Receipts

Modern code review tools can identify potential problems, run tests, and report failures, but software changes often require more than a fixed sequence of checks. A test suite may pass while important behavior remains untested. A static warning may indicate risk without proving a defect. An automated fix may appear correct without demonstrating that the original problem is actually resolved. Receipts addresses this problem with an evidence-first approach to software change verification. Receipts is an adaptive code review and bug-immunity system designed for developers and engineering teams. Instead of following one fixed testing method, it analyzes a change, identifies what evidence is available and what evidence is missing, and selects appropriate investigation strategies. Depending on the evidence gap, it can use existing tests, differential testing, property-based testing, mutation testing, fault localization, metamorphic testing, fuzzing, counterexample shrinking, and semantic sibling analysis. The system follows a simple principle: No evidence, no flag. A failed check is not automatically treated as a confirmed defect. Evidence is collected, evaluated, and associated with claims. When evidence is insufficient, Receipts can select another applicable strategy rather than prematurely declaring the code safe or unsafe. For verified defects, Receipts extends the process into a Bug-to-Immunity pipeline. It reproduces the issue, tracks root-cause hypotheses, evaluates bounded fix strategies in isolated workspaces, verifies the proposed fix, generates regression protection, and records the resulting evidence. Unsafe or insufficiently verified fixes are rejected or escalated rather than silently accepted. Every important decision can be represented through an auditable receipt containing the claim, evidence, strategy used, result, and final decision. The system also includes replay infrastructure, strategy traces, audit-chain verification, repository providers, deterministic execution controls, and a frontend for presenting reviews, evidence, bug immunity, replay results, audit information, and project activity. What makes Receipts different is the combination of adaptive investigation + evidence contracts + verified repair + auditability. The goal is not simply to add more automated checks, but to make software verification capable of changing its approach when the current evidence is insufficient. Receipts therefore moves code review from: “Run the checks and report the result.” to: “Determine what must be proven, gather the appropriate evidence, verify it, and preserve the reasoning.”