what you get
how it is built
what it believes
what it believesTop ↑
B.O.S.S.

Who BOSS went and checked.

BOSS's positions come from two places. Most of them come from a couple of decades of building product — that half is the author's, and it is on the about page rather than this one. The rest is published work by people who had already worked something out, which BOSS went and read rather than guessed at. This page is that second list.

83 named sources, 42 of them marked key — meaning a practice would have to change if they turned out to be wrong. Names, what each one is for, and a link where there is one.

The one-line note beside a name is what BOSS took from them — a study pointer, not their endorsement and not their verbatim view. No agent in BOSS impersonates a person; mentors are archetypes that cite the practice, never someone's name.

▸the roll call

People

Practitioners and researchers whose published thinking is distilled into a practice BOSS ships.

  • Addy Osmanikey

    AI code review; the 70%-to-80% problem

    feature-flags git-workflow

  • Alan Alickovic — bulletproof-react

    shared → features → app unidirectional structure enforced with ESLint import/no-restricted-paths; the barrel-file caveat

    design-system

  • Amy Edmondsonkey

    psychological safety

    ai-adoption-culture

  • Andrej Karpathy — the verifiability thesiskey

    harness-engineering testing-with-agents

  • Bangaly Kabakey

    the best-retained-users method

    activation retention

  • Brad Frost — Atomic Designkey

    design-system

  • Brian Balfourkey

    retention is the engine, not a metric

    retention

  • Casey Winterskey

    activation > acquisition; the retention curve must flatten

    activation retention

  • Dex Horthy — 12-factor agentskey

    harness-engineering

  • Ethan Mollickkey

    'secret cyborgs' (2024)

    ai-adoption-culture

  • Hamel Husain + Shreya Shankarkey

    error analysis, evals-as-spec, judge validation

    analytics-for-ai-products testing-with-agents

  • Harry Dry — MarketingExampleskey

    'write with the delete key'; back a bold claim with proof

    landing-page

  • Jason Liu — systematically improving RAGkey

    recall@k first; inventory vs capability

    retrieval

  • Julian Shapirokey

    the value-prop table

    landing-page

  • Kyle Poyarkey

    usage-based pricing and expansion when usage tracks value

    monetization-in-practice

  • Lenny Rachitsky

    there is no retention silver bullet — it's the product

    retention

  • Lincoln Murphy

    involuntary churn

    retention

  • Martin Fowlerkey

    MonolithFirst (Fowler); ParallelChange (Danilo Sato, on Fowler's bliki)

    scalable-architecture ship-it-live

  • Martin Kleppmann — DDIAkey

    schema evolution

    data-schema

  • Marty Cagan (SVPG)key

    discovery vs documentation — why a written artifact is a means of deciding, not a deliverable

    documentation

  • Michael Nygard — Documenting Architecture Decisionskey

    the architecture decision record (2011) — the direct ancestor of BOSS's DEC-NNN: short, dated, superseded rather than edited

    documentation

  • Nathan Curtis — design tokenskey

    design-system

  • Patrick Campbell / ProfitWellkey

    involuntary churn is 20-40% of the total and the most recoverable

    monetization-in-practice retention

  • Paul Grahamkey

    do things that don't scale

    activation

  • Simon Willisonkey

    the lethal trifecta; Agents Rule of Two; classifiers are non-deterministic; MCP prompt injection

    agent-security mcp ship-it-live

  • TianPan — AI product metrics

    TCR, retained-character rate, frustration index

    analytics-for-ai-products

Labs, companies & projects

Engineering writing, open-source projects and published guidelines BOSS builds on.

  • 37signals

    clarity, not cleverness

    landing-page

  • a16z / Tomasz Tunguz

    the margin trap — cost scales with engagement; the AI-'tourist' churn wave

    monetization-in-practice retention

  • Ada Lovelace Institutekey

    advanced-AI-assistant relationship harms

    harm-taxonomy

  • Anthropic — the Agent Skills spec and templatekey

    skill-authoring

  • Anthropic — Unified Harm Frameworkkey

    the 5 harm dimensions

    harm-taxonomy

  • Anthropic containment + Redwood control

    agent-security

  • Anthropic engineeringkey

    effective harnesses for long-running agents; scaling managed agents; the agent-computer interface; contextual retrieval

    documentation harness-engineering retrieval

  • Chroma — context rotkey

    retrieval

  • Chromatic

    visual snapshot per story; accept-as-baseline as the governance step

    design-system

  • ConfigCat

    flags as a vibe-coding safety net

    feature-flags

  • Demand Curve / CXL

    above-the-fold, clarity over cleverness

    landing-page

  • Factory.ai

    documented conventions rot; enforced conventions compound

    scalable-architecture

  • FTC — Operation AI Complykey

    AI washing as an enforced deceptive pattern — five actions, 2024-09-25; the DoNotPay final order (5-0, 2025-01-16)

    deceptive-patterns

  • GitHub Primer — contributor docs & ADRskey

    component lifecycle (drafts → main → deprecated), prop norms, children-as-API, one directory per component, deprecating props with a lint rule

    design-system

  • GitHub Spec Kit / AWS Kiro

    the spec-driven-development lineage

    harness-engineering

  • Google PAIR

    ai-ux-patterns

  • GrowthBook

    flag the model, not just the feature

    feature-flags

  • METR

    the developer perception gap

    git-workflow testing-with-agents

  • Microsoft HAX guidelines

    ai-ux-patterns

  • Nielsen Norman Group (2026)

    ai-ux-patterns

  • Omlet

    design-system adoption measured from static analysis of code — legacy usage, unused props, non-system components used most

    design-system

  • OX Security 2026

    62% of AI-built apps ship a critical vuln

    data-schema

  • PostHog — LLM analytics

    product + observability convergence

    analytics-for-ai-products

  • Radix Primitives

    the headless-primitive argument — behaviour and accessibility in the primitive, style from your system

    design-system

  • Shape of AI

    ai-ux-patterns

  • Shape Up

    circuit-breaker / appetite

    feature-flags

  • Shopify's modular monolith

    scalable-architecture

  • Superhuman — concierge onboarding

    onboarding done by hand for the first users

    activation

  • Unleash / LaunchDarkly

    trunk-based flags; flag-debt hygiene

    feature-flags

  • Veracode (2026 GenAI Code Security Report)

    insecure AI-generated code

    agent-security testing-with-agents

Research, reports & incidents

Papers, studies and the named failures BOSS designs against.

  • BetterUp Labs x Stanford — 'workslop'

    HBR 2025 + the 2026 OSF follow-on (n=962)

    ai-adoption-culture

  • Brooks, Huang, Kearney & Murray — PNAS 2014key

    investors preferred an identical pitch from a man; attractiveness moderated for men only

    harm-taxonomy

  • Camuffo et al. — the scientific-approach RCTkey

    validation buys faster quitting

    analytics-for-ai-products

  • CDT — Dark Patterns in AI Chatbots (2026)

    ai-ux-patterns deceptive-patterns

  • CVE-2025-48757 (Lovable/Supabase RLS class)

    data-schema ship-it-live

  • DORA / Accelerate

    ROI of AI-Assisted Software Development (2026.01)

    git-workflow ship-it-live

  • Haytham (arslan70) — system-evolution ADRs

    single-agent synthesis beats a split pipeline (8/4/0 vs 1/3/8); a score with no named evidence source is hallucinated

    harness-engineering testing-with-agents

  • How Coding Agents Fail Their Users (arXiv 2605.29442)

    20,574-session misalignment analysis

    testing-with-agents

  • Professional Software Developers Don't Vibe, They Control (arXiv 2512.14012)

    testing-with-agents

  • Quantifying Overclaiming Propensity in Frontier LLM Agents (OverclaimBench, arXiv 2609.20812)

    agents misreport their own review coverage (67.9% incomplete, 80.4% of those misleading)

    harness-engineering

  • Rule Taxonomy and Evolution in AI IDEs (Cai, Li, Liang, Li, Shahin — arXiv 2606.12231)

    83 projects / 7,310 rules / 99 practitioners — architectural constraints ranked first, repos hold formatting rules; before/after compliance figure, no control

    context-discipline

  • Stanford WORKBank / Human Agency Scalekey

    which tasks workers want automated vs augmented

    ai-adoption-culture

  • The MoltBook credential exposure

    data-schema ship-it-live

  • UXBench (Wang et al.)key

    what an LLM UX critique measurably repairs — feedback and scannability move, flow efficiency does not; preprint, grade as direction not magnitude

    design-system

  • Vaccaro et al., CHI'26

    generated code injects dark patterns

    ai-ux-patterns deceptive-patterns

  • zeroheight — Design Systems Report 2026key

    governance model split (51/31/13), adoption measured by only 41%, top challenges, AI use and worry — n=147 practitioners

    design-system

Standards & specifications

The specs and canonical documentation BOSS reads directly.

▸the other direction

Crediting BOSS is optional, and it stays optional

BOSS's own promise is that it never puts its name on your work — you ship it, your name's on it. That's a promise about taking credit, not about refusing to let anyone give it. So nothing is ever added automatically, and nothing appears anywhere your users see.

If you want to say it anyway, boss credit shows you one line for your README and --apply adds it. --remove takes it back out and leaves your own words exactly as they were.

what it adds — nothing more than this 
<!-- Builds, Or Stays Silent. ✦ -->
Made with [BOSS](https://oyeboss.build) — *Build Out Solid Stuff.*

The comment is one of BOSS's alternate full forms — a wink for whoever reads the source, rather than a badge.

And one thing worth saying out loud: BOSS writes a marked <!-- boss: --> comment into your CLAUDE.md so it can remove itself cleanly later. That marker is also findable by searching public repositories, which is honestly how anyone would know BOSS is being used at all. /welcome says so when you start, and boss remove takes it out along with everything else. Counting people who never agreed to be counted is surveillance, however public the data — so it's disclosed rather than discovered.

▸an open door

Got a better approach? Say so.

Everybody above is credited by name; the key ones are linked where a primary source exists. If you have a cool new idea or approach — a practice BOSS should know, a source it's missing, a place it's wrong — happy to collab. Hit Ajesh up on LinkedIn, or open an issue on GitHub.

How a claim gets in here, and the technical practices.