References

References & further reading

References for code review, model evaluation, packaging, and supply-chain security, grouped by topic. Academic preprints, vendor docs, and engineering writing are called out as such, so you can weight them accordingly.

Research & academic

Code review and software quality. Studies of inspection, review coverage, participation, and review effectiveness.

  • Fagan, “Design and Code Inspections to Reduce Errors in Program Development,” IBM Systems Journal 15(3), 182–211, 1976 — doi.org/10.1147/sj.153.0182. Describes systematic inspections and their role in defect removal.
  • Kemerer & Paulk, “The Impact of Design and Code Reviews on Software Quality,” IEEE Trans. Software Eng. 35(4), 2009 — sites.pitt.edu. Examines relationships between review rate, review effectiveness, and software quality.
  • McIntosh, Kamei, Adams & Hassan, “The Impact of Code Review Coverage and Participation on Software Quality,” MSR 2014 (distinguished paper) — doi.org/10.1145/2597073.2597076. Examines associations between review coverage, participation, and post-release defects.
  • SmartBear / Cisco, “Best Practices for Peer Code Review” — smartbear.com. Industry guidance on review rates, change size, and defect detection. (Industry white paper, not peer-reviewed.)

Modern, tool-based code review. Studies of review practices and outcomes.

  • Bacchelli & Bird, “Expectations, Outcomes, and Challenges of Modern Code Review,” ICSE 2013, 712–721 — doi.org/10.1109/ICSE.2013.6606617. Studies review outcomes beyond defect finding, including knowledge transfer and team understanding.
  • Sadowski, Söderberg, Church, Sipko & Bacchelli, “Modern Code Review: A Case Study at Google,” ICSE-SEIP 2018, 181–190 — doi.org/10.1145/3183519.3183525. Describes lightweight, per-change review practices at scale.

Model calibration and evaluation. Research on confidence, diverse reasoning, and model-based evaluation.

  • Guo, Pleiss, Sun & Weinberger, “On Calibration of Modern Neural Networks,” ICML 2017 (PMLR 70:1321–1330) — arXiv:1706.04599. Examines neural-network confidence calibration.
  • Wang et al., “Self-Consistency Improves Chain-of-Thought Reasoning in Language Models,” ICLR 2023 — arXiv:2203.11171. Evaluates aggregating answers from diverse sampled reasoning paths.
  • Zheng et al., “Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,” NeurIPS 2023 (Datasets & Benchmarks) — arXiv:2306.05685. Evaluates model-based judging and documents biases including verbosity and self-enhancement.

Cost & pricing data

The inputs behind the overview’s dollar figures — surfaced here for auditability. These are data sources, not research.

  • U.S. Bureau of Labor Statistics — “Software Developers,” Occupational Outlook Handbook, May 2024 — bls.gov. The $133,080 median (~$64/hr) that, at a conservative 1.4× benefits/overhead load, yields the ~$90/hr fully-loaded reviewer rate on the overview.
  • Peer AI-reviewer list pricing — CodeRabbit, Greptile, Qodo, Graphite, accessed 2026. ~$24–30/developer-month, the comparison point for Bubo’s per-review cost. (Vendor list prices, subject to change.)

Python packaging & distribution

  • uv — Tools guide: docs.astral.sh/uv/guides/tools. uv tool install bubo (from PyPI) is Bubo’s primary install path; this documents tool installs, the git+https://… “track main” syntax, and PATH placement.
  • uv — Build backend concepts: docs.astral.sh/uv/concepts/build-backend. Why the default backend ships only the module root — the root cause of an early release that dropped the deploy assets.
  • astral-sh/uv #11502 (uv maintainer konstin’s recommendation): github.com/astral-sh/uv/issues/11502. The basis for Bubo switching its build backend to Hatchling for flexible non-Python asset packaging.
  • Hatch / Hatchling build configuration: hatch.pypa.io/latest/config/build. The force-include mechanism that places Bubo’s prompts, skills, and deploy templates into the wheel under bubo/_assets/.

Standards & specifications Bubo implements

  • Model Context Protocol (MCP) — modelcontextprotocol.io. Bubo ships an MCP server (bubo-mcp) and consumes upstream MCP servers.
  • Conventional Commits 1.0 — conventionalcommits.org. Enforced on every commit; drives the automated release flow.
  • Semantic Versioning 2.0 — semver.org, with the pre-1.0 “anything-goes under 0.x” carve-out.
  • Keep a Changelog 1.1 — keepachangelog.com. The format of this project’s hand-curated CHANGELOG.md.
  • OpenTelemetry — opentelemetry.io. Bubo’s metrics, spans, and cost-attribution backend.

Supply-chain security

  • OpenSSF Scorecard — github.com/ossf/scorecard. The checks Bubo hardens against (SHA-pinned Actions, branch protection, signed releases, …).
  • Sigstore — sigstore.dev. Keyless OIDC signing; Bubo’s release artifacts are cosign-signed.
  • SLSA — slsa.dev. Supply-chain integrity levels that frame the release provenance goals.
  • SPDX — spdx.dev. The SBOM format attached to every Bubo release.

Ecosystem & directories

Prior art evaluated

  • Serena — github.com/oraios/serena. An MCP-based coding agent toolkit reviewed while scoping Bubo’s MCP surface and token-efficiency approach.
Configuration reference
MountainOwlMountainOwl
Bubo · MIT licensed · © 2026