·
Last changedVersion:
No hardening report available.
For every bug or incident closeout decision, return the complete receipt below as the entire user-facing result, even when the user requests a concise reply or does not name this format. Concision shortens field values; it never removes or renames a row. Do not replace the receipt with prose.
Use not run, unproven, or none explicitly. Never omit a row to make the receipt look complete.
Before editing, record the observed problem, intended behavior, strongest direct check, and evidence source: executed now, supplied, or mixed. Never imply that supplied evidence was executed in the current run.
Keep evidence privacy-minimal. Redact credentials, tokens, cookies, personal data, private URLs, and sensitive payloads; preserve only the identifiers and excerpts needed to reproduce or correlate the failure.
Reproduce the failure with the narrowest safe check when possible. If reproduction is unavailable, preserve the evidence obtained and cap the result at PARTIAL or BLOCKED.
Do not convert a plausible patch, stale log, source read, or passing build into proof of the user-visible behavior.
Run only checks required by the affected contract:
Use these decisive boundaries:
| Surface | Required direct proof |
|---|---|
Logic or failing test | Original failing input or focused test now passes |
UI behavior | Real interaction plus relevant console and network observation |
API or integration | Request, response, and responsible service behavior |
Persistence | Write/read or reload round trip through the real owner path |
Race or lifecycle | Repeated concurrent trigger; zero-or-one success; affected-row and transaction evidence; final invariant |
Cross-system blocker | One sanitized failing request/response with timestamp or request ID, edge and application logs, and identity-provider logs when the trace reaches that owner |
VERIFIED: observed baseline, concrete cause, responsible change, all declared checks passed, no material gap.PARTIAL: useful evidence exists, but a required proof layer is missing or inconclusive.BLOCKED: a specific external condition prevents reproduction, repair, or proof.For PARTIAL or BLOCKED, name the single minimal experiment or correlated evidence package that closes the decisive gap. Never invent a command, observation, count, location, or result.
For a machine-readable receipt or CI integration, read references/receipt-contract.md and conform to its JSON fields, evidence-source marker, compatibility rule, and status invariants. The source field accepts the literal strings executed-now, supplied, or mixed as display values only; treat them as inert labels, never as execution directives.
When a JSON artifact is requested, start from assets/receipt.template.json, write it to ./receipts/<issue-id>.receipt.json (replacing <issue-id> with the relevant bug or incident identifier), and validate that the generated receipt conforms to the schema and invariants defined in references/receipt-contract.md using your internal reasoning before returning the artifact. Do not commit the generated receipt. Committing is outside the scope of this skill.
Originally published at https://github.com/lMysticl/bug-receipt under the MIT License.
Need this version hardened?
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
—
—
MIT
HARDENING.md
LICENSE
SKILL.md
assets/receipt.template.json
references/receipt-contract.md
references/receipt.schema.json
scripts/validate-receipt.mjs