Appendix E — Annotated Bibliography

Organised by what you would read it for, not by topic — and including what this book rejected.

Grades: [A] peer-reviewed / RCT / large-N · [B] preprint, credible method · [C] analyst research · [D] vendor or practitioner claim Status: ✅ primary verified · 🟡 secondary only · 🔴 unverified, not relied upon

Full entries with page-level detail: references/sources.md.

E.1 If you read only three things

Böckeler, Birgitta. Harness engineering for coding agent users. martinfowler.com [D] ✅ The framework this book adopts wholesale. Agent = Model + Harness; builder versus user harness; the guides/sensors × computational/inferential quadrant; the steering loop; harnessability; harness templates. Also the most honest statement of what is unsolved — the behaviour harness as "the elephant in the room." Read this before anything else.

Galster, Mohsenimofidi, Lulla, Abubakar, Treude, Baltes. Harness Engineering for Agentic AI Coding Tools: An Exploratory Study. arXiv 2602.14690, AIware '26 [A] ✅ The empirical baseline for what teams actually do. 2,853 repositories, eight configuration mechanisms, February 2026 snapshot. Context Files in 90.6%; Hooks in 0.9–3.2%; 85.5% of Skills bundle no resources; no repository used Subagent persistent memory. Their conclusion — "harness engineering in open source today is therefore mostly context engineering" — is the gap this book is about.

He, Agarwal, Denisov-Blanch, Azaletskiy, Koyejo, Vasilescu. AI Writes Faster Than Humans Can Review. arXiv 2607.01904, CMU/Stanford [B] ✅ The only properly instrumented organisational case. 802 developers, 196,212 pull requests, a documented CTO mandate, 26 months. Throughput doubled; per-reviewer load doubled; automated review overtook human review. "Relocates work downstream rather than removing it."

E.2 On whether AI makes engineers faster

Read all five or none. Chapter 3 §3.1 plots them as a gradient; any one of them alone is a selection.

METR. We are Changing our Developer Productivity Experiment Design, Feb 2026 [B] ✅ The follow-up nobody cites: 30–50% of developers refused to submit tasks they were unwilling to attempt without AI, at \$50/hour. Revealed preference contradicting measured outcome — the book's central epistemics set-piece.

Faros AI telemetry [D] 🟡 — 10,000+ developers: +98% merged PRs, +91% review time, +154% PR size, flat organisational DORA. Vendor data; the shape corroborates the peer-reviewed sources.

E.3 On whether it damages the codebase

He, Miller, Agarwal, Kästner, Vasilescu. Speed at the Cost of Quality? arXiv 2511.04427, MSR '26 [A] ✅ (abstract only) The one causal design. Difference-in-differences, Cursor adopters versus matched controls. Velocity "large but transient"; warnings and complexity "substantial and persistent" and identified as driving the later slowdown. ⚠️ The circulating effect sizes are not in the abstract and are not printed in this book.

GitClear. AI Copilot Code Quality (2025 edition, 211M changed lines) [C] 🟡 Moved code 24.8% (2021) → 9.5% (2024); copy/paste 8.4% → 12.3%; churn 5.5% → 7.9%; duplicated blocks ~8× in 2024. Vendor research, but "moved code" is close to a direct measurement rather than a proxy. A 2026 Maintainability Gap edition supersedes it and returns HTTP 403.

DORA. State of AI-assisted Software Development 2025 [C] ✅ ~5,000 respondents. AI is an amplifier. Throughput up and delivery instability up. The seven capabilities are the best-validated organisational model in the field. 90% adoption.

E.4 On the interface and the harness

Yang, Jimenez, Wettig, Lieret, Yao, Narasimhan, Press. SWE-agent. arXiv 2405.15793, NeurIPS 2024 [A] ✅ The founding result, and the ablation matters more than the headline. Table 1: 1.31% → 12.47% with the model held constant. Table 3: four interface dials, each with an interior optimum, and iterative search at 12.0% versus 15.7% for no search at all. Also "agents succeed quickly and fail slowly."

Jimenez et al. SWE-bench. arXiv 2310.06770, ICLR 2024 [A] ✅ — Claude 2 at 1.96%. Every instance ships with the maintainers' tests, i.e. the benchmark supplies the specification real work lacks.

Agentless. arXiv 2407.01489 [B] 🟡 — 27.33% on SWE-bench Lite at \$0.34. The counterweight to elaborate scaffolding.

mini-swe-agent [D] ✅ — 100 lines, bash only, >74% on SWE-bench Verified. The standing objection to every claim that agents require apparatus.

SWE-Bench+. arXiv 2410.06992 [B] 🟡 — 32.67% solution leakage, 31.08% weak tests, and SWE-Agent+GPT-4 falling 12.47% → 3.97% when filtered. Cite this whenever you cite a benchmark level.

E.5 On context

Mei et al. A Survey of Context Engineering for LLMs. arXiv 2507.13334 [B] ✅ 1,400+ papers. The definition worth adopting: "the systematic optimization of information payloads." And the asymmetry with a design consequence — models "demonstrate remarkable proficiency in understanding complex contexts" while showing "pronounced limitations in generating equally sophisticated, long-form outputs." Load richly, ask narrowly.

Hong, Troynikov, Huber. Context Rot. Chroma, July 2025 [D] ✅ 18 models. Reliability drops with input length "even for tasks as simple as retrieval and text replication." ⚠️ Chroma sells a vector database — disclose it. Credible because the method resists dismissal and because it converges with SWE-agent's independent ablation.

Liu et al. Lost in the Middle (2023) [A] 🟡 — the mechanism SWE-agent's authors cite for their own ablations.

Zhang et al. Agentic Context Engineering. arXiv 2510.04618 [B] 🔴 — context collapse and brevity bias; incremental updates over rewrites. The reason never to let an agent regenerate a context file.

Lulla et al. On the Impact of AGENTS.md Files. arXiv 2601.20404 [B] 🔴 — lower runtime and tokens at comparable completion. The only causal evidence that context files help, supporting a practice in 90.6% of repositories.

E.6 On graphs and structure

Chen et al. LocAgent. arXiv 2503.09089 [B] ✅ — directed heterogeneous graphs; nodes are files, classes, functions; edges are imports, invocations, inheritance. 92.7% file-level localisation, +12% Pass@10, ≈86% cost reduction. The cost figure is a context-budget result as much as an accuracy one.

Ouyang et al. RepoGraph. arXiv 2410.14684, ICLR 2025 [A] ✅ (abstract) — a plug-in added to four methods that boosted all of them. The strongest form of evidence that graphs supply something orthogonal. ⚠️ The circulating "32.8%" is not in the abstract.

When to use Graphs in RAG. arXiv 2506.05690 [B] ✅ — the honest counterweight: GraphRAG "frequently underperforms vanilla RAG on many real-world tasks." Negative results, by the authors' own description.

Parnas, D. L. (1972). On the Criteria To Be Used in Decomposing Systems into Modules. CACM 15(12) ✅ canonical Fifty-four years old and the most load-bearing citation in this book. Information hiding turns out to be the condition under which local inference is sound — a property Parnas did not name and could not have, because humans absorbed the failure.

Arora et al. MASAI. arXiv 2406.11638 [B] ✅ — modular sub-agents; 28.33% on SWE-bench Lite; "avoiding unnecessarily long trajectories which inflate costs and add extraneous context." Information hiding applied to the workforce.

Evans, Domain-Driven Design; Ford, Parsons, Kua, Building Evolutionary Architectures ✅ canonical — bounded contexts as context-window boundaries; fitness functions as the enforcement mechanism.

E.7 On security

OWASP GenAI Security Project. Top 10 for Agentic Applications (2026), announced Dec 2025 [C] ✅ ASI01 Agent Goal Hijack ranked first, because agents "cannot reliably distinguish instructions from data", so one poisoned input redirects an agent using its legitimate tools and access.

CVE-2026-22708 — Cursor terminal allowlist bypass [C] ✅ Shell built-ins bypassed allowlist validation; injection poisoned PATH/LD_PRELOAD so already-approved commands executed attacker code; RCE possible with an empty allowlist. "The allowlist made the attack easier." The book's clearest case of an iatrogenic control.

RyotaK / GMO Flatt Security — claude-code-action, disclosed 1 June 2026 [C] ✅ checkWritePermissions trusted any actor ending in [bot]. Payload disguised as an error message; target /proc/self/environ; secrets written back into the issue. Actively exploited February 2026 against Cline. Every remediation that held was structural.

Deng et al. Understanding the (In)Security of Vibe-Coded Applications. arXiv 2606.23130 [B] ✅ VibeApps: 10,517 applications; 200 deployed sampled; 1,471 vulnerabilities. Classes: placeholder logic, unfiltered input, secret exposure. Root causes — memory loss, locally optimised objectives, insufficient security knowledge — are three mechanisms this book derived independently.

E.8 On what delegation does to people

Lee et al. The Impact of Generative AI on Critical Thinking. CHI 2025, doi 10.1145/3706598.3713778 [A] ✅ 319 knowledge workers, 936 examples. Confidence in the tool predicts less critical thinking; confidence in oneself predicts more. The second half is the protective variable and the reason the intervention is not "trust the tool less."

Your Brain on ChatGPT. MIT Media Lab, arXiv 2506.08872 [B] ✅ 54 participants, EEG. LLM users showed up to 55% less neural connectivity than unaided; shallow encoding; poor recall. Coins cognitive debt. And the finding that is actually actionable: brain-to-LLM ordering — attempt first, delegate second — preserved recall and prefrontal activation.

Burelli, Calefato, Grassi, Hristova, Novielli, Romano, Tell. arXiv 2606.20598 [B] ✅ Pre-registered Registered Report. EEG, eye-tracking, EDA, HRV. Reduced cognitive engagement under AI — and, decisively, electrodermal activity correlated with performance without AI and not with it. The signals do not become biased; they decouple. ⚠️ Students, two universities, working draft.

Brynjolfsson, Chandar, Chen. Canaries in the Coal Mine? Stanford Digital Economy Lab, Aug 2025 [B] ✅ Administrative payroll microdata. 13% relative employment decline for ages 22–25 in the most AI-exposed occupations after controlling for firm-level shocks, later 19%; experienced workers show no comparable gap; no widespread displacement. The authors' title carries a question mark and so should any citation of it.

Stack Overflow Developer Survey 2025 [C] ✅ — 46% distrust accuracy (up from 31%), 3% highly trust, 84% use anyway. Experienced developers are the most sceptical.

E.9 On vibe coding

Pimenova, Fakhoury, Bird, Storey, Endres. Good Vibrations? arXiv 2509.12491 [B] ✅ 190,000+ words of interviews and social data. Grounded theory of vibe coding as a new interaction paradigm supporting human–AI co-creation, with flow central and practitioners personifying the assistant. Coined by Karpathy, February 2025. ⚠️ The widely-repeated "trust regulates movement from delegation to co-creation" is not verified and not printed here.

Farrag, Sabry E. The Productivity-Reliability Paradox. arXiv 2605.01160v1 [B] ✅ Names the PRP and identifies the review bottleneck as an amplifying mechanism. Its specification-strength ladder — post-hoc review → natural-language spec → executable contract → constitutional governance — is orthogonal to this book's authority ladder and useful alongside it. ⚠️ Single-author preprint whose evidence table merges two distinct studies; several of its figures are the author's own "indicative estimates."

E.10 Published engineering accounts

Both self-reported, both without outcome data, both survivors. Read as a bill, not permission.

OpenAI. Harness engineering: leveraging Codex in an agent-first world, February 2026 [D] ✅ Over 1 million lines of agent-generated code. Layering Types → Config → Repo → Service → Runtime → UI enforced by structural tests. Custom Codex-generated linters whose "error messages inject remediation instructions into agent context." Background agents scanning for divergence and opening refactoring PRs.

Stripe. Minions: Stripe's one-shot, end-to-end coding agents, Parts 1–2 [D] ✅ 1,000+ PRs merged weekly, zero human-written code. Blueprints as workflows defined in code, with the agent reasoning and deterministic code doing everything else. Sub-second blocking pre-push hooks — "the single biggest cost reducer at agent scale."

Thoughtworks [D] 🟡 — architecture drift addressed with mixed sensors; the "janitor army."

E.11 What this book rejected

A bibliography that lists only what it used is hiding half its method. These were pursued and not relied upon.

And one process correction worth more than any single source. An automated summary of arXiv 2606.20598 reported that AI "maintained or elevated neural demand." The paper found the opposite. Reading the primary reversed the conclusion of an entire chapter section.

Cite the paper, not the summary of the paper. Four of this book's twenty-one documented corrections drift in the same direction: secondary coverage rounds, merges, or dramatises, and the drift always makes the claim more quotable than the truth.

E.12 Frameworks borrowed, with attribution

Original to this book: the four-tier evidence reconciliation and the stated/measured/revealed preference analysis · the Ashby constraint as a forcing result · harnessability as banked variety reduction · the retirement arm · harness drills as mutation testing · the regression-versus-specification distinction for generated tests · the held-out partition · the autonomy ladder tied to harnessability × blast radius, enforced as revoked capabilities · saturation elasticity · batching as a false relief valve · harness coverage · maturity as closed loops · the six-instance unowned-work class · the four crossing signals · the belief-versus-capability distinction · the effort-proxy collapse.