Bug Vaccine

PROBLEM Every team fixes bugs, and many of them come back. Under incident pressure, fixes ship without regression tests; "add a test" becomes a postmortem follow-up nobody finishes. New code, written by people who never saw last spring's incident, repeats the same mistake somewhere else: a missing null guard, float money math, an off-by-one. Coverage can't see this risk ("80% of lines executed" says nothing about whether you'd catch bugs you already shipped), and classic mutation testing is too slow and noisy for most teams. Each regression means paying for the same bug twice. SOLUTION Bug Vaccine treats a repo's own history as a vaccine. It mines bug-fix commits and postmortems; IBM Bob extracts the reusable pattern behind each bug (an "antigen") and flags follow-ups that were never done. Bob's parallel subagents, one per pattern, hunt for every place each bug could come back, including code written after the fix. Bug Vaccine then re-injects each historical bug one at a time and runs the real test suite: caught means immune; passing means the bug could return unnoticed. Bob in Agent mode writes "antibody" tests that guard each pattern, never touching production code, and a fresh Bob session that never saw those tests invents new variants as a blind check. Measured on our sample project: tests caught 2/6 past bugs (33%) before and 6/6 (100%) after; the blind check caught 6/6 unseen variants; 23 tests were added. TARGET USERS AND HOW THEY USE IT Engineering teams and maintainers. They run one command on their repo (or a GitHub Action on every pull request). Reviewers get a PR comment when new lines repeat a bug the company already fixed, with the team's own fix attached. "patch" applies those past fixes automatically, reruns the tests (rolling back if they fail) and re-scans; a pre-commit guard blocks the next copy, and Semgrep rules carry the knowledge into every IDE and CI. An offline dashboard shows the whole run, and a Debug lab answers "have we had this bug before?" for any crash, report or diff, with cited company sources. WHAT MAKES IT UNIQUE Mutation testing built from your own incidents rather than random mutants: few, meaningful mutants that each represent a real past failure. The core principle is "Bob proposes, the test runner decides": every number comes from actually running the tests, never from an AI estimate, and the blind held-out check guards against tests that memorise instead of generalise. WHY IT WORKS EFFICIENTLY A full check of six mutants takes seconds. There are no pip installs, and it works on Windows, macOS and Linux. It found what reviewers missed: the #57 fix had no test, and a module written after all three fixes repeated every one of them. In our PR demo it flagged 5 risks before merge and patched 3 repeated bugs with the team's own fixes (3 → 0).