Antibody: do your fixed bugs stay fixed?

Every project fixes bugs, but a fix only stays fixed if some test notices when it goes away. Antibody checks that. It puts a project's past bug fixes back one at a time, on today's code, and runs the project's own tests. Before the event we measured the problem on 18 popular Python libraries. We undid 479 fixes for real bugs, and 139 times every test still passed. When a fix shipped without its own test, undoing it went unnoticed 100 times out of 109. One of them is sqlparse's published security fix for a slowdown attack: take it out and the attack works again, with all 506 tests green. IBM Bob does the judgment. It reads each fix's bug report to decide which fixes were real bugs, then starts one subagent for every fix that slipped through. Each subagent writes the missing regression test, and a script proves it: the test must fail with the bug put back and pass with the fix in. On sqlparse, 13 of the 20 past bugs we could check were caught by its tests before Bob, and 18 after, with five new tests that Bob's subagents wrote and proved, one of them for that security fix. One is still exposed, and the ledger says why. Mutation testing invents bugs. Antibody puts back the ones a project really had. The Immunity Ledger lists every past bug with a link to its public fix, and fixes we couldn't run count as no data, never as safe. A CI check fails the build when a past bug has no test that catches it (unless someone accepts it with a written reason), and when a proven test is deleted.