Update Bug Receipt to v1.4.1 (#2632)

* Update Bug Receipt to v1.4

* Add Bug Receipt version metadata

docs/README.skills.md

@@ -92,7 +92,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [breakdown-feature-prd](../skills/breakdown-feature-prd/SKILL.md)<br />`gh skills install github/awesome-copilot breakdown-feature-prd` | Prompt for creating Product Requirements Documents (PRDs) for new features, based on an Epic. | None |
 | [breakdown-plan](../skills/breakdown-plan/SKILL.md)<br />`gh skills install github/awesome-copilot breakdown-plan` | Issue Planning and Automation prompt that generates comprehensive project plans with Epic > Feature > Story/Enabler > Test hierarchy, dependencies, priorities, and automated tracking. | None |
 | [breakdown-test](../skills/breakdown-test/SKILL.md)<br />`gh skills install github/awesome-copilot breakdown-test` | Test Planning and Quality Assurance prompt that generates comprehensive test strategies, task breakdowns, and quality validation plans for GitHub projects. | None |
-| [bug-receipt](../skills/bug-receipt/SKILL.md)<br />`gh skills install github/awesome-copilot bug-receipt` | Close bugs and incidents with an auditable BUG RECEIPT and VERIFIED, PARTIAL, or BLOCKED status. Use for defect repair, regression proof, production incidents, and issue closeout. | `assets/receipt.template.json`<br />`references/receipt-contract.md`<br />`references/receipt.schema.json`<br />`scripts/validate-receipt.mjs` |
+| [bug-receipt](../skills/bug-receipt/SKILL.md)<br />`gh skills install github/awesome-copilot bug-receipt` | Close defects and incidents with a BUG RECEIPT and VERIFIED, PARTIAL, or BLOCKED status after diagnosis, repair, or recovery. | `assets/receipt.template.json`<br />`references/receipt-contract.md`<br />`references/receipt.schema.json`<br />`scripts/validate-receipt.mjs` |
 | [bug-reproduction-brief](../skills/bug-reproduction-brief/SKILL.md)<br />`gh skills install github/awesome-copilot bug-reproduction-brief` | Turn a vague, intermittent, or environment-specific bug report into a minimal evidence-backed reproduction before proposing a fix. | None |
 | [build-evidence-map](../skills/build-evidence-map/SKILL.md)<br />`gh skills install github/awesome-copilot build-evidence-map` | Build an auditable evidence map for a contested technical choice, research synthesis, proposal review, or consequential decision. Use when Copilot must preserve supporting, contradicting, qualifying, and missing evidence with exact source regions instead of collapsing disagreement into prose. | `references/evidence-ladder.md`<br />`references/map-schema.md`<br />`scripts/contract.mjs`<br />`scripts/validate.mjs` |
 | [centos-linux-triage](../skills/centos-linux-triage/SKILL.md)<br />`gh skills install github/awesome-copilot centos-linux-triage` | Triage and resolve CentOS issues using RHEL-compatible tooling, SELinux-aware practices, and firewalld. | None |

skills/bug-receipt/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: bug-receipt
-description: 'Close bugs and incidents with an auditable BUG RECEIPT and VERIFIED, PARTIAL, or BLOCKED status. Use for defect repair, regression proof, production incidents, and issue closeout.'
+description: 'Close defects and incidents with a BUG RECEIPT and VERIFIED, PARTIAL, or BLOCKED status after diagnosis, repair, or recovery.'
+metadata:
+  version: "1.4.1"
 ---
 
 # Bug Receipt
@@ -27,6 +29,8 @@ Use `not run`, `unproven`, or `none` explicitly. Never omit a row to make the re
 
 Before editing, record the observed problem, intended behavior, strongest direct check, and evidence source: `executed now`, `supplied`, or `mixed`. Never imply that supplied evidence was executed in the current run.
 
+Keep evidence privacy-minimal. Redact credentials, tokens, cookies, personal data, private URLs, and sensitive payloads; preserve only the identifiers and excerpts needed to reproduce or correlate the failure.
+
 Reproduce the failure with the narrowest safe check when possible. If reproduction is unavailable, preserve the evidence obtained and cap the result at `PARTIAL` or `BLOCKED`.
 
 ## Trace and repair
@@ -66,7 +70,7 @@ Use these decisive boundaries:
 
 For `PARTIAL` or `BLOCKED`, name the single minimal experiment or correlated evidence package that closes the decisive gap. Never invent a command, observation, count, location, or result.
 
-For a machine-readable receipt or CI integration, read [references/receipt-contract.md](references/receipt-contract.md) and conform to its JSON fields and status invariants.
+For a machine-readable receipt or CI integration, read [references/receipt-contract.md](references/receipt-contract.md) and conform to its JSON fields, evidence-source marker, compatibility rule, and status invariants.
 
 When a JSON artifact is requested, start from [assets/receipt.template.json](assets/receipt.template.json), write it to a task-owned path, and validate it with `node scripts/validate-receipt.mjs <receipt.json>` from this skill directory. Do not commit the generated receipt unless the user requests it.
 

skills/bug-receipt/assets/receipt.template.json

@@ -1,6 +1,7 @@
 {
-  "version": 1,
+  "version": 2,
   "status": "partial",
+  "evidenceSource": "supplied",
   "problem": "Describe the observed defect and intended behavior.",
   "baseline": {
     "command": "Record the exact reproduction command or interaction.",

skills/bug-receipt/references/receipt-contract.md

@@ -4,8 +4,9 @@ Use JSON only when the user, CI, or another tool needs a structured artifact. Ke
 
 ## Required fields
 
-- `version`: integer `1`.
+- `version`: integer `2` for new receipts. Version `1` remains accepted for compatibility.
 - `status`: `verified`, `partial`, or `blocked`.
+- `evidenceSource`: `executed-now`, `supplied`, or `mixed` (required in version `2`).
 - `problem`: concise defect and intended behavior.
 - `baseline`: object with `command`, `result`, and `evidence`.
 - `rootCause`: object with `summary` and at least one evidence item for `verified`.
@@ -37,4 +38,4 @@ For `blocked`:
 - Require at least one gap naming the external blocking condition.
 - Leave unperformed work empty or mark it `not-run`; do not speculate about the result.
 
-Validate against [receipt.schema.json](receipt.schema.json), run `node scripts/validate-receipt.mjs <file>` from the skill directory, or pipe JSON to `node scripts/validate-receipt.mjs - --json`.
+Validate against [receipt.schema.json](receipt.schema.json), run `node scripts/validate-receipt.mjs <file>` from the skill directory, pipe JSON to `node scripts/validate-receipt.mjs - --json`, or use `bug-receipt check <file>` when the package CLI is installed.

skills/bug-receipt/references/receipt.schema.json

@@ -7,8 +7,9 @@
   "additionalProperties": false,
   "required": ["version", "status", "problem", "baseline", "rootCause", "changes", "verification", "gaps"],
   "properties": {
-    "version": { "const": 1 },
+    "version": { "enum": [1, 2] },
     "status": { "enum": ["verified", "partial", "blocked"] },
+    "evidenceSource": { "enum": ["executed-now", "supplied", "mixed"] },
     "problem": { "$ref": "#/$defs/nonEmptyString" },
     "baseline": {
       "type": "object",
@@ -71,6 +72,13 @@
     "nonEmptyString": { "type": "string", "minLength": 1, "pattern": "\\S" }
   },
   "allOf": [
+    {
+      "if": { "properties": { "version": { "const": 2 } }, "required": ["version"] },
+      "then": {
+        "properties": { "evidenceSource": { "enum": ["executed-now", "supplied", "mixed"] } },
+        "required": ["evidenceSource"]
+      }
+    },
     {
       "if": { "properties": { "status": { "const": "verified" } }, "required": ["status"] },
       "then": {

skills/bug-receipt/scripts/validate-receipt.mjs

@@ -3,6 +3,7 @@ import { resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 const statuses = new Set(['verified', 'partial', 'blocked'])
+const evidenceSources = new Set(['executed-now', 'supplied', 'mixed'])
 const baselineResults = new Set(['failed', 'observed', 'not-run'])
 const verificationResults = new Set(['passed', 'failed', 'not-run'])
 
@@ -10,8 +11,9 @@ const isObject = (value) => value !== null && typeof value === 'object' && !Arra
 const nonEmpty = (value) => typeof value === 'string' && value.trim().length > 0
 
 export const sampleReceipt = {
-  version: 1,
+  version: 2,
   status: 'verified',
+  evidenceSource: 'executed-now',
   problem: 'A 10% checkout discount returns 100 instead of 90 after currency rounding.',
   baseline: {
     command: 'npm test -- discount.test.ts',
@@ -41,10 +43,12 @@ export function validateReceipt(receipt) {
   }
 
   if (!isObject(receipt)) return { valid: false, issues: [{ path: '$', message: 'Receipt must be a JSON object.' }] }
-  rejectUnknown(receipt, new Set(['version', 'status', 'problem', 'baseline', 'rootCause', 'changes', 'verification', 'gaps']), '')
+  rejectUnknown(receipt, new Set(['version', 'status', 'evidenceSource', 'problem', 'baseline', 'rootCause', 'changes', 'verification', 'gaps']), '')
 
-  if (receipt.version !== 1) add('version', 'Must equal 1.')
+  if (receipt.version !== 1 && receipt.version !== 2) add('version', 'Must equal 1 or 2.')
   if (!statuses.has(receipt.status)) add('status', 'Must be verified, partial, or blocked.')
+  if (receipt.evidenceSource !== undefined && !evidenceSources.has(receipt.evidenceSource)) add('evidenceSource', 'Must be executed-now, supplied, or mixed.')
+  if (receipt.version === 2 && !evidenceSources.has(receipt.evidenceSource)) add('evidenceSource', 'Version 2 requires an evidence source.')
   if (!nonEmpty(receipt.problem)) add('problem', 'Must be a non-empty string.')
 
   if (!isObject(receipt.baseline)) {
@@ -103,7 +107,7 @@ export function validateReceipt(receipt) {
     if (!Array.isArray(receipt.rootCause?.evidence) || receipt.rootCause.evidence.length === 0) add('rootCause.evidence', 'Verified requires concrete root-cause evidence.')
     if (!Array.isArray(receipt.changes) || receipt.changes.length === 0) add('changes', 'Verified requires at least one changed file or artifact.')
     if (!Array.isArray(receipt.verification) || receipt.verification.length === 0) add('verification', 'Verified requires at least one verification check.')
-    if (receipt.verification?.some((entry) => entry?.result !== 'passed')) add('verification', 'Every verification check must pass for verified status.')
+    if (Array.isArray(receipt.verification) && receipt.verification.some((entry) => entry?.result !== 'passed')) add('verification', 'Every verification check must pass for verified status.')
     if (Array.isArray(receipt.gaps) && receipt.gaps.length > 0) add('gaps', 'Verified status cannot contain proof gaps.')
   }