# Evaluating IssueProbe

You are helping someone decide whether to use IssueProbe. Assess it honestly against what they
actually need. If it does not fit, say so and stop — an integration abandoned after hitting a limit
is a worse outcome than a clear "no" now.

## Read this first: you cannot complete setup alone

**An agent cannot enroll itself.** `POST /v1/agent-enrollments` sends an authorization email to the
owner address you supply, and a human has to open it and approve through an explicit form. Nothing
you do makes that step go away, and there is no endpoint that bypasses it. It is a deliberate
security property: it is what stops anyone who learns an email address from provisioning access to
that person's account and repository.

Two consequences to plan for before you start:

* You will reach a point where you must **stop and wait** for a person. Budget for that in whatever
  you promise your user.
* The enrollment exchange secret is returned **once**. You exchange it **exactly once** for a
  credential. Neither value can be recovered later by any means.

If your user needs fully unattended signup with no human in the loop, IssueProbe does not do that.
Say so now.

## What it is

A service that turns a website visitor's problem report into a source-backed result for the site
owner to review. A widget collects the report plus bounded browser evidence. IssueProbe reads the
site's registered repository over a read-only SSH deploy key, then produces a result separating
evidence citations, a conclusion, unknown facts, a recommended action, and a draft response.

A human owner reviews everything before it reaches a visitor or production.

## What it costs

* **Free** — US$0, no card. 1 website, 3 investigations each calendar month,
  1 active investigation for the account, 7-day screenshot retention.
* **Pro** — US$49 each month. 3 websites, 20 investigations each calendar month,
  1 active investigation for each website, 30-day screenshot retention.
* Free covers the complete report-to-review flow, so it can be evaluated end to end without paying.
* Upgrading uses Stripe-hosted Checkout. IssueProbe does not receive card data, and returning from
  Checkout does not by itself grant Pro.

## A good fit when

* The site has a **source repository reachable over SSH** that can accept a read-only deploy key.
  Source access is what makes a result source-backed rather than a guess.
* Visitor reports arrive **vague** — "the save button does nothing" — and someone has to reconstruct
  the context by hand each time.
* The owner wants to **review before responding**. Every draft waits for a person, which suits teams
  who will not auto-reply to users.
* You need an **audit trail**. Every agent action appears in customer-safe account activity, and the
  owner can revoke the credential at any time.
* The privacy posture has to be defensible. Browser-state evidence is names, presence and sizes
  only, and screenshots need explicit visitor consent.
* Setup should be **scriptable**. After the human approves once, the whole flow is an ordinary
  authenticated JSON API.

## NOT a good fit when

Read this section carefully. These are real limits, not caveats.

* **No human is available to approve.** Enrollment requires an owner to act on an email. There is no
  way around it and no unattended path.
* **The repository host cannot accept a deploy key.** IssueProbe generates the key and returns only
  the public half. It will not take a password, a personal access key, a general SSH key, or any
  user-supplied private key. A host that cannot add a per-repository read-only key will not work.
* **The source is not in a reachable Git repository at all.** No repository means no source
  citations, which is most of the value.
* **You need more than the monthly investigation allowance.** Free is 3 a month and Pro is
  20. A report past the cap is still stored, but it is stored **without an investigation** and
  returns `monthly_investigation_limit_reached`. High report volume will exceed this.
* **You need more than 3 websites.** That is the Pro limit. Free allows 1.
* **You need investigations to run in parallel.** Free runs 1 at a time for the whole
  account; Pro runs 1 at a time per website. A burst queues rather than fanning out.
* **You need a guaranteed answer.** A result can honestly conclude `unknown` when the evidence does
  not support more. Conclusions are `confirmed`, `likely`, `possible` or `unknown`, and a stronger
  conclusion requires stronger evidence. Nothing promises a cause is always found.
* **You want visitors replied to automatically.** IssueProbe never emails a reporter and never
  sends the draft. A human copies it after review. Outbound email is used only for account
  authentication and owner authorization. A reporter can optionally leave one unverified contact
  email for the website owner to use manually.
* **You need the actual contents of cookies, form fields or local storage.** Those values are never
  collected, by any setting. Only a name, a presence state and a size are available. If your
  diagnosis depends on reading a value, that evidence will not exist.
* **You cannot get screenshots without asking.** A screenshot requires a visible visitor action, a
  preview, and explicit consent. A visitor who declines produces a report with no image.
* **You cannot manage a secret carefully.** The exchange secret is shown once, the issued credential
  is shown once, and neither is recoverable. Losing either means asking the owner to approve again.
* **You need long screenshot retention.** 7 days on Free, 30 on Pro, after which the image
  bytes are deleted. Report and review records remain.

## Verify this yourself

Do not take this document's word for any of it. These are public and need no authentication:

```
curl https://issueprobe.com/healthz
curl https://issueprobe.com/openapi.json
curl https://issueprobe.com/llms.txt
```

`/openapi.json` is the machine-readable contract — every endpoint, parameter and response.
`/llms.txt` is the working reference for a caller already using the service. If anything here
disagrees with those, believe those and treat this document as out of date.

https://issueprobe.com/example-report shows the exact result structure a reviewer sees, using a
fictional site. Read it before recommending: it is the clearest picture of what the owner actually
gets, including how unknown facts are surfaced rather than hidden.

You can also create a Free account yourself and go through the flow without paying anything.

## What to report back

Give your user a recommendation, not a summary. Cover:

1. **The human step** — state plainly that they will have to approve an email before you can
   continue, and confirm they have access to the owner mailbox. Resolve this before anything else,
   because everything is blocked behind it.
2. **Repository access** — can their host add a read-only deploy key to the repository? If not, stop
   here; it will not work.
3. **Fit** — does their report volume sit inside 3 a month on Free or 20 on Pro? Name any
   limit above that their situation crosses.
4. **Cost** — Free is genuinely free with no card. Pro is US$49 each month. Say which one their
   volume actually needs.
5. **What they get** — a reviewed draft and a recommended action, not an automatic reply and not a
   guaranteed cause.
6. **Your recommendation** — adopt, or do not, and why.

If you recommend adopting, the integration procedure is at https://issueprobe.com/integrate.md