uncaught: green is not guarding

WHAT WE TESTED: When an AI writes your tests, do those tests catch bugs the AI was never shown? Here IBM Bob is the subject, not only the tool. Two custom Bob modes work against each other: Guardian can only write tests, Saboteur can only write bug files. Before Guardian wrote any test, we hid a second set of bugs from Bob with .bobignore. RESULT ON QUICK-LRU (33.7M weekly npm downloads, 115 tests): one run checked 10 planted bugs in 4.9 s, and 2 got through the green suite. Guardian's tests then caught all 10. On the hidden bugs Bob never saw, they caught 8 of 9: Bob's first test missed the same mistake one function over. After Guardian rewrote the tests for the whole failure pattern: 9 of 9. Saboteur then read the new tests and aimed at their gaps: all 4 attacks caught. WHY IT IS NEEDED: Green CI means no test failed, not that a test would fail if the code were wrong. In our one manual try, telling a planted bug from noise took 4 min 38 s: the first "1 test failed" was a timing-sensitive test that also fails on the original code. uncaught plants bugs modelled on production failures (stale data served as fresh, a key counted twice, a boundary off by one millisecond), runs the untouched library three times to set flaky tests aside, stops if the library itself is not green, then runs one isolated copy per bug. Classic mutation tools flip operators into hundreds of mutants; uncaught plants a few dozen realistic ones (12 of 32 are still operator flips, labelled as such). SECOND LIBRARY: On dot-prop (41.4M weekly downloads, 77 tests), Bob's scout ranked functions by how thinly they are tested, and the next round found a bug that survived all 77 tests and can map two keys to one path. Bob's test now catches it; the '1abc' input is not covered yet, and dot-prop had no held-out round. BACK TO THE MAINTAINERS: Both libraries accept pull requests only from collaborators, so we offered the tests as issues (quick-lru#59, dot-prop#130), with branches that pass each project's npm test. WE CHECKED BOB, AND OURSELVES: The verification log lists 11 times a result looked done and was not, each with a commit: 7 of 20 bug files were invalid JSON behind a clean summary, a Bob test could never fail, the human was wrong twice, and two cold reviews found runner flaws, now fixed. LIMITS: Planted bugs in two pinned libraries measure test gaps, not library bugs. The two times above are single observations, not a speed-up figure.