Trust
B.O.S.S.

Credits

Almost none of this is original.

BOSS is mostly a distillation of other people's published thinking, arranged so it arrives at the moment a founder needs it. That's the honest description of the product, and it means the people below are load-bearing rather than decorative. 44 named sources sit behind the practice shelf, and 20 of them are load-bearing enough to be marked key.

The one-line note beside a name is what BOSS took from them — a study pointer, not their endorsement and not their verbatim view. No agent in BOSS impersonates a person; mentors are archetypes that cite the practice, never someone's name.

▸the roll call

People

Practitioners and researchers whose published thinking is distilled into a practice BOSS ships.

Labs, companies & projects

Engineering writing, open-source projects and published guidelines BOSS builds on.

  • Anthropic — the Agent Skills spec and templatekey

    skill-authoring

  • Anthropic containment + Redwood control

    agent-security

  • Anthropic engineeringkey

    effective harnesses for long-running agents; scaling managed agents; the agent-computer interface; contextual retrieval

    harness-engineering retrieval documentation

  • Chroma — context rotkey

    retrieval

  • ConfigCat

    flags as a vibe-coding safety net

    feature-flags

  • Factory.ai

    documented conventions rot; enforced conventions compound

    scalable-architecture

  • GitHub Spec Kit / AWS Kiro

    the spec-driven-development lineage

    harness-engineering

  • Google PAIR

    ai-ux-patterns

  • GrowthBook

    flag the model, not just the feature

    feature-flags

  • METR

    the developer perception gap

    testing-with-agents git-workflow

  • Microsoft HAX guidelines

    ai-ux-patterns

  • Nielsen Norman Group (2026)

    ai-ux-patterns

  • OX Security 2026

    62% of AI-built apps ship a critical vuln

    data-schema

  • Shape of AI

    ai-ux-patterns

  • Shape Up

    circuit-breaker / appetite

    feature-flags

  • Shopify's modular monolith

    scalable-architecture

  • Unleash / LaunchDarkly

    trunk-based flags; flag-debt hygiene

    feature-flags

  • Veracode (Spring 2026)

    insecure AI-generated code

    agent-security testing-with-agents

Research, reports & incidents

Papers, studies and the named failures BOSS designs against.

  • CDT — Dark Patterns in AI Chatbots (2026)

    ai-ux-patterns

  • CVE-2025-48757 (Lovable/Supabase RLS class)

    data-schema ship-it-live

  • DORA / Accelerate

    ROI of AI-Assisted Software Development (2026.01)

    git-workflow ship-it-live

  • How Coding Agents Fail Their Users (arXiv 2605.29442)

    20,574-session misalignment analysis

    testing-with-agents

  • Professional Software Developers Don't Vibe, They Control (arXiv 2512.14012)

    testing-with-agents

  • The MoltBook credential exposure

    data-schema ship-it-live

  • Vaccaro et al., CHI'26

    generated code injects dark patterns

    ai-ux-patterns

Standards & specifications

The specs and canonical documentation BOSS reads directly.

▸the other direction

Crediting BOSS is optional, and it stays optional

BOSS's own promise is that it never puts its name on your work — you ship it, your name's on it. That's a promise about taking credit, not about refusing to let anyone give it. So nothing is ever added automatically, and nothing appears anywhere your users see.

If you want to say it anyway, boss credit shows you one line for your README and --apply adds it. --remove takes it back out and leaves your own words exactly as they were.

what it adds — nothing more than this 
<!-- Builds, Or Stays Silent. ✦ -->
Made with [BOSS](https://oyeboss.build) — *Build Out Solid Stuff.*

The comment is one of BOSS's alternate full forms — a wink for whoever reads the source, rather than a badge.

And one thing worth saying out loud: BOSS writes a marked <!-- boss: --> comment into your CLAUDE.md so it can remove itself cleanly later. That marker is also findable by searching public repositories, which is honestly how anyone would know BOSS is being used at all. /welcome says so when you start, and boss remove takes it out along with everything else. Counting people who never agreed to be counted is surveillance, however public the data — so it's disclosed rather than discovered.

▸citation debt

Naming everyone is right. Linking everyone is busywork.

Everybody above is credited by name. Only the 20 marked key owe a link — a named practitioner whose thinking is distilled directly into a practice, or a primary spec a reviewer would re-open. A supporting citation sitting behind one claim doesn't need a URL to have been honest.

For the key ones it matters, because an attribution without a URL is half a citation: it can't be cheaply re-checked when the practice comes up for review, the person can't be credited properly, and the next reader redoes a search someone already did. The verification work was already done — /vet goes to the primary source before it grades anything — and then the URL was thrown away.

So the rule now sits inside /vet: write down the URL you actually opened — not the thread that pointed at it. Each name becomes a link the moment its URL lands. Currently 19 of 20 key sources linked.

How a claim gets in here → · the technical practices →