You might partition your test suite into two pieces: one to test bugs raised in the field; the other to grow in-step with the code as you develop it (i.e. test-driven development).

I try not to do this for a couple of reasons:

• The failing bug test is often illustrating something useful about holes in the existing test suite. If it's off it a separate area it is harder to get a good handle on the unit being tested since the tests are spread out over different locations.
• There is a tendency to sideline the bug-report tests if they're not causing your main build to fail.

If it's not something that can be fixed immediately I might make it a $TODO test so that the test suite runs successfully, but there's always that reminder that there is technical debt that needs to be paid off.

My current plan is simply to insert bug-IDs/test-case IDs in test program comments and Configuration Management change logs. How do you do it?

I tend to use the SCM logs for this, and I've also been experimenting with subversion's properties (for those who don't use subversion properties are versioned metadata you can associate with files/directories).

IMHO it belongs in the SCM not the tests themselves since it's basically a comment and, as test suites and code gets refactored. the comment gets more and more out of sync with reality. You want to track when the failing test(s) for a particular bug were created and when they were fixed, which is a job that source control does well. I'm not really certain that there is much utility in tracking stuff after that.