name: Bug report
description: Report a defect in IEG itself (not a task failure — use the report template for that).
title: "[bug] "
labels: ["bug", "triage"]
body:
  - type: markdown
    attributes:
      value: |
        Thanks for the report. IEG is a **prototype**: the model-backed behavioural
        and information-integrity gates (C, D) are unmeasured and it is not
        recommended for a working profile.

        A **task failure** (IEG's governance produced a wrong outcome during real
        work) is more useful when the report names the task, the seed state, and
        the exact governance decision (allow / ask / deny) that was wrong.

        **Never paste credentials, `~/.dsh/.credentials.yaml` contents, or
        unredacted session logs.** See `SECURITY.md`.

  - type: checkboxes
    id: preflight
    attributes:
      label: Pre-flight
      options:
        - label: I called `ieg_status` and pasted its JSON below (required if IEG mounted at all).
          required: false
        - label: "I reproduced the failure with IEG disabled (`enabled: false` or the `ieg-off.yml` overlay), or I explain why that was not possible."
          required: true
        - label: This is not in the accepted-limits list in `SECURITY.md` ("Known limitations — not vulnerabilities, not bugs").
          required: true

  - type: textarea
    id: environment
    attributes:
      label: Environment
      description: OS, Node version, DSH version (`dsh -V`), IEG version, profile, and whether the plugin was re-installed after the last source change.
      placeholder: |
        OS: Ubuntu 24.04
        node -v: v22.x
        dsh -V: 0.2.0-rc.2
        IEG: 0.7.0 (PROMPT_VERSION 0.3.0)
        profile: test-profile
        re-installed after last change: yes
    validations:
      required: true

  - type: textarea
    id: status
    attributes:
      label: ieg_status output
      description: "Paste the JSON verbatim. An empty or `mounted: false` result is itself a useful finding."
      render: json
    validations:
      required: false

  - type: textarea
    id: config
    attributes:
      label: Effective configuration
      description: The `ieg` row from `dsh --profile <name> --dump-config`, including any `--patch` overlays.
      render: yaml
    validations:
      required: true

  - type: textarea
    id: expected
    attributes:
      label: Expected behaviour
    validations:
      required: true

  - type: textarea
    id: actual
    attributes:
      label: Actual behaviour
      description: Include the exact refusal or allowance text IEG produced, and whether it was a deny or an ask.
    validations:
      required: true

  - type: textarea
    id: repro
    attributes:
      label: Minimal reproduction
      description: Smallest configuration and task that shows the problem. State whether it is deterministic.
    validations:
      required: true

  - type: checkboxes
    id: privacy
    attributes:
      label: Privacy
      options:
        - label: I removed credentials, tokens, and private file contents from everything pasted above.
          required: true