, GitHub Issues, and their cousins are excellent for planning and memory. The repair still needs repo proof: test, commit, code anchor, and state agreeing.

  • Pull request templates

    Templates ask politely. bug verifies. That turns a checkbox into a repo contract reviewers and agents can actually trust.

  • CI checks only

    CI proves a command passed. bug preserves the change: the right regression failed first, the repair passed later, and certified authorship stayed intact.

  • Commit message discipline

    Conventions help until pressure arrives. bug checks the record against tests, anchors, commits, and certified proof so discipline does not depend on memory.

  • Custom scripts

    String scripts become hidden process debt. bug gives teams typed workflow, certified evidence, and audit output without inventing a private mini-standard.

  • Manual QA signoff

    Human judgment remains valuable. bug makes that judgment calmer because reviewers start from evidence instead of rebuilding the fix from scattered clues.

Proof compounds

Two tools. One standard.

bug keeps Witness high quality by proving fixes closed before execution evidence gets sealed. Witness keeps bug defensible by preserving the quality run and independent copy when proof has to leave git.

Use bug for the maintenance habit. Add Witness when customers, auditors, buyers, regulators, or counsel need sealed execution evidence they can verify later.

Explore Witness

bug keeps closure honest

The repo shows the defect, red proof, green repair, commits, anchors, author, time, path, and reason before anyone asks Witness to seal the run.

Witness keeps proof portable

The quality run becomes reports, manifests, ledgers, hashes, timestamps, failures, artifacts, and verifier material an outside party can inspect later.

Off Grid can hold the copy

The locked Witness bundle can be retained by a third party, so the story is not dependent only on CI logs, screenshots, dashboards, or memory.

Add it when proof leaves git

Use bug by default. Add Witness for release gates, audits, procurement, regulated customers, incident review, legal exposure, or challenged fixes.

Enterprise rollout

Air-gapped proof without a new process.

Enterprise is the same bug workflow with a long signed offline lease. Put it on build hosts, incident machines, regulated laptops, and air-gapped repos where proof still has to be created when the network is not invited.

Same product, longer lease

Enterprise is not a second binary, special key prefix, or feature paywall. It is the full product with a signed offline lease for the prepaid term.

Air-gapped machines keep closing

When the network is dead or forbidden, mutation commands keep creating proof from the held lease until its signed boundary.

Inspection is never hostage

audit, show, list, languages, and verify stay available without a current license. Old evidence remains readable because it is repository data.

One licensing surface

Licensing checks entitlement without watching the work. Source, paths, titles, repository identity, and proof records stay with your team.

Proof stays private

The record is created beside the code and travels with git. Your team can defend the close without sending the defect story to us.

Roll out where risk is real

Start with regulated repos, incident workstations, build hosts, and agent-heavy teams. Keep Jira, GitHub, Sentry, and CI; let git prove closure.

Buyer checklist

Questions worth asking before the next fix has to be believed.

You are not buying another workflow. You are buying fewer arguments after a fix, cleaner handoffs, safer agent work, easier feature work, and evidence that stays with git.

Memory fades

The repo still shows what broke, what proved it, what changed, and why the close can be trusted.

Review gets calmer

Red proof, green proof, commits, author, time, path, and reason arrive before the debate starts.

Handoffs survive Monday

A Friday red test and a Monday repair stay in one thread without Slack archaeology.

Agents stay bounded

Agents can contribute without turning confidence into claims nobody can verify.

Features move easier

Closed defects stop hiding as debt, so new work starts from known truth instead of old uncertainty.

Git stays home

Proof rides with branches, pull requests, and CI instead of forcing a tracker migration.

If customers, auditors, counsel, or future maintainers ask later, the answer is already beside the code.

The promise

The fix explains itself.

  • Review faster because red, green, Git, and authorship already agree.

  • Hand off without losing what failed, what changed, or why it worked.

  • Stop paying for the same defect through a second review, release, and production incident.

  • Let agents move quickly without letting confidence become evidence.

  • Keep proof private, portable, and readable without a subscription.

  • Turn PROVABLY CLOSED into a verified state, not a status field.

  • Spend less time reopening old doubt and more time building what comes next.

FAQ

Straight answers.

Is this a replacement for Jira, Linear, or GitHub Issues?

No. Trackers are where teams discuss, assign, prioritize, and remember work. bug lives beside git because the repair has to be verified where the code, test, commit, and future maintenance burden actually live. Keep the tracker; use bug when trust needs verification.

What does bug actually prove?

bug proves that closure was earned. PROVABLY CLOSED means the issue was described, the red test demonstrated the defect, the green fix changed that outcome, the commits back the transition, and the repair explanation is concrete enough for the next maintainer. It is a standard backed by repository evidence, not a status someone typed.

What is the red and green workflow?

Red is the moment the team proves the bug is real. Green is the moment the team proves the repair changed the outcome. The value is not ceremony; it is preserving the transition from broken to fixed so a reviewer, agent, auditor, or future maintainer can verify the story later.

How does bug help with engineering handoffs?

It keeps the thread in the repository. A record can show who filed the issue, when red proof was captured, who captured it, which commit held that proof, which test output hash describes the failure, who later greened the fix, and which commit closed it. The second-order effect is less coordination tax: the Monday maintainer starts from facts instead of chat archaeology. The third-order effect is cultural: handoffs become transparent without turning into blame, because the record shows the work path, not just the final success story.

How hard is it to adopt?

Start in the repo you already have. bug initializes beside your code, respects existing files, and can begin audit-only before you enforce anything. That matters because teams are tired of tools that demand a migration before proving value. bug earns trust by showing where closure is already weak.

Why is red proof so important?

Without the failing-before state, a passing test can be theatre. Red proof answers the first maintenance question: did we ever prove the issue we claimed to fix? It protects the team from polished fixes, agent guesses, and tests that were written after the fact but never caught the original defect.

How does bug help during an outage?

Outages are when standards are easiest to abandon and hardest to recover. People are tired, customers are angry, managers want updates, and a quick patch can quietly become tomorrow's bigger incident. bug gives the team a narrow path through the pressure: describe the defect, capture red proof, land the repair, prove green, and leave the record behind so the postmortem starts from facts instead of panic memory.

Does this only work for Go projects?

No. Real companies do not maintain one tidy language forever. bug is built for mixed repositories and the hero count is generated from the supported language list, so the page cannot drift from the product. Go currently gets the deepest parser-backed treatment, but the value is one maintenance habit across the stacks your company actually has.

Does bug fight our git workflow?

No. bug works hand in glove with git because git is already where engineering time is recorded. Branches, commits, pull requests, and reviews stay central. bug adds the missing defect proof layer so maintenance history is not split between code truth and ticket folklore.

Why not just rely on CI?

CI proves a command passed. It does not usually prove the issue was described well, that the right regression failed first, that the same defect was fixed, or that the next maintainer has enough context. CI is execution. bug is closure evidence.

What does bug audit do?

It verifies records, tests, current Git history, certified writer proofs, signatures, and revocations. Then it names what is proven, half fixed, stale, malformed, open, parked, or unproven. Plain audit is read-only and license-free.

What does half-fixed mean?

Half-fixed means there is smoke but not enough proof. Maybe the team has a green run but no red failure, a named test that does not match the bug, stale file anchors, or a repair explanation that would not help the next maintainer. bug makes that uncomfortable middle state visible.

What does malformed mean?

Malformed means the proof record cannot be trusted yet. That is different from an unfixed bug. It means the evidence itself is broken: missing fields, bad paths, invalid IDs, broken references, or structure that would force a human or agent to guess.

Why keep bug records in the repository?

Because maintenance happens in the repository. Tickets drift, teams reorganize, vendors change, and context disappears. A repo-local proof record moves with the branch, pull request, commit, review, and agent work that actually changed the system.

Why both Markdown and JSON?

Because teams are mixed now. Humans need readable Markdown they can review in a pull request, hand to a maintainer, or show during an incident review. Agents need structured JSON so they can inspect state without scraping prose. Both point at the same proof instead of creating two separate stories.

Is this agent-safe?

It gives agents the same hard boundary as people. Each licensed device writes immutable signed claims instead of fighting over a shared file. Audit verifies every writer independently and refuses prose-only closure.

How does bug stop agents from cutting corners?

Agents cannot satisfy bug by editing a sentence, inventing confidence, or calling a passing command a fix. They have to describe the issue, attach the right files and tests, prove red, prove green, and leave a repair explanation that a maintainer can understand.

What are certified writer proofs for?

They bind each mutation to a device key certified by the license server. Red, green, and reattest claims also bind the bug, operation, commit, and proof hash. A teammate can clone the repo and verify the chain without your private key or a paid license.

How do I get started after buying?

Download the signed binary and activate the license once per device. Proof creation switches on immediately, then the license disappears into the background. Everything needed to run the first proof cycle ships with the binary, so there is no onboarding call to schedule. Reading, showing, verifying, and auditing existing records never needs a key, because your maintenance evidence is your repository data.

What usage data do you collect?

Command counters, and nothing else. We do not need your code, arguments, paths, bug titles, repository names, or proof records to license a tool. The point of bug is that your evidence stays with you. Air gapped deployments check in never and send nothing.

Why are there two prices?

Because there are two lease shapes, not two products. The figures are public: no Contact Sales gate, no negotiation, and no discount cycle. Standard stores a local signed lease; when bug checks in, it sends subscription status and anonymized command counts, and the server returns the next check-back date after the billing window should clear. Enterprise costs twice as much because it buys a long signed offline lease for one to five years, so regulated and air gapped machines can keep creating records when the network is not allowed in. It is not a feature paywall.

Do you offer a trial or refunds?

All sales are final. There are no trial periods, refunds, credits, or prorated cancellations. We would rather say that plainly here than have you find it out after a charge. The reason is that everything needed to judge bug is public before you spend anything: the full workflow, the commands, the benchmarks, the licensing terms, and the price. If you are on a monthly subscription you can cancel at any time and the next charge will not be taken, though the current period is not refunded. Your evidence is never held over you either way, because reading and audit keep working without a license and every record stays in your repository.

How does billing work?

Standard is fifty dollars a seat, billed monthly. After activation, bug keeps a local signed lease and receives the next check-back date after the billing window should clear. Enterprise prepays one to five years so regulated or air gapped teams can keep proof creation running without reconnecting.

What happens if we stop paying?

Creating new proof eventually stops. Reading does not. show, list, verify, and audit keep working on an expired or absent license because historical maintenance evidence must not become hostage data. Your proof outlives your subscription, and it would outlive us too.

I work on several machines. How many licenses do I need?

One. A seat is a person, not a computer. Put bug on up to five of your machines under one seat and each holds its own offline lease. Maintenance work happens on laptops, desktops, build hosts, and incident machines; the pricing should not punish that reality.

What happens to license abusers?

A revoked or expired lease stops new proof creation. bug does not delete records, rewrite history, or block inspection. Existing evidence remains readable and auditable on every machine.

How does bug work with Witness?

bug proves the closure path: defect, red, green, explanation, commits, and certified writer. Witness preserves the wider quality run for outside review. Together they answer: was the bug repaired, and did the supporting checks really run?

Can bug help with compliance or enterprise review?

Yes, as engineering evidence. Certification and recertification work asks whether real processes exist and operate over time. bug helps show how the organization maintains software: defects were described, assigned, red-tested, green-fixed, explained, dated, committed, and governed by the same standard whether the actor was a person or an agent. Handoff records also show continuity: the organization can explain how work moved between people instead of relying on one person's memory.

How does this help with SOC 2 or ISO recertification?

Recertification asks whether controls operated over time. If a critical service has one job for years, the evidence that matters is how the team kept that job reliable. bug is built for code plus time: who or what touched the record, when operations happened, what fix was claimed, which test failed first, which test passed after, which commits prove the transition, and what audit state the repository reports.

What happens if a bug cannot be fixed yet?

It should stay visible instead of being buried. Maintenance is not pretending everything is done; it is knowing what is open, parked, unproven, or unsafe to close. bug lets the repository tell that truth without turning uncertainty into fake completion.

Does this replace human review?

No. It gives reviewers better facts. Humans still decide whether the fix is good, but bug makes the basic maintenance evidence structured, repeatable, and auditable before review becomes a judgment call.

Will it slow down with thousands of bugs or a fleet of agents?

The numbers come from the bug benchmark suite, measured on a developer machine rather than a server: go test ./internal/run -run '^$' -bench . -benchmem -count 3 on an Apple M1 Max. Start/report on a 10,000-bug inventory ran at 17.3 ms. Red and green first resolve and load the record at 1.7-1.8 ms and 2.5-2.6 ms, then the move bookkeeping measured 15.0-15.9 ms for the ledger and 26.1-26.3 ms for the index on a 5,000-bug inventory. Audit-shaped validation measured 17.1-17.5 ms for 200 open bugs and 120-122 ms for 300 closed bugs.

Does it require a server?

Your evidence never needs one. The proof lives in the repository, so there is no external database to trust when someone asks what happened. Standard proof creation uses a local signed lease until its server-issued check-back date; Enterprise proof creation can run offline for the full prepaid term.

Could Off Grid, or anyone with the binary, forge a closure proof?

A binary or repo edit alone cannot create certified proof. Each device generates its writer key locally; the server certifies only the public key, and audit verifies the certificate, device signature, Git ancestry, proof hash, and revocation state. The private writer key never leaves the device.

Accountability

Make the next close one you can defend.

One recurring production defect can cost more than years of proof. Give every close the evidence the next reviewer, maintainer, and incident responder will need.

Buy bug