References and Sources

This section lists the sources cited throughout the book. The numbered source index, ordered by source number, is the canonical bibliography: every inline citation of the form (N, author or organisation, year) links to the entry with that number. The index is grouped by category so that readers can locate European legislation, frameworks, incident reports, research on software development, AI-assisted coding, security and work, and practitioner literature quickly.

The bibliography was seeded from the bibliography of AI Developer (Book 12), which carries the entries of the earlier volumes. Every seeded entry was opened and checked against the primary text or a bibliographic record in the earlier volume. Sources added while this book is drafted are written in the reserved range of the chapter that cites them (N100+1 to N100+49) and verified against the primary page before release; sources that no chapter cites are removed before the book is merged to main.

Numbered source index

European legislation and policy

• Source [1]: European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj (accessed 2026-10-31). Articles are read in the consolidated text of 27 July 2026 (CELEX 02024R1689-20260727, documentary and without legal effect of its own), which includes the amendments of Regulation (EU) 2026/1744; the text as adopted is CELEX 32024R1689. Both were fetched from the Publications Office's Cellar service on 2026-11-14 with scripts/fetch_eu_law.py. Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When, Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [2]: European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. Available at: https://eur-lex.europa.eu/eli/reg/2022/2554/oj (accessed 2026-10-31). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built, Chapter 19: Regulation for Builders: What Applies When.

• Source [3]: European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. Available at: https://eur-lex.europa.eu/eli/dir/2022/2555/oj (accessed 2026-10-31). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When.

• Source [4]: European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj (accessed 2026-11-06). Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules, Chapter 8: Step 4 Specification: Write Down What Correct Means, Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When, Chapter 22: Failures and Anti-Patterns, Chapter 23: Two Builds, Step by Step: Nordvik Region and Hansa Mutual.

• Source [5]: European Parliament and Council of the European Union. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Regulation of 8 July 2026, Official Journal of the European Union, 24 July 2026. Available at: https://eur-lex.europa.eu/eli/reg/2026/1744/oj (accessed 2026-11-10). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 19: Regulation for Builders: What Applies When.

• Source [6]: European Parliament and Council of the European Union. Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). Official Journal of the European Union, L, 22 December 2023. Available at: https://eur-lex.europa.eu/eli/reg/2023/2854/oj (accessed 2026-11-10). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.

• Source [7]: Federal Republic of Germany. Betriebsverfassungsgesetz (BetrVG), section 87 (Mitbestimmungsrechte). Federal Ministry of Justice, gesetze-im-internet.de. Available at: https://www.gesetze-im-internet.de/betrvg/__87.html (accessed 2026-11-10). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 20: Should Everyone Build? A Debate.

• Source [8]: Swedish Parliament (Sveriges riksdag). Lag (1976:580) om medbestämmande i arbetslivet (Co-determination in the Workplace Act), sections 10 to 12. Svensk författningssamling 1976:580. Available at: https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-1976580-om-medbestammande-i_sfs-1976-580/ (accessed 2026-11-10). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs.

• Source [9]: Sveriges riksdag, Regeringskansliet. Cybersäkerhetslag (2025:1506). Svensk författningssamling, issued 11 December 2025, in force 15 January 2026; implements Directive (EU) 2022/2555 in part. Available at: https://data.riksdagen.se/dokument/sfs-2025-1506.html (accessed 2026-11-10). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When.

• Source [10]: Sveriges riksdag, Regeringskansliet. Lag (1976:580) om medbestämmande i arbetslivet (MBL), 10 to 12 §§. Svensk författningssamling. Available at: https://data.riksdagen.se/dokument/sfs-1976-580.html (accessed 2026-11-10). Referenced in: Chapter 20: Should Everyone Build? A Debate.

• Source [11]: European Parliament and Council of the European Union. Directive (EU) 2016/2102 on the accessibility of the websites and mobile applications of public sector bodies. Official Journal of the European Union L 327, 2 December 2016; Articles 1, 4, 5, 6 and 7 read (accessibility statement: Article 7; Article 5(4) refers to it). Available at: https://eur-lex.europa.eu/eli/dir/2016/2102/oj (accessed 2026-11-11). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [12]: European Commission (2024). Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework. Official Journal of the European Union. Articles 16 (ICT systems acquisition, development, and maintenance) and 17(1) (ICT change management, points (a) to (h), including (b) on the independence of the functions that approve changes) were read against the live text on 2026-11-11. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1774 (accessed 2026-11-11). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 19: Regulation for Builders: What Applies When.
• Source [13]: European Parliament and Council of the European Union (2014). Directive 2014/24/EU on public procurement and repealing Directive 2004/18/EC, Articles 18 (principles of procurement), 42 (technical specifications), 70 (conditions for performance of contracts) and 72 (modification of contracts during their term). Official Journal of the European Union L 94, 28 March 2014, p. 65. Articles read in the original adopted text as reproduced by the UK National Archives at https://www.legislation.gov.uk/eudr/2014/24/contents/adopted; official source: https://eur-lex.europa.eu/eli/dir/2014/24/oj (text accessed 2026-11-11; Articles 18(1), 42(4), 70 and 72(1) re-read in the EUR-Lex text on 2026-11-12). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [14]: European Parliament and Council of the European Union (2019). Directive (EU) 2019/882 on the accessibility requirements for products and services (European Accessibility Act), Articles 2 and 4. Official Journal of the European Union L 151, 7 June 2019, p. 70. Available at: https://eur-lex.europa.eu/eli/dir/2019/882/oj (accessed 2026-11-12; Articles 2, 4 and 24 and recital 46 read). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [15]: European Parliament and Council of the European Union (2009). Directive 2009/24/EC on the legal protection of computer programs (codified version), Articles 1(1) and 2(3). Official Journal of the European Union L 111, 5 May 2009, p. 16. Article 2(3) gives the employer the exclusive right to exercise all economic rights in a computer program created by an employee in the execution of duties or following the employer's instructions, unless the contract provides otherwise. Articles 1(2), 1(3) and 2(1) (ideas and principles unprotected, the author's own intellectual creation, the natural person as author) read in the EUR-Lex text on 2026-11-11. Available at: https://eur-lex.europa.eu/eli/dir/2009/24/oj (accessed 2026-11-11). Referenced in: Chapter 19: Regulation for Builders: What Applies When.
• Source [16]: Article 29 Data Protection Working Party (2017). Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (WP 248 rev.01). Adopted 4 April 2017, as last revised and adopted 4 October 2017 (the newsroom page lists 13 October 2017); guidance of the predecessor body of the European Data Protection Board, not binding law. Sets out nine criteria for processing likely to result in a high risk and states that in most cases processing meeting two criteria requires a DPIA, and in some cases one criterion suffices. Available at: https://ec.europa.eu/newsroom/article29/redirection/document/47711 (accessed 2026-11-14; full text read). Referenced in: Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs.
• Source [17]: European Data Protection Board (2020). Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, version 2.0, final version, 20 October 2020 (date as listed on the EDPB page). Available at: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-42019-article-25-data-protection-design-and_en (accessed 2026-11-14; the EDPB page was read, the guidelines text was not). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.

Frameworks, standards and taxonomies

• Source [18]: ISO/IEC/IEEE (2018). ISO/IEC/IEEE 29148:2018 Systems and software engineering: Life cycle processes: Requirements engineering. Second edition, 28 November 2018; gives guidance on applying the requirements processes of ISO/IEC/IEEE 15288 and 12207 and specifies the information items produced by them; the catalogue page was read in an earlier pass but returned HTTP 403 on re-check on 2026-11-11, and the text of the standard was not read, so the entry rests on the catalogue record; a revision is listed as in development. Available at: https://www.iso.org/standard/72089.html (accessed 2026-11-11). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know.
• Source [19]: World Wide Web Consortium (W3C) (2024). Web Content Accessibility Guidelines (WCAG) 2.2. W3C Recommendation, Accessibility Guidelines Working Group (editors Campbell, A., Adams, C., Bradley Montgomery, R., Cooper, M. & Kirkpatrick, A.); the version read is dated 12 December 2024. Organises success criteria under four principles (perceivable, operable, understandable, robust) with three conformance levels, A, AA and AAA. Available at: https://www.w3.org/TR/WCAG22/ (accessed 2026-11-14; the opening part of the document was read, not all success criteria). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions.

Threat assessments, agency guidance and incident reports

• Source [20]: U.S. Securities and Exchange Commission (2013). In the Matter of Knight Capital Americas LLC. Order Instituting Administrative and Cease-and-Desist Proceedings, Release No. 34-70694, File No. 3-15570, 16 October 2013. Available at: https://www.sec.gov/files/litigation/admin/2013/34-70694.pdf (accessed 2026-11-10). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 22: Failures and Anti-Patterns.
• Source [21]: Nx project (nrwl) (2025). Security advisory GHSA-cxm3-wv7p-598c: malicious versions of Nx and some supporting plugins were published. GitHub Security Advisory, posted 27 August 2025; primary advisory by the maintainers; describes a workflow injection weakness, the publication of malicious package versions on 26 August 2025, a post-install script that collected credentials, and remediation. Available at: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c (accessed 2026-11-11). Referenced in: Chapter 22: Failures and Anti-Patterns.

Agents, containment and AI incidents

• Source [22]: AI Incident Database (2025). Incident 1152: LLM-Driven Replit Agent Reportedly Executed Unauthorized Destructive Commands During Code Freeze, Leading to Loss of Production Data. Incident date 18 July 2025; a catalogue record that lists five press reports and no primary post-incident report. Available at: https://incidentdatabase.ai/cite/1152/ (accessed 2026-11-10). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 20: Should Everyone Build? A Debate, Chapter 22: Failures and Anti-Patterns.

• Source [23]: Perry, N., Srivastava, M., Kumar, D. & Boneh, D. (2023). Do Users Write More Insecure Code with AI Assistants? Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23); arXiv:2211.03622. Available at: https://arxiv.org/abs/2211.03622 (accessed 2026-11-10). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 20: Should Everyone Build? A Debate, Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [24]: Kim, E., Garg, A., Peng, K. & Garg, N. (2025). Correlated Errors in Large Language Models. ICML 2025; arXiv:2506.07962. Available at: https://arxiv.org/abs/2506.07962 (accessed 2026-11-10). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion.

• Source [25]: Panickssery, A., Bowman, S. R. & Feng, S. (2024). LLM Evaluators Recognize and Favor Their Own Generations. arXiv:2404.13076. Available at: https://arxiv.org/abs/2404.13076 (accessed 2026-11-10). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.

• Source [26]: Nagli, G. (2026). Hacking Moltbook: The AI Social Network Any Human Can Control. Wiz Blog, 2 February 2026; primary report by a security vendor's researcher on a data exposure in a web application whose founder said he had not written a line of its code; gives the mechanism (a database key in the page code and no row-level security policies), the counts of records exposed, the write-access finding and a dated disclosure and fix timeline. Available at: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys (accessed 2026-11-14; page read). Referenced in: Chapter 22: Failures and Anti-Patterns.
• Source [27]: Palmer, M. (2025). Statement on CVE-2025-48757. mattpalmer.io, 29 May 2025; the researcher's own account, a party's statement and not a neutral report: a scan of 1,645 sites listed in an app builder's public showcase, of which 303 endpoints across 170 projects had inadequate row-level security, with his disclosure timeline from 21 March 2025; the vendor's own account was not opened and the page is internally inconsistent on whether the vendor replied to the first email. Available at: https://mattpalmer.io/posts/statement-on-CVE-2025-48757/ (accessed 2026-11-14; page read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 22: Failures and Anti-Patterns.

AI adoption, productivity and automation research

• Source [28]: Harvey, N. & DeBellis, D. (2025). Announcing the 2025 DORA Report: State of AI-Assisted Software Development. Google Cloud Blog, 23 September 2025. Available at: https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report (accessed 2026-11-10). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register.

• Source [29]: Goddard, K., Roudsari, A. & Wyatt, J. C. (2012). Automation bias: a systematic review of frequency, effect mediators, and mitigators. Journal of the American Medical Informatics Association 19(1), 121-127. DOI: 10.1136/amiajnl-2011-000089 (accessed 2026-11-10). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.

• Source [30]: Buçinca, Z., Malaya, M. B. & Gajos, K. Z. (2021). To Trust or to Think: Cognitive Forcing Functions Can Reduce Overreliance on AI in AI-assisted Decision-making. Proceedings of the ACM on Human-Computer Interaction 5(CSCW1); arXiv:2102.09692. DOI: 10.1145/3449287 (accessed 2026-11-10). Referenced in: Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [31]: Anthropic. Model deprecations. Claude Platform documentation. Available at: https://platform.claude.com/docs/en/about-claude/model-deprecations (accessed 2026-11-10). Provider documentation. Referenced in: Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset.

• Source [32]: Gillespie, N., Lockey, S., Ward, T., Macdade, A. & Hassed, G. (2025). Trust, Attitudes and Use of Artificial Intelligence: A Global Study 2025. The University of Melbourne and KPMG. Online survey of more than 48,000 people in 47 countries (employees n=32,352), data collected November 2024 to January 2025; funded by KPMG, self-reported data. DOI: 10.26188/28822919; global report available at: https://kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf.coredownload.inline.pdf (accessed 2026-11-11; full report read). Referenced in: Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate.

• Source [33]: IBM (2025). 2025 Cost of a Data Breach Report. IBM, research by the Ponemon Institute; research on 600 organisations (the page read does not say how they were selected or that all had been breached). Reports that 63 per cent of the surveyed organisations had no AI governance policies to manage AI or prevent shadow AI, and that a high level of shadow AI added USD 670,000 to the global average breach cost. Industry research; the page read does not describe the method. Available at: https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai (accessed 2026-11-11; the IBM page was read, the report was not). Referenced in: Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register.

Workforce, skills and automation research

• Source [34]: SFIA Foundation (2024). SFIA 9: the global skills and competency framework for the digital world. Released October 2024. Available at: https://sfia-online.org/en/sfia-9 (accessed 2026-11-10). Referenced in: Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [35]: Parasuraman, R., Sheridan, T. B. & Wickens, C. D. (2000). A model for types and levels of human interaction with automation. IEEE Transactions on Systems, Man, and Cybernetics, Part A: Systems and Humans 30(3), 286-297. DOI: 10.1109/3468.844354 (accessed 2026-11-10). Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test.

• Source [36]: Becker, J., Rush, N., Barnes, E. & Rein, D. (2025). Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. arXiv:2507.09089, submitted 12 July 2025, revised 25 July 2025. Available at: https://arxiv.org/abs/2507.09089 (accessed 2026-11-10). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 20: Should Everyone Build? A Debate, Chapter 21: From Builder to Developer: Learning, Competence and Career, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion.

• Source [37]: Bastani, H., Bastani, O., Sungu, A., Ge, H., Kabakcı, Ö. & Mariman, R. (2025). Generative AI without guardrails can harm learning: Evidence from high school mathematics. Proceedings of the National Academy of Sciences 122(26), e2422633122. DOI: 10.1073/pnas.2422633122 (accessed 2026-11-10). Referenced in: Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [38]: Shen, J. H. & Tamkin, A. (2026). How AI Impacts Skill Formation. arXiv:2601.20245, submitted 28 January 2026, revised 1 February 2026 (preprint, not peer reviewed). Available at: https://arxiv.org/abs/2601.20245 (accessed 2026-11-10). Referenced in: Chapter 3: What Developers Do: The Gap Described, Chapter 21: From Builder to Developer: Learning, Competence and Career.

Books and practitioner literature

• Source [39]: Lunney, J. & Lueder, S. (2017). Postmortem Culture: Learning from Failure. Chapter 15 in Beyer, B., Jones, C., Petoff, J. & Murphy, N. R. (eds), Site Reliability Engineering: How Google Runs Production Systems; edited by G. O'Connor. O'Reilly Media and Google, online edition. Available at: https://sre.google/sre-book/postmortem-culture/ (accessed 2026-11-10). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.

• Source [40]: Atlassian (2022). Post-Incident Review on the Atlassian April 2022 outage. Atlassian Engineering, How We Build, 29 April 2022. Primary post-incident report by the operator of the affected service. Available at: https://www.atlassian.com/blog/how-we-build/post-incident-review-april-2022-outage (accessed 2026-11-10). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.

• Source [41]: Kwa, T., West, B., Becker, J., Deng, A., Garcia, K., Hasin, M., Jawhar, S., Kinniment, M., Rush, N., Von Arx, S., Bloom, R., Broadley, T., Du, H., Goodrich, B., Jurkovic, N., Miles, L. H., Nix, S., Lin, T., Painter, C., Parikh, N., Rein, D., Sato, L. J. K., Wijk, H., Ziegler, D. M., Barnes, E. & Chan, L. (2025). Measuring AI Ability to Complete Long Tasks (arXiv title in current version: Measuring AI Ability to Complete Long Software Tasks). METR; arXiv:2503.14499, first submitted 18 March 2025; NeurIPS 2025. Available at: https://arxiv.org/abs/2503.14499 (accessed 2026-11-10). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.

• Source [42]: Lee, H.-P., Sarkar, A., Tankelevitch, L., Drosos, I., Rintel, S., Banks, R. & Wilson, N. (2025). The Impact of Generative AI on Critical Thinking: Self-Reported Reductions in Cognitive Effort and Confidence Effects From a Survey of Knowledge Workers. Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, Article 1121. DOI: 10.1145/3706598.3713778 (accessed 2026-11-11). Referenced in: Chapter 20: Should Everyone Build? A Debate, Chapter 21: From Builder to Developer: Learning, Competence and Career.

• Source [43]: Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S. R. et al. (2023). Towards Understanding Sycophancy in Language Models. arXiv:2310.13548, submitted 20 October 2023. Available at: https://arxiv.org/abs/2310.13548 (accessed 2026-11-11). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 8: Step 4 Specification: Write Down What Correct Means.
• Source [44]: Nygard, M. (2011). Documenting Architecture Decisions. Cognitect blog, 15 November 2011. Available at: https://www.cognitect.com/blog/2011/11/15/documenting-architecture-decisions (accessed 2026-11-11). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset.
• Source [45]: European Commission. AI Literacy: Questions and Answers. Shaping Europe's digital future, page last updated 20 October 2026; Commission guidance in question-and-answer form on Article 4 of Regulation (EU) 2024/1689. Available at: https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers (accessed 2026-11-11). Referenced in: Chapter 19: Regulation for Builders: What Applies When, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion.
• Source [46]: Sveriges riksdag. Kommunallag (2017:725), 5 kap. 1 §, 6 kap. 1 §, 6 kap. 37 and 38 §§ and 12 kap. 1 §. Svensk författningssamling 2017:725. Available at: https://lagen.nu/2017:725 (accessed 2026-11-11; consolidated text read at lagen.nu, the Riksdag page returned an error). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [47]: Muller, J. Z. (2018). The Tyranny of Metrics. Princeton University Press, 6 February 2018. ISBN 978-0-691-17495-2. Available at: https://press.princeton.edu/books/hardcover/9780691174952/the-tyranny-of-metrics (accessed 2026-11-11). Referenced in: Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations.
• Source [48]: European Commission, Community of Practice on the Procurement of AI (2025). Updated EU AI model contractual clauses now available. Public Buyers Community, news item of 5 March 2025; model clauses for the procurement of high-risk and non-high-risk AI that buyers can use and customise (the page does not state their legal status), first published 29 September 2023. Available at: https://public-buyers-community.ec.europa.eu/communities/procurement-ai/news/updated-eu-ai-model-contractual-clauses-now-available (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [49]: Rechtbank Den Haag (2020). Judgment of 5 February 2020, NJCM c.s. v the State of the Netherlands (SyRI), ECLI:NL:RBDHA:2020:1878 (English version of ECLI:NL:RBDHA:2020:865). Available at: https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBDHA:2020:1878 (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [50]: Sveriges riksdag, Regeringskansliet. Arkivlag (1990:782), 3, 4, 6 and 10 §§. Svensk författningssamling 1990:782, text as published by the Riksdag. Available at: https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/arkivlag-1990782_sfs-1990-782/ (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [51]: European Parliament and Council of the European Union (2014). Directive 2014/24/EU on public procurement and repealing Directive 2004/18/EC, Article 67 (Contract award criteria). Official Journal of the European Union L 94, 28 March 2014. Article 67 read in the original adopted text as reproduced by the UK National Archives at https://www.legislation.gov.uk/eudr/2014/24/article/67/adopted; official source: https://eur-lex.europa.eu/eli/dir/2014/24/oj (Article 67(1) to (4) re-read in the EUR-Lex text on 2026-11-12). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [52]: Gray, J. (2006). A Conversation with Werner Vogels. ACM Queue, 2006; interview of Amazon's chief technology officer, containing the sentence "You build it, you run it". Available at: https://queue.acm.org/detail.cfm?id=1142065 (accessed 2026-11-11; the page returned an access error from the review environment; the wording and the interview (Jim Gray with Werner Vogels) were confirmed from search-result excerpts, and the sentence "You build it, you run it" from the AWS news blog post that quotes the interview (AWS news blog), so re-read the ACM page before print). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.
• Source [53]: Delimarsky, D. (2025). Spec-driven development with AI: Get started with a new open source toolkit. GitHub Blog, 2 September 2025; a vendor description of the Spec Kit workflow (specify, plan, tasks, implement), not an evaluation of its outcomes. Available at: https://github.blog/ai-and-ml/generative-ai/spec-driven-development-with-ai-get-started-with-a-new-open-source-toolkit/ (accessed 2026-11-11). Referenced in: Chapter 8: Step 4 Specification: Write Down What Correct Means.
• Source [54]: Saltzer, J. H. & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE 63(9), 1278-1308. DOI: 10.1109/PROC.1975.9939 (accessed 2026-11-11; bibliographic record confirmed through search results, the design principles read in secondary summaries, the IEEE page returned no text). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions.
• Source [55]: Merriam-Webster. Vibe coding. Merriam-Webster "Slang and Trending" entry; defines the term and attributes it to Andrej Karpathy, social media post of 2 February 2025; the entry is marked "Last Updated: 4 Jun 2026". Available at: https://www.merriam-webster.com/slang/vibe-coding (accessed 2026-11-11). Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 25: Conclusion.
• Source [56]: Anthropic (2025). Effective context engineering for AI agents. Anthropic Engineering, 29 September 2025; vendor engineering guidance, not a controlled study. Available at: https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents (accessed 2026-11-11). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [57]: Warner, A., Davidovič, Š., Hidalgo, A., Beyer, B., Smith, K. & Duftler, M. (2018). Canarying Releases. Chapter 16 in The Site Reliability Workbook, O'Reilly Media, 2018. Defines canarying as a partial and time-limited deployment of a change and its evaluation, with a control population, and advises absolute measures such as service level objectives beside relative comparison. Available at: https://sre.google/workbook/canarying-releases/ (accessed 2026-11-11). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [58]: Sato, D. (2014). Parallel Change. martinfowler.com bliki, 13 May 2014. Describes the expand, migrate and contract phases for backward-incompatible changes to an interface. Available at: https://martinfowler.com/bliki/ParallelChange.html (accessed 2026-11-11). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [59]: Niemen, G. (2020). How We Use Golden Paths to Solve Fragmentation in Our Software Ecosystem. Spotify Engineering, 17 August 2020. Defines the Golden Path as the opinionated and supported path to build something, states that its aim is not to limit engineers, and notes that engineers may leave it with less support. Available at: https://engineering.atspotify.com/2020/08/how-we-use-golden-paths-to-solve-fragmentation-in-our-software-ecosystem/ (accessed 2026-11-11). Referenced in: Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register.
• Source [60]: Wiggins, A. The Twelve-Factor App: V. Build, release, run. 12factor.net; practitioner statement of practice for services run in the cloud. States that the app uses strict separation between the build, release and run stages, that a release cannot be mutated once created and any change must create a new release, and that deployment tools typically offer rollback to a previous release. The page states no date. Available at: https://12factor.net/build-release-run (accessed 2026-11-14). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [61]: Preston-Werner, T. Semantic Versioning 2.0.0. semver.org; specification of the MAJOR.MINOR.PATCH convention. States that once a versioned package has been released the contents of that version must not be modified, and that any change must be released as a new version. The page states no date. Available at: https://semver.org/spec/v2.0.0.html (accessed 2026-11-14). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [62]: Lacan, O. Keep a Changelog, version 1.1.0. keepachangelog.com; convention for a human-readable changelog. Gives the guiding principles (for humans, an entry for every version, release date shown, mention of Semantic Versioning) and the change types Added, Changed, Deprecated, Removed, Fixed and Security. The page states no date for version 1.1.0. Available at: https://keepachangelog.com/en/1.1.0/ (accessed 2026-11-14). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [63]: Wiggins, A. The Twelve-Factor App: XI. Logs. 12factor.net; practitioner statement of practice. Treats logs as a stream of events written to standard output and routed and stored by the execution environment, not by the app. The page states no date. Available at: https://12factor.net/logs (accessed 2026-11-14). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.
• Source [64]: GitLab (2017). Postmortem of database outage of January 31. GitLab blog, published 10 February 2017; primary post-incident report by the operator of the affected service. Reports accidental removal of data from the primary database server, a backup procedure whose tool version did not match the database, unnoticed failures because alert emails were rejected, an empty backup storage location, a best available copy about six hours old, about 18 hours of copying to restore, and about 5,000 projects, 5,000 comments and 700 user accounts affected. Available at: https://about.gitlab.com/blog/postmortem-of-database-outage-of-january-31/ (accessed 2026-11-14). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.
• Source [65]: Ewaschuk, R. (2017). Monitoring Distributed Systems. In Beyer, B., Jones, C., Petoff, J. & Murphy, N. R. (eds), Site Reliability Engineering: How Google Runs Production Systems, chapter 6; edited by B. Beyer; O'Reilly Media and Google, online edition. Defines the four golden signals (latency, traffic, errors, saturation) and advises paging a person when one is problematic and putting more effort into symptoms than causes. Available at: https://sre.google/sre-book/monitoring-distributed-systems/ (accessed 2026-11-14). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.
• Source [66]: Stribblehill, A. (2017). Managing Incidents. In Beyer, B., Jones, C., Petoff, J. & Murphy, N. R. (eds), Site Reliability Engineering: How Google Runs Production Systems, chapter 14; edited by K. Guliani; O'Reilly Media and Google, online edition. Describes incident command, operational work, communication and planning roles, and the priority to stop the bleeding, restore service and preserve evidence. Available at: https://sre.google/sre-book/managing-incidents/ (accessed 2026-11-14). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.
• Source [67]: Anthropic. Rate limits. Claude Platform documentation; vendor documentation, undated. Describes monthly spend limits per organisation tier, spend limits that the customer can set below the cap, per-workspace limits, and that requests stop when a limit is reached. Cited as one example of a pattern, not as a recommendation. Available at: https://platform.claude.com/docs/en/api/rate-limits (accessed 2026-11-14). Referenced in: Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built.

Leadership, management and organisation research

Decision-making, automation bias and cognition

Work, employment and labour law

Public administration and accountability

• Source [68]: Sveriges riksdag. Förvaltningslag (2017:900). Svensk författningssamling, in force 1 July 2018 (sections 30 to 32 and section 2 read in the version amended to SFS 2025:582). Available at: https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/forvaltningslag-2017900_sfs-2017-900/ (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [69]: Sveriges riksdag. Tryckfrihetsförordning (1949:105). Svensk författningssamling, Chapter 2 (sections 3 to 10 read: 3, 4, 9 and 10 define a public document). Available at: https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/tryckfrihetsforordning-1949105_sfs-1949-105/ (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [70]: Sveriges riksdag. Skadeståndslag (1972:207) (Tort Liability Act), 3 kap. 2 § (liability of the State or a municipality for fault in the exercise of public authority) and 4 kap. 1 § (liability of employees). Svensk författningssamling 1972:207. Available at: https://data.riksdagen.se/dokument/sfs-1972-207.html (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [71]: Autoriteit Persoonsgegevens (2020). Belastingdienst/Toeslagen: De verwerking van de nationaliteit van aanvragers van kinderopvangtoeslag. Onderzoeksrapport z2018-22445, July 2020 (in Dutch; summary read: three kinds of processing of nationality found unlawful), published as an attachment to a letter to the Tweede Kamer. Available at: https://zoek.officielebekendmakingen.nl/blg-945542.pdf (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [72]: Prime Minister of Australia (2023). Final report of the Royal Commission into the Robodebt Scheme. Media statement, 7 July 2023. A government statement that quotes the Royal Commission's overview (including 'a crude and cruel mechanism, neither fair nor legal') and states that the Federal Court found the scheme unlawful in late 2019 (a declaration made by consent orders in Amato v Commonwealth, 27 November 2019, per secondary sources); the report itself was not opened. Available at: https://www.pm.gov.au/media/final-report-royal-commission-robodebt-scheme (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [73]: Regeringen (2026). Regeringens proposition 2026/27:12 En ny produktansvarslag. Proposition to the Riksdag dated 15 October 2026; proposes a new product liability act to implement Directive (EU) 2024/2853, in force 1 January 2027; the bill was read, the Riksdag's decision was not. Available at: https://data.riksdagen.se/dokument/HE0312.html (accessed 2026-11-11). Referenced in: Chapter 19: Regulation for Builders: What Applies When.

The Transformed Architecture and the author

• Source [74]: Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. Available at: https://aac.geon.se/ (accessed 2026-10-31). Referenced in: Chapter 3: What Developers Do: The Gap Described, Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules, Chapter 8: Step 4 Specification: Write Down What Correct Means, About the Author.

• Source [75]: Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. Available at: https://aig.geon.se/ (accessed 2026-11-01). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When, Chapter 21: From Builder to Developer: Learning, Competence and Career, About the Author.

• Source [76]: Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Transformed Architecture, Book 3. Available at: https://aips.geon.se (accessed 2026-11-01). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: About the Author.

• Source [77]: Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. Available at: https://aired.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: About the Author.

• Source [78]: Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5, published at aithreat.geon.se. Available at: https://aithreat.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 21: From Builder to Developer: Learning, Competence and Career, About the Author.

• Source [79]: Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. Available at: https://tsa.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: About the Author.

• Source [80]: Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. Available at: https://aiboss.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 21: From Builder to Developer: Learning, Competence and Career, About the Author.

• Source [81]: Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. The Transformed Architecture, Book 8, published at aiblue.geon.se. Available at: https://aiblue.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: About the Author.

• Source [82]: Nordqvist, G. (2026). AI Purple: How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities. The Transformed Architecture, Book 9, published at aipurple.geon.se. Available at: https://aipurple.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, About the Author.

• Source [83]: Nordqvist, G. (2026). AI Operations: How Artificial Intelligence Transforms IT Operations in European Enterprises and Public Authorities. The Transformed Architecture, Book 10, published at aiops.geon.se. Available at: https://aiops.geon.se/ (accessed 2026-11-11). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built, About the Author.

• Source [84]: Kvadrat AB. Kvadrat: Sveriges vassaste konsulter (site title); "Vi är Sveriges största nätverk av egenföretagare" (home page, Sweden's largest network of self-employed persons). Available at: https://www.kvadrat.se/ (accessed 2026-10-31; company self-description, not independently verified). Referenced in: About the Author.

European legislation and case law

Company law and director liability

The Transformed Architecture (Book 11)

• Source [85]: Nordqvist, G. (2026). AI Leader: How Leadership Roles Change When AI Is Used Broadly in European Enterprises and Public Authorities. The Transformed Architecture, Book 11, published at leader.geon.se. Available at: https://leader.geon.se/ (accessed 2026-11-11). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset, Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When, Chapter 20: Should Everyone Build? A Debate, Chapter 21: From Builder to Developer: Learning, Competence and Career, About the Author.

The Transformed Architecture (Book 12)

• Source [86]: Nordqvist, G. (2026). AI Developer: How the Developer Role Changes When AI Is Used Broadly in European Enterprises and Public Authorities. The Transformed Architecture, Book 12, published at developer.geon.se. Available at: https://developer.geon.se/ (accessed 2026-11-14). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules, Chapter 8: Step 4 Specification: Write Down What Correct Means, Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 14: Step 10 Run: Watching, Backing Up, Paying for and Supporting What You Built, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset, Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy, Chapter 19: Regulation for Builders: What Applies When, Chapter 20: Should Everyone Build? A Debate, Chapter 21: From Builder to Developer: Learning, Competence and Career, Chapter 22: Failures and Anti-Patterns, Chapter 23: Two Builds, Step by Step: Nordvik Region and Hansa Mutual, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion, Glossary, Appendix A: Code Examples: The Artefacts of the Twelve Steps, Appendix B: Templates and Tools, About the Author.

Software engineering and AI-assisted development evidence

• Source [87]: Peng, S., Kalliamvakou, E., Cihon, P. & Demirer, M. (2023). The Impact of AI on Developer Productivity: Evidence from GitHub Copilot. arXiv:2302.06590, submitted 13 February 2023. Controlled experiment in which developers were asked to write an HTTP server in JavaScript. Available at: https://arxiv.org/abs/2302.06590 (accessed 2026-11-11). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [88]: Cui, Z. (K.), Demirer, M., Jaffe, S., Musolff, L., Peng, S. & Salz, T. (2024). The Effects of Generative AI on High-Skilled Work: Evidence from Three Field Experiments with Software Developers. SSRN 4945566; later published in Management Science 72(11), 9408-9420, 2026 (DOI: 10.1287/mnsc.2025.00535). Randomised field experiments at Microsoft, Accenture and an anonymous Fortune 100 company with 4,867 developers; the abstract reports a pooled 26.08 per cent increase in completed tasks (standard error 10.3 per cent; results vary across experiments). Available at: https://papers.ssrn.com/abstract=4945566 (accessed 2026-11-11; the SSRN and Microsoft Research abstract pages and a MIT Sloan summary were read; the figures in Chapter 7, including commit, build and experiment-by-experiment estimates, were checked against the full text of the February 2025 working-paper draft hosted by MIT Economics, economics.mit.edu/sites/default/files/inline-files/draft_copilot_experiments.pdf; the published Management Science text was not opened). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [89]: Barr, E. T., Harman, M., McMinn, P., Shahbaz, M. & Yoo, S. (2015). The Oracle Problem in Software Testing: A Survey. IEEE Transactions on Software Engineering 41(5), 507-525. DOI: 10.1109/TSE.2014.2372785. Available at: https://doi.org/10.1109/TSE.2014.2372785 (accessed 2026-11-11; bibliographic record read through Crossref and an open-access copy at UCL Discovery). Referenced in: Chapter 3: What Developers Do: The Gap Described, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 8: Step 4 Specification: Write Down What Correct Means, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [90]: Bird, C., Nagappan, N., Murphy, B., Gall, H. & Devanbu, P. (2011). Don't Touch My Code! Examining the Effects of Ownership on Software Quality. Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering (ESEC/FSE '11), 4-14. DOI: 10.1145/2025113.2025119. Available at: https://doi.org/10.1145/2025113.2025119 (accessed 2026-11-11; bibliographic record read through Crossref, abstract through the Microsoft Research listing; only the abstract-level finding is cited). Referenced in: Chapter 3: What Developers Do: The Gap Described, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset.
• Source [91]: Naur, P. (1985). Programming as Theory Building. Microprocessing and Microprogramming 15(5), 253-261. DOI: 10.1016/0165-6074(85)90032-8. An essay and an argument, not an empirical study. Available at: https://doi.org/10.1016/0165-6074(85)90032-8 (accessed 2026-11-11; bibliographic record read through Crossref; the essay text read in a mirror, which confirms that the programmers' theory has primacy over the program text, that documentation does not carry it and that revival is the rebuilding of the theory by a new team). Referenced in: Chapter 3: What Developers Do: The Gap Described, Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset, Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers.
• Source [92]: Dhar, R., Vaidhyanathan, K. & Varma, V. (2024). Can LLMs Generate Architectural Design Decisions? An Exploratory Empirical Study. IEEE International Conference on Software Architecture (ICSA 2024), research track; arXiv:2403.01709, submitted 4 March 2024. Available at: https://arxiv.org/abs/2403.01709 (accessed 2026-11-11; abstract read). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions.
• Source [93]: Paradis, E., Grey, K., Madison, Q., Nam, D., Macvean, A., Meimand, V., Zhang, N., Ferrari-Church, B. & Chandra, S. (2024). How much does AI impact development speed? An enterprise-based randomized controlled trial. Google; arXiv:2410.12944, submitted 16 October 2024, revised 11 November 2024. Randomised controlled trial with 96 full-time Google software engineers on one enterprise-grade task, summer 2024. Available at: https://arxiv.org/abs/2410.12944 (accessed 2026-11-11; full text read). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [94]: METR (Becker, J., Rush, N., Cunningham, T., Rein, D. & Mahamud, K.) (2026). We are Changing our Developer Productivity Experiment Design. METR blog, 24 February 2026; update to the randomised trial of early-2025 AI tools; reports 57 developers, 143 repositories and more than 800 tasks, and states that the data from the follow-up study gave an unreliable signal of the current effect because of selection effects (developers declining to work without AI or withholding tasks) and that the study design is being changed. Available at: https://metr.org/blog/2026-02-24-uplift-update/ (accessed 2026-11-11; page read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 20: Should Everyone Build? A Debate, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion.
• Source [95]: Liu, N. F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F. & Liang, P. (2023). Lost in the Middle: How Language Models Use Long Contexts. arXiv:2307.03172, July 2023; accepted to Transactions of the Association for Computational Linguistics. Available at: https://arxiv.org/abs/2307.03172 (accessed 2026-11-11; abstract read). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [96]: Bacchelli, A. & Bird, C. (2013). Expectations, Outcomes, and Challenges of Modern Code Review. Proceedings of the 35th International Conference on Software Engineering (ICSE 2013), pp. 712-721. DOI: 10.1109/ICSE.2013.6606617. Observation, interviews and a survey of developers and managers at Microsoft, with manual classification of hundreds of review comments. Available at: https://doi.org/10.1109/ICSE.2013.6606617 (accessed 2026-11-11; abstract read on the Microsoft Research publication page and bibliographic record confirmed through Crossref, the full text was not read). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [97]: Sadowski, C., Söderberg, E., Church, L., Sipko, M. & Bacchelli, A. (2018). Modern Code Review: A Case Study at Google. Proceedings of the 40th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP 2018), pp. 181-190. DOI: 10.1145/3183519.3183525. Exploratory study with 12 interviews, a survey of 44 respondents and an analysis of review logs covering about 9 million reviewed changes. Available at: https://research.google/pubs/modern-code-review-a-case-study-at-google/ (accessed 2026-11-11; the abstract and study design were read, the full text was not). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [98]: Czerwonka, J., Greiler, M. & Tilford, J. (2015). Code Reviews Do Not Find Bugs: How the Current Code Review Best Practice Slows Us Down. Proceedings of the 37th International Conference on Software Engineering, volume 2 (ICSE 2015, short paper), pp. 27-28. DOI: 10.1109/ICSE.2015.131. Short position paper from Microsoft. Available at: https://www.microsoft.com/en-us/research/?p=168182 (accessed 2026-11-11; bibliographic record confirmed through Crossref and a summary of the abstract read on the Microsoft Research publication page, the full text was not read; the page's summary does not support a claim about the duration of review). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [99]: Liu, J., Xia, C. S., Wang, Y. & Zhang, L. (2023). Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generation. arXiv:2305.01210, submitted 2 May 2023, last revised 30 October 2023 (NeurIPS 2023 according to the authors' project). Extends the HumanEval benchmark's test cases by a factor of 80 (HumanEval+); the abstract reports that pass@k of the evaluated models falls by up to 19.3 to 28.9 per cent. Available at: https://arxiv.org/abs/2305.01210 (accessed 2026-11-11; the abstract was read, the full text was not). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [100]: Petrović, G., Ivanković, M., Fraser, G. & Just, R. (2021). Does Mutation Testing Improve Testing Practices? Proceedings of the 43rd International Conference on Software Engineering (ICSE 2021), pp. 910-921; arXiv:2103.07189. Analysis of about 15 million mutants in Google's code review process. Available at: https://arxiv.org/abs/2103.07189 (accessed 2026-11-11; the abstract was read through the arXiv record and the authors' page). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [101]: Foster, C., Gulati, A., Harman, M., Harper, I., Mao, K., Ritchey, J., Robert, H. & Sengupta, S. (2025). Mutation-Guided LLM-based Test Generation at Meta. arXiv:2501.12862, submitted 22 January 2025 (the arXiv listing states "Submitted to FSE 2025 Industry Track"). Describes the ACH system: 10,795 Android Kotlin classes, 9,095 mutants, 571 privacy-hardening tests; engineers accepted 73 per cent of the generated tests in test-a-thons and judged 36 per cent privacy-relevant. Available at: https://arxiv.org/abs/2501.12862 (accessed 2026-11-11; the abstract was read, the full text was not). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [102]: Borg, M., Hewett, D., Hagatulah, N., Couderc, N., Söderberg, E., Graham, D., Kini, U. & Farley, D. (2025). Echoes of AI: Investigating the Downstream Effects of AI Assistants on Software Maintainability. arXiv:2507.00788, first submitted 1 July 2025, latest revision February 2026. Two-phase controlled experiment with 151 participants, 95 per cent of them professional developers; phase 2 is a randomised trial with 75 completers who evolved the phase 1 solutions without AI assistance. Available at: https://arxiv.org/abs/2507.00788 (accessed 2026-11-11; abstract and the measures and limitations sections read). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 25: Conclusion.
• Source [103]: Just, R., Jalali, D., Inozemtseva, L., Ernst, M. D., Holmes, R. & Fraser, G. (2014). Are Mutants a Valid Substitute for Real Faults in Software Testing? Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE 2014), 654-665. Available at: https://homes.cs.washington.edu/~mernst/pubs/mutation-effectiveness-fse2014-abstract.html (accessed 2026-11-11; abstract page and the author-hosted full paper read; 73 per cent of 357 real faults coupled to mutants, 17 per cent not coupled to any mutant). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [104]: Li, J., Hou, Y., Lin, L., Zhu, R., Cao, H. & El Ali, A. (2025). Vibe Coding in Product Teams: Reconfiguring AI-Assisted Workflows, Prototyping, and Collaboration. arXiv:2509.10652, first submitted 12 September 2025 (page read at v3, revised 1 May 2026); interview study with 22 product team members. Available at: https://arxiv.org/abs/2509.10652 (accessed 2026-11-11; abstract read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 20: Should Everyone Build? A Debate, Chapter 25: Conclusion.
• Source [105]: Ko, A. J., Abraham, R., Beckwith, L., Blackwell, A., Burnett, M., Erwig, M., Scaffidi, C., Lawrance, J., Lieberman, H., Myers, B., Rosson, M. B., Rothermel, G., Shaw, M. & Wiedenbeck, S. (2011). The State of the Art in End-User Software Engineering. ACM Computing Surveys 43(3), Article 21, April 2011. DOI: 10.1145/1922649.1922658. Literature survey that defines end-user software engineering; its introduction reports, from US Bureau of Labor Statistics data via Scaffidi et al. (2005), a projection of fewer than 3 million professional programmers and more than 55 million people using spreadsheets and databases at work in the United States by 2012. Available at: https://doi.org/10.1145/1922649.1922658 (accessed 2026-11-11; abstract and introduction read from the first author's copy, the remainder was not read). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate.
• Source [106]: Panko, R. R. (2000). Spreadsheet Errors: What We Know. What We Think We Can Do. Proceedings of the Spreadsheet Risk Symposium, European Spreadsheet Risks Interest Group (EuSpRIG), Greenwich, 17 to 18 July 2000; arXiv:0802.3457. Review of research; Table 1 summarises seven field audits of real organisational spreadsheets from 1987 to 2000: errors in 24 per cent of 367 spreadsheets, and in 91 per cent of the 54 audited in 1997 and later; most audits reported only substantive errors. Available at: https://arxiv.org/abs/0802.3457 (accessed 2026-11-11; text read). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 20: Should Everyone Build? A Debate.
• Source [107]: Microsoft (2025). Implement a data policy strategy. Microsoft Learn, Power Platform guidance, page dated 29 August 2025; provider documentation. States that data policies are guardrails that enforce which connectors are enabled for each environment and which can be used together, that connectors are classified as business data only, no business data allowed or blocked, that policies are scoped at environment or tenant level and not at user level, and that by default no data policies are implemented in the tenant. Available at: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/dlp-strategy (accessed 2026-11-11; page read; no claim of effectiveness is made by the series). Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate.
• Source [108]: Microsoft (2026). Develop a tenant environment strategy to adopt Power Platform at scale. Microsoft Learn, Power Platform guidance, page dated 17 October 2026; provider documentation. Describes the default environment as the place where personal productivity apps often start, routing of makers to personal developer environments, separate development, test and production environments, and pipelines that promote assets between them. Available at: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/environment-strategy (accessed 2026-11-11; the introduction and the sections on the default environment, sandbox environments and pipelines were read, not the whole page; no claim of effectiveness is made by the series). Referenced in: Chapter 4: The Method: Twelve Steps, Four Tiers and the Takeover Test, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register.
• Source [109]: Deng, J., Fan, Z. & Meng, R. (2026). Understanding the (In)Security of Vibe-Coded Applications. arXiv:2606.23130, submitted 22 June 2026, version 4 of 14 September 2026; preprint, not peer reviewed. Collects 9,041 open-source applications built with Claude Code and Lovable and audits 200 publicly deployed applications: 1,186 vulnerabilities, 91.0 per cent of the audited applications with at least one, 65.77 per cent of the vulnerabilities rated Critical or High, clustered in broken access control, injection and authentication failures. Available at: https://arxiv.org/abs/2606.23130 (accessed 2026-11-11; the arXiv abstract page, v4, was re-read for the figures, the full text was not). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described, Chapter 6: Step 2 Tier: Decide How Much Structure the Work Needs, Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate, Chapter 22: Failures and Anti-Patterns, Chapter 24: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 25: Conclusion.
• Source [110]: Mozannar, H., Bansal, G., Fourney, A. & Horvitz, E. (2024). Reading Between the Lines: Modeling User Behavior and Costs in AI-Assisted Programming. CHI 2024; arXiv:2210.14306, first submitted 25 October 2022, current version 5 of 22 April 2024. Study in which 21 programmers completed coding tasks with GitHub Copilot and retrospectively labelled their sessions with a taxonomy of programmer activities (CUPS); the authors report that the taxonomy revealed inefficiencies and time costs in the interaction. Available at: https://arxiv.org/abs/2210.14306 (accessed 2026-11-11; the abstract page was read, the full text was not). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.
• Source [111]: Google. The Standard of Code Review. Google Engineering Practices documentation, Code Review Developer Guide, reviewer guide. States that the primary purpose of code review is to make sure that the overall code health of Google's code base is improving over time, and that reviewers should favour approving a change once it definitely improves overall code health even if it is not perfect. Practitioner documentation of one company, not a measured effect. Available at: https://google.github.io/eng-practices/review/reviewer/standard.html (accessed 2026-11-11; page read). Referenced in: Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers.
• Source [112]: The Linux kernel community. AI Coding Assistants. Linux kernel documentation, Documentation/process/coding-assistants. States that AI agents must not add Signed-off-by tags because only humans can certify the Developer Certificate of Origin, and that the human submitter is responsible for reviewing all AI-generated code, ensuring licence compliance and taking full responsibility for the contribution. Documentation of one project, which changes between kernel versions (accessed 2026-11-11, current page). Available at: https://docs.kernel.org/process/coding-assistants.html Referenced in: Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers.
• Source [113]: Spracklen, J., Wijewickrama, R., Sakib, A. H. M. N., Maiti, A., Viswanath, B. & Jadliwala, M. (2025). We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs. arXiv:2406.10279, first submitted 12 June 2024, version 3 of 2 March 2025; listed as accepted to the 2025 USENIX Security Symposium. 16 code-generation models and 576,000 code samples in two programming languages; hallucinated packages averaged at least 5.2 per cent for commercial models and 21.7 per cent for open-source models, with 205,474 unique hallucinated package names. Available at: https://arxiv.org/abs/2406.10279 (accessed 2026-11-14; abstract page read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 22: Failures and Anti-Patterns.
• Source [114]: CVE Program (2025). CVE-2025-48757. CVE record published 30 May 2025, last updated 21 August 2025; describes an insufficient Row-Level Security policy in Lovable through 2025-04-15 that allows reading or writing arbitrary database tables of generated sites (CWE-863), and carries the tags "disputed" and "exclusively-hosted-service": the supplier disputes the finding and states that each customer is responsible for protecting its application's data. Available at: https://cveawg.mitre.org/api/cve/CVE-2025-48757 (accessed 2026-11-14; record read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well.
• Source [115]: Chacon, S. & Straub, B. (2014). Pro Git, 2nd edition, section 1.3 "What is Git?" Apress; open-licensed (CC BY-NC-SA 3.0); documentation of the version control system Git: states that Git stores snapshots, that most operations need only local files, and the three states (modified, staged, committed). Available at: https://git-scm.com/book/en/v2/Getting-Started-What-is-Git%3F (accessed 2026-11-14; page read). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules.
• Source [116]: Git project. gitignore: Specifies intentionally untracked files to ignore. Git documentation, git-scm.com/docs/gitignore; states that files already tracked by Git are not affected by ignore patterns and that git rm --cached removes a tracked file from the index. Available at: https://git-scm.com/docs/gitignore (accessed 2026-11-14; page read). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules.
• Source [117]: GitHub. Removing sensitive data from a repository. GitHub Docs; vendor documentation of one platform, undated; states that a committed secret must first be revoked or rotated and that rewriting history and force pushing may leave the commits accessible elsewhere. Available at: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository (accessed 2026-11-14; page read). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules.
• Source [118]: Wiggins, A. (2017). The Twelve-Factor App, III. Config: store config in the environment. 12factor.net; practitioner methodology, not a standard; states a strict separation of config from code and the test that a codebase could be made open source at any moment without compromising any credentials. Available at: https://12factor.net/config (accessed 2026-11-14; page read). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules.
• Source [119]: AGENTS.md project. AGENTS.md: a simple, open format for guiding coding agents. agents.md; describes the file as a "README for agents" kept at the repository root, with nested files whose nearest copy takes precedence and with explicit user prompts overriding it; stewardship by the Agentic AI Foundation under the Linux Foundation as stated on the page; a description of a convention, not a guarantee that any tool honours it. Available at: https://agents.md (accessed 2026-11-14; page read). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules.
• Source [120]: Fowler, M. (2013). Given When Then. martinfowler.com bliki, 21 August 2013; practitioner article describing the Given-When-Then style of representing tests, developed by Daniel Terhorst-North and Chris Matts as part of Behavior-Driven Development, as a way of specifying behaviour by example. Available at: https://martinfowler.com/bliki/GivenWhenThen.html (accessed 2026-11-14; page read). Referenced in: Chapter 8: Step 4 Specification: Write Down What Correct Means.
• Source [121]: McKinley, D. (2015). Choose Boring Technology. mcfunley.com, 30 March 2015; the spoken-word version of the talk is at boringtechnology.club (the talk page states no date). Practitioner essay, not an empirical study: proposes that a company has about three "innovation tokens" to spend on unproven technology and that technology which is well understood, with known failure modes, should be preferred elsewhere; the author calls the model approximate. Available at: https://mcfunley.com/choose-boring-technology (accessed 2026-11-14; essay and talk page read). Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions.
• Source [122]: pytest (2026). How to parametrize fixtures and test functions. pytest documentation (stable), documentation of one testing tool, cited as an example of the pattern of running one test function over a list of inputs and expected results. Available at: https://docs.pytest.org/en/stable/how-to/parametrize.html (accessed 2026-11-14; page read, the page states no date). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle.
• Source [123]: Viljoen, A., Radić, M., Hein, A., Nguyen, J. & Krcmar, H. (2024). Governing Citizen Development to Address Low-Code Platform Challenges. MIS Quarterly Executive 23(3), Article 6. Interview study with 30 citizen developers and low-code platform experts; reports that poor software quality, shadow IT and technical debt are the hazards, that technical experts play a central role in governing citizen development, that platform-specific features matter, and that governing citizen development differs from conventional software governance. Available at: https://aisel.aisnet.org/misqe/vol23/iss3/6 (accessed 2026-11-14; abstract page read, the full text was not). Referenced in: Chapter 20: Should Everyone Build? A Debate.
• Source [124]: Stegmann, L., Berendorf, R., Zimmermann, S. K. & Weeger, A. (2024). Balancing Risks and Opportunities in the Governance of Low Code Development Platforms. ECIS 2024 Proceedings, Paper 1634 (short paper). Qualitative interview study of internationally operating companies; preliminary findings that the strict, centralised governance favoured in the literature is not always suitable and that more differentiated governance structures are needed; the page does not state the number of interviews. Available at: https://aisel.aisnet.org/ecis2024/is_governance/track21_is_govern/4/ (accessed 2026-11-14; abstract page read, the full text was not). Referenced in: Chapter 20: Should Everyone Build? A Debate.

Developer productivity research

• Source [125]: Brooks, F. P. (1995). The Mythical Man-Month: Essays on Software Engineering, Anniversary Edition. Addison-Wesley Professional (first edition 1975). ISBN 978-0-201-83595-3. Bibliographic record: https://openlibrary.org/isbn/9780201835953 (accessed 2026-11-11). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know.
• Source [126]: Google Cloud, DORA (2024). Accelerate State of DevOps Report 2024. DevOps Research and Assessment (DORA) programme, Google Cloud, published October 2024. Available at: https://dora.dev/research/2024/dora-report/ (accessed 2026-11-11; the page states neither the release date nor the survey size; the release date of 22 October 2024 is taken from secondary reports of the publisher's announcement; the magnitudes cited in Chapter 7 were checked in the full report PDF, which reports a survey of nearly 3,000 respondents fielded in early 2024). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate, Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [127]: Stack Overflow (2025). 2025 Stack Overflow Developer Survey. Stack Overflow, over 49,000 responses from 177 countries; survey of self-selected respondents. Available at: https://survey.stackoverflow.co/2025/ (accessed 2026-11-11). Referenced in: Chapter 1: Introduction: From Vibe to Dev, Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 3: What Developers Do: The Gap Described.
• Source [128]: Meyer, A. N., Barton, L. E., Murphy, G. C., Zimmermann, T. & Fritz, T. (2017). The Work Life of Developers: Activities, Switches and Perceived Productivity. IEEE Transactions on Software Engineering 43(12), December 2017. Monitoring of 20 professional developers at four companies for an average of 11 full workdays, with self-reports of perceived productivity. Available at: https://thomas-zimmermann.com/publications/files/meyer-tse-2018.pdf (accessed 2026-11-11; full text read). Referenced in: Chapter 3: What Developers Do: The Gap Described.
• Source [129]: Xia, X., Bao, L., Lo, D., Xing, Z., Hassan, A. E. & Li, S. (2018). Measuring Program Comprehension: A Large-Scale Field Study with Professionals. IEEE Transactions on Software Engineering 44(10), 951-976. Field study of 78 professional developers in seven projects over 3,148 working hours (accessed 2026-11-11; the figures (78 developers, seven projects, 3,148 hours, about 58 per cent) were checked against the abstract as reproduced in library catalogue records; the full text was not read). Referenced in: Chapter 3: What Developers Do: The Gap Described.
• Source [130]: Harvey, N. (2026). DORA's software delivery performance metrics. DevOps Research and Assessment (DORA) programme, Google Cloud; guide page last updated 5 January 2026. Names five metrics in two groups (throughput: change lead time, deployment frequency, failed deployment recovery time; instability: change fail rate, deployment rework rate) and warns against setting them as goals, against a single-metric focus and against comparing unlike applications. Available at: https://dora.dev/guides/dora-metrics/ (accessed 2026-11-11). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback.
• Source [131]: Google Cloud, DORA (2025). Streamlining change approval. DevOps Research and Assessment (DORA) programme capability page, last updated 30 October 2025. States that heavyweight external approval (a change advisory board or senior sign-off) has a negative impact on software delivery performance and that no evidence was found that a more formal external review is associated with lower change fail rates; it keeps a coordinating role for the board. Available at: https://dora.dev/capabilities/streamlining-change-approval/ (accessed 2026-11-11). Referenced in: Chapter 13: Step 9 Ship: Pipelines, Environments, Releases and Rollback, Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register.
• Source [132]: Google Cloud, DORA. Trunk-based development. DevOps Research and Assessment (DORA) programme capability page; the page states no date. Describes merging small batches into the main line at least daily, three or fewer active branches, branches that last no more than a few hours, and no code freezes. Available at: https://dora.dev/capabilities/trunk-based-development/ (accessed 2026-11-11). Referenced in: Chapter 10: Step 6 Build: Small Slices with an Assistant Under a Mandate.

Secure software supply chain

• Source [133]: Pearce, H., Ahmad, B., Tan, B., Dolan-Gavitt, B. & Karri, R. (2021). Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions. arXiv:2108.09293, submitted 20 August 2021, revised 16 December 2021; accepted at the IEEE Symposium on Security and Privacy 2022 according to the arXiv page. Available at: https://arxiv.org/abs/2108.09293 (accessed 2026-11-11). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [134]: Veracode (2025). October 2025 Update: GenAI Code Security Report. Veracode; code from over 100 large language models in Java, JavaScript, Python and C#, with AI-generated code introducing risky security flaws in 45 per cent of tests; vendor research. Available at: https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/ (accessed 2026-11-11). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 22: Failures and Anti-Patterns.
• Source [135]: OWASP Gen AI Security Project (2025). OWASP Top 10 for LLM Applications 2025 (2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps). OWASP Foundation; ten risks from LLM01 Prompt Injection to LLM10 Unbounded Consumption, including LLM03 Supply Chain and LLM06 Excessive Agency. Available at: https://genai.owasp.org/llm-top-10/ (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [136]: Open Source Security Foundation and Linux Foundation. SLSA specification (Supply-chain Levels for Software Artifacts). slsa.dev; levels that describe increasing supply chain security guarantees; version 1.0 was read, and the site marks version 1.2 as current. Available at: https://slsa.dev/spec/v1.0/ (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [137]: Souppaya, M., Scarfone, K. & Dodson, D. (2022). Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. NIST Special Publication 800-218, National Institute of Standards and Technology, February 2022. DOI: 10.6028/NIST.SP.800-218. Available at: https://csrc.nist.gov/pubs/sp/800/218/final (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [138]: Booth, H., Souppaya, M., Vassilev, A., Ogata, M., Stanley, M. & Scarfone, K. (2024). Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile. NIST Special Publication 800-218A, National Institute of Standards and Technology, July 2024. DOI: 10.6028/NIST.SP.800-218A. Available at: https://csrc.nist.gov/pubs/sp/800/218/a/final (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [139]: Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S. & Dolan-Gavitt, B. (2023). Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants. arXiv:2208.09727, first submitted August 2022, revised February 2023; accepted at USENIX Security 2023 according to the arXiv page. Available at: https://arxiv.org/abs/2208.09727 (accessed 2026-11-11). Referenced in: Chapter 11: Step 7 Prove: Tests, Review and an Independent Oracle, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 20: Should Everyone Build? A Debate.
• Source [140]: Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. & Fritz, M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173, first submitted 23 February 2023, version 2 of 5 May 2023. Available at: https://arxiv.org/abs/2302.12173 (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [141]: GitGuardian (2025). The State of Secrets Sprawl 2025. GitGuardian, report page on 2024 data from public GitHub; vendor research by a seller of secrets-detection products; the page states no publication date, no selection method for the Copilot subset and no sample sizes for it. Available at: https://www.gitguardian.com/state-of-secrets-sprawl-report-2025 (accessed 2026-11-11). Referenced in: Chapter 7: Step 3 Workshop: Version Control, Environments, Secrets and the Assistant's Rules, Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [142]: Ecma International (2025). ECMA-424: CycloneDX Bill of materials specification, 2nd edition, December 2025; specifies the CycloneDX v1.7 BOM format in JSON, covering software and hardware parts, services, dependencies, security flaws, cryptographic assets and machine-learning models. Available at: https://ecma-international.org/publications-and-standards/standards/ecma-424/ (accessed 2026-11-11). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.
• Source [143]: UpGuard (2021). By Design: How Default Permissions on Microsoft Power Apps Exposed Millions. UpGuard Research, 23 August 2021; research report by a security vendor. Reports 38 million records across Power Apps portals and 47 entities notified, because lists had table permissions disabled by default; Microsoft closed the report on 29 June 2021 as "by design", later released a checker tool and made table permissions enabled by default for newly created portals. Available at: https://upguard.com/breaches/power-apps (accessed 2026-11-11; page read, Microsoft's own account was not). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate, Chapter 22: Failures and Anti-Patterns.
• Source [144]: National Institute of Standards and Technology (2025). CVE-2025-48757 Detail. National Vulnerability Database, published 30 May 2025. Record describes an insufficient row-level security policy in Lovable through 2025-04-15 that lets unauthenticated remote attackers read or write arbitrary database tables of generated sites; weakness CWE-863; tagged disputed, with the supplier stating that each customer is responsible for protecting its application's data. Available at: https://nvd.nist.gov/vuln/detail/CVE-2025-48757 (accessed 2026-11-11; record read through the NVD programming interface, the supplier's own statement was not). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 17: What the Organisation Provides: Sandboxes, Templates, Golden Paths and a Register, Chapter 20: Should Everyone Build? A Debate, Chapter 22: Failures and Anti-Patterns, Chapter 25: Conclusion.
• Source [145]: Lanyado, B. (2024). Lasso Research: AI Package Hallucinations. Lasso Security blog, post dated 28 March 2024 (the page also carries a site date of 2026 in its metadata); primary account by the researcher of an experiment in which he registered an empty package under a name that models had hallucinated and counted downloads over three months, reporting more than 30,000 authentic downloads and a reference in the README of an Alibaba research repository; it reports no malicious use. Available at: https://www.lasso.security/blog/ai-package-hallucinations (accessed 2026-11-11; page read). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data, Chapter 22: Failures and Anti-Patterns.
• Source [146]: OWASP Foundation (2025). OWASP Top 10:2025. OWASP Top 10 Web Application Security Risks, 8th edition; categories A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, A10 Mishandling of Exceptional Conditions. Available at: https://owasp.org/Top10/2025/0x00_2025-Introduction/ (accessed 2026-11-14; introduction page read). Referenced in: Chapter 12: Step 8 Secure: Secrets, Dependencies, Access and Personal Data.

Software law: the Cyber Resilience Act and product liability

• Source [147]: European Parliament and Council of the European Union. Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/2847/oj (accessed 2026-11-11; title and dates read; Article 3(14) (open-source software steward) and Article 24(1) (cybersecurity policy of stewards) verified in the EUR-Lex text on 2026-11-11; Article 13(1) to (3) and Annex I, Part I, point (2)(a) and (b) verified in the EUR-Lex text on 2026-11-11, Article 13(7), (8) and (9) and Article 71(2) (application from 11 December 2027) verified in the EUR-Lex text on 2026-11-11 for Chapter 12; Articles 2, 3, 12, 13, 14, 24, 64, 69 and 71, Annexes I and II and recitals 15, 16 and 20 verified in the EUR-Lex text on 2026-11-11 for Chapter 24). Referenced in: Chapter 19: Regulation for Builders: What Applies When.
• Source [148]: European Parliament and Council of the European Union. Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC. Official Journal of the European Union, 18 November 2024. Available at: https://eur-lex.europa.eu/eli/dir/2024/2853/oj (accessed 2026-11-11; title and dates read; Article 4(1), Article 2(1) and Article 21 checked in the Official Journal text on 2026-11-11; Articles 2, 4, 6, 7, 9, 10, 11, 17 and 22 and recital 13 checked for Chapter 24 on the same date). Referenced in: Chapter 19: Regulation for Builders: What Applies When.

Intellectual property and open source

• Source [149]: United States Copyright Office (2025). Copyright and Artificial Intelligence, Part 2: Copyrightability. A report of the Register of Copyrights, January 2025. United States law, cited as one worked statement of the question of AI-assisted authorship. Available at: https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf (report text read on 2026-11-11; the conclusions on assistive use, human expressive contribution, prompts, case-by-case assessment and no case for a sui generis right checked in the text). Referenced in: Chapter 19: Regulation for Builders: What Applies When.
• Source [150]: Xu, W., Gao, K., He, H. & Zhou, M. (2025). LiCoEval: Evaluating LLMs on License Compliance in Code Generation. Proceedings of the 47th International Conference on Software Engineering (ICSE 2025); arXiv:2408.02487, first submitted 5 August 2024, version 3 of 25 February 2025. Abstract read; the method and the models evaluated are described in the paper. Available at: https://arxiv.org/abs/2408.02487 (accessed 2026-11-11). Referenced in: Chapter 19: Regulation for Builders: What Applies When.
• Source [151]: GitHub (n.d.). Managing GitHub Copilot policies as an individual subscriber (section "Enabling or disabling suggestions matching public code"). GitHub Docs. Vendor documentation of one product's setting, cited only as an example of a provider control. Available at: https://docs.github.com/en/copilot/how-tos/manage-your-account/manage-policies (accessed 2026-11-11). Referenced in: Chapter 19: Regulation for Builders: What Applies When.

Developer skills and education

Public-sector software

• Source [152]: Sveriges riksdag (2018). Lag (2018:1937) om tillgänglighet till digital offentlig service (Act on accessibility of digital public services), 4, 10 to 13 §§. Svensk författningssamling 2018:1937, in force 1 January 2019 (version amended to SFS 2026:1625; 4 § is replaced by a new wording from 1 January 2027). Available at: https://data.riksdagen.se/dokument/sfs-2018-1937.html (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.
• Source [153]: WebAIM (2025). The WebAIM Million: An annual accessibility analysis of the top 1,000,000 home pages (2025 report). WebAIM; automated tests of one million home pages in February 2025, last updated 31 March 2025. Available at: https://webaim.org/projects/million/2025 (accessed 2026-11-11). Referenced in: Chapter 18: Builders in the Public Authority: Procurement, Records, Accessibility and Legitimacy.

Professional ethics and codes of conduct

Research papers and studies

• Source [154]: Yang, C., Shi, Y., Ma, Q., Liu, M. X., Kästner, C. & Wu, T. (2025). What Prompts Don't Say: Understanding and Managing Underspecification in LLM Prompts. arXiv:2505.13360, first submitted 19 May 2025 (preprint; the abstract reports that models infer unspecified requirements by default in 41.1 per cent of cases and that underspecified prompts are twice as likely to regress across model or prompt changes). Available at: https://arxiv.org/abs/2505.13360 (accessed 2026-11-11). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know, Chapter 8: Step 4 Specification: Write Down What Correct Means.
• Source [155]: Mu, F., Shi, L., Wang, S., Yu, Z., Zhang, B., Wang, C., Liu, S. & Wang, Q. (2023). ClarifyGPT: Empowering LLM-based Code Generation with Intention Clarification. arXiv:2310.10996, submitted 17 October 2023 (preprint; function-level code generation benchmarks, with simulated user answers in the automated evaluation). Available at: https://arxiv.org/abs/2310.10996 (accessed 2026-11-11). Referenced in: Chapter 5: Step 1 Intent: Say What You Are Building, for Whom and How You Will Know.

Legacy modernisation and code stewardship

• Source [156]: Nikolov, S., Codecasa, D., Sjovall, A., Tabachnyk, M., Chandra, S., Taneja, S. & Ziftci, C. (2025). How is Google using AI for internal code migrations? arXiv:2501.06972, submitted 12 January 2025. Experience report on LLM-assisted migrations in Google's monorepo (identifier-type widening, JUnit3 to JUnit4, Joda-Time to java.time); the savings figures are estimates reported by the engineers who did the work. Available at: https://arxiv.org/abs/2501.06972 (accessed 2026-11-11; full text read). Referenced in: Chapter 22: Failures and Anti-Patterns.
• Source [157]: Avelino, G., Passos, L., Hora, A. & Valente, M. T. (2016). A Novel Approach for Estimating Truck Factors. In: 24th International Conference on Program Comprehension (ICPC 2016). DOI: 10.1109/ICPC.2016.7503718; arXiv:1604.06766. Study of 133 popular GitHub projects (the six main languages' most popular repositories, filtered). Available at: https://arxiv.org/abs/1604.06766 (accessed 2026-11-11; bibliographic record and summary read). Referenced in: Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset, Chapter 16: Step 12 Hand Over: The Takeover Test and Working with Developers.
• Source [158]: Wright, H. (2020). Deprecation. Chapter 15 in Winters, T., Manshreck, T. & Wright, H. (eds), Software Engineering at Google: Lessons Learned from Programming Over Time. O'Reilly Media. Practitioner book, not research. Available at: https://abseil.io/resources/swe-book/html/ch15.html (accessed 2026-11-11; chapter read online). Referenced in: Chapter 15: Step 11 Own: Documentation, Updates, Review and Sunset.

Fairness, bias and accessibility evidence

• Source [159]: WebAIM (2026). The WebAIM Million: An annual accessibility analysis of the top 1,000,000 home pages. Report of February 2026: automated analysis of 1,000,000 home pages found detectable WCAG 2 failures on 95.9 per cent, an average of 56.1 detected errors per page, and low-contrast text (83.9 per cent), missing alternative text (53.1 per cent) and missing form labels (51 per cent) as the most common failures. Automated detection covers only part of the failures a person would find (accessed 2026-11-11). Available at: https://webaim.org/projects/million/ Referenced in: Chapter 9: Step 5 Design: Choose Boring Technology and Record Decisions.

AI-assisted coding

• Source [160]: Kolirin, L. (2025). 'Vibe coding' named Collins Dictionary's Word of the Year. CNN Business, 6 November 2025 (syndicated); reports that Collins Dictionary chose "vibe coding" as its Word of the Year 2025, defined as the use of artificial intelligence prompted by natural language to assist with the writing of computer code, and attributes the term to Andrej Karpathy. Secondary report; the Collins page itself could not be fetched. Available at: https://kvia.com/news/business-technology/cnn-business-consumer/2025/11/06/vibe-coding-named-collins-dictionarys-word-of-the-year/ (accessed 2026-11-14; page read). Referenced in: Chapter 2: What Vibe Coding Is, and What It Does Well.

Developer experience, identity and wellbeing

• Source [161]: Prather, J., Reeves, B., Leinonen, J., MacNeil, S., Randrianasolo, A. S., Becker, B. A., Kimmel, B., Wright, J. & Briggs, B. (2024). The Widening Gap: The Benefits and Harms of Generative AI for Novice Programmers. ICER 2024; arXiv:2405.17739, submitted 28 May 2024. 21 novice students in lab sessions with observation, interviews and eye tracking. Available at: https://arxiv.org/abs/2405.17739 (accessed 2026-11-11; abstract read). Referenced in: Chapter 21: From Builder to Developer: Learning, Competence and Career, Chapter 25: Conclusion.

Learning, practice and expertise

Employment law: case law

• Source [162]: Bundesarbeitsgericht (2024). Beschluss vom 16. Juli 2024 – 1 ABR 16/23 (Technische Überwachungseinrichtung – Headset-System – betriebliche Mitbestimmung – Gesamtbetriebsrat), ECLI:DE:BAG:2024:160724.B.1ABR16.23.0. Federal Labour Court, First Senate. Holds in paragraph 25 that technical equipment is "bestimmt" for monitoring within section 87(1) no. 6 BetrVG "wenn sie objektiv geeignet sind, Verhaltens- oder Leistungsinformationen über den Arbeitnehmer zu erheben und/oder aufzuzeichnen" and that the employer's subjective intention to monitor does not matter. Available at: https://www.bundesarbeitsgericht.de/entscheidung/1-abr-16-23/ (accessed 2026-11-14; text of the decision read on the court's site). Referenced in: Chapter 20: Should Everyone Build? A Debate.

How to cite

Inline citations give the source number, the author or organisation, and the year, for example (9, MITRE, n.d.), and link to the entry here. Where an author is named in the sentence, the citation carries the year. Each chapter closes with a ## Sources section that lists the works it cites, using the same numbering as this bibliography. New sources are appended to the appropriate category with the next free number; existing numbers are never reused.