Boyue · Boyue Development Method—AI coding decision & complexity governance
Overview
- README
- README.md
- Language
- en
- hash
- 5475a5e52949
- Original
- GitHub
Lightweight AI coding governance method and Agent Skill using Commitment and Ownership Boundaries with risk-adaptive validation to separate broad exploration from long-term production complexity.
- Best for
- AI coding developers, Coding Agent users, software architects, technical leads, product and engineering teams
- Adoption threshold
- Low, ready to try
- Supported platforms
- Agent Skills, Codex, Claude Code, OpenClaw
- Deployment
- Local runtime
English | 简体中文
Boyue Method
AI makes it easier to build the wrong thing faster.
Boyue is a lightweight AI development governance method and Agent Skill for software teams and coding agents.
It helps teams explore broadly, commit selectively, validate expensive decisions, deliver coherent small changes, and retire complexity that no longer earns its maintenance cost.
Click the cover to read the full English methodology paper.
Project resources
The English project path is intentionally focused on English-language resources:
- Full methodology paper: From Implementation Scarcity to Implementation Abundance
- Installable Agent Skill (canonical execution source): SKILL.md
- Methodology references: references/
- Practical templates: templates/
- Usage examples: examples/
The GitHub repository is the canonical home for the methodology paper, Agent Skill, templates, references, and examples.
The idea in one sentence
Explore broadly. Prototype freely. Commit carefully. Own selectively.
The name “Boyue” comes from a classical principle commonly rendered as: study broadly, take selectively; accumulate deeply, release with restraint.
In software-development terms:
Manage possibilities broadly, commitments selectively, uncertainty with evidence, and complexity with restraint.
Why Boyue exists
AI coding systems can generate ideas, prototypes, code changes, tests, and pull requests at a speed that was previously impossible for many teams.
That is valuable—but it creates a new failure mode:
Cheap candidate generation
↓
More ideas and prototypes
↓
More accidental commitments
↓
More production ownership
↓
More maintenance, verification, migration, and compatibility costBoyue keeps two boundaries explicit:
1. Commitment Boundary
Could Build ≠ Should Invest
An idea, competitor feature, prototype, or working patch is still only an option until evidence justifies investment.
Choose:
- COMMIT — invest now;
- DEFER — preserve the option and define a revisit trigger;
- DISCARD — stop spending attention on it.
2. Ownership Boundary
Should Build ≠ Should Own
Working code is not automatically worth maintaining for years.
Before durable complexity enters production, ask:
If this must be maintained for three years, is it still worth adding?
Operating modes
Boyue is not a waterfall process. A real project may use multiple modes at the same time.
| Mode | Purpose | Typical practices |
|---|---|---|
| Explore | Expand the option space and reduce blind spots | user research, competitor research, Option Map, AI Spike |
| Select | Prevent options from becoming accidental commitments | PRFAQ, Non-goals, Commit / Defer / Discard |
| Shape | Reduce uncertainty according to the cost of being wrong | PoC, prototype, ADR, benchmark, rehearsal |
| Deliver | Ship the smallest coherent change worth owning | MCVS, Vertical Slice, Walking Skeleton |
| Evidence / Retirement | Decide whether existing complexity still deserves ownership | usage evidence, simplification, Retirement Review |
The five rules
- Explore broadly without committing broadly.
- Prototype freely; own selectively.
- Options are cheap; commitments are expensive.
- Shape according to the cost of being wrong.
- Deliver the smallest coherent change worth owning.
What the Skill does
The installable SKILL.md teaches an AI coding agent to:
- classify the current work as Explore / Select / Shape / Deliver / Evidence;
- avoid heavy process for small reversible edits;
- detect when new scope should cross a Commitment Boundary;
- detect when durable complexity should cross an Ownership Boundary;
- use disposable Spike / PoC work to validate uncertain AI capabilities;
- avoid silently promoting prototypes into production architecture;
- prefer the smallest coherent vertical slice for delivery;
- periodically consider simplification and retirement.
The Skill intentionally avoids arbitrary rules such as “AI must be 10× better” or “delete 80% of ideas”. Evidence and project context should drive decisions.
Quick examples
Small reversible edit
“Change this label and adjust card spacing.”
Boyue should not add process overhead. Make the smallest safe change and verify it.
See Feature Request.
Scope expansion
“While adding export, let’s also add scheduling, cloud sync, templates, and a public API.”
Boyue treats the new ideas as Options, then applies Commit / Defer / Discard rather than silently expanding scope.
Hard-to-reverse architecture decision
“Expose our internal extension mechanism as a public API.”
Boyue increases shaping depth because compatibility and migration obligations can last for years.
See Architecture Change.
Uncertain AI capability
“Can the model reliably extract structured findings from long documents?”
Boyue recommends a disposable capability Spike before production ownership.
See AI Capability Spike.
Practical toolkit
References
Templates
- Option Map
- Lightweight PRFAQ
- Commitment Decision Record
- Non-goals
- Risk Review
- Ownership Review
- Retirement Review
Examples
Installation
Boyue is packaged as an Agent Skill with a root SKILL.md and supporting Markdown resources.
For Agent Skills-compatible CLI installers, the repository can be installed directly:
npx skills add wuaishare/boyueSee DISTRIBUTION.md for marketplace/registry status and licensing boundaries.
OpenAI Skills follow the Agent Skills open standard, and Skills are supported across ChatGPT, Codex, and the API, although installation and workspace management differ by host product.
ChatGPT
Use the Skills interface to create/upload a skill from your computer or workspace. See OpenAI’s official documentation:
- https://help.openai.com/en/articles/20001066-skills-in-chatgpt
Hosts that scan ~/.agents/skills
For environments such as Desktop Commander setups that load skills from ~/.agents/skills/:
git clone https://github.com/wuaishare/boyue.git ~/.agents/skills/boyueThen start a new session or let the host refresh its skill registry.
Other Agent Skills-compatible tools
Clone or copy the repository into the skill directory expected by the host. The host must support the Agent Skills layout and SKILL.md discovery.
Suggested prompts
Boyue should normally activate automatically when relevant, but it can also be invoked explicitly:
Use Boyue to evaluate whether this new feature belongs in the roadmap.Apply the Commitment and Ownership boundaries before implementing this architecture change.Use Boyue to design a disposable AI Spike for this uncertain model capability.Run a Retirement Review on this mature module and identify complexity we can safely remove.Design philosophy
Boyue is deliberately lightweight.
It should not turn a CSS change into a product committee meeting. Governance depth should rise only when reversibility decreases, failure cost rises, or long-term ownership materially grows.
Prototype can be disposable. Production should be deliberate.
Methodology origin and attribution
The Boyue methodology was originally developed and published by Wuaishare.
Canonical English resources:
When redistributing or adapting the methodology text, please retain attribution to Wuaishare and the original article link.
Boyue builds on and references existing software and product practices such as Double Diamond, Set-Based Design, Shape Up, YAGNI, Working Backwards, Spike / PoC, Walking Skeleton, Tracer Bullet, and Vertical Slice. This project does not claim to have invented those practices.
License
Repository code and Skill files are released under the MIT License.
The methodology attribution request above applies to redistribution or adaptation of the Boyue methodology text.
Source access
Get code
Copy clone URLs, use GitHub CLI, or download the current default-branch source archive.
Clone using the web URL.
Clone using the SSH URL.
Clone using GitHub CLI.
Entry
Verified distributions
Verified platform routes, versions, and install commands for the same Skill.
openclaw skills install @wuaishare/boyueOpen Smithery and choose the target agent or client to install.
GitHub Releases
v0.2.3
A direct view of the current GitHub Release entry, notes, and downloadable assets.
AI Share Review
Security Audit & AI Evaluation Report
The report is bound to the audited snapshot, commit, and content fingerprint; changes require a new review.
The site review index equals 100 minus the semantic risk score and is only an internal relative-risk indicator; it is not a safety probability or third-party certification. Read it together with the risk level and each independent evidence source.
Security summary
This snapshot is primarily a Markdown-based Agent Skill with methodology, templates, and references. It contains no bundled executable code, credential access, exfiltration, or persistence instruction. The only confirmed executable recommendation is an unversioned npx installation command in documentation; if executed by a user, it introduces supply-chain risk from changes to the latest upstream release. SkillSpector covered the textual content substantially, but the overall result is partial because binary images were excluded from static pattern scanning and a few references were resolved ambiguously. Dependency vulnerability scanning was not applicable, so it does not support an absence-of-vulnerabilities conclusion.
Review engines & evidence coverage
Each scanner covers a different evidence surface; unavailable coverage does not mean confirmed absence of risk. The final conclusion combines multi-engine evidence, AI semantic adjudication, and deterministic policy.
v2.11.14 static findings · 100% text coverage · Partial
v0.74.0Filesystem scan completed; dependency-vulnerability coverage unavailable
v8.30.10 secret findings
v2.5.1No scannable package/lock source observed; vulnerability coverage unavailable
v5.5.0Public index currently has no supplemental repository-governance evidence; core safety gates are unaffected
Scanner provenance
sha256:a744afa570a9c693c1a0e4bd348a166e6e8745571af5a0bbd309357dc63c4753 Official assetsha256:1caada5e0e2091909357c7525d3aa76f4b660b13821bc143b190c7483e31cc11 Official assetsha256:b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5 Official assetsha256:75c44d6332f892a1e56286f4105a98ed751ae28d215ca0a8b65cc00d84103054 Official assetsha256:bac6371a4f810d6bdd0b65d63c3311906bdfe3ba0d76a5ea743ce24ced170fcf Official assetFindings & semantic adjudication
All three hits present the same unversioned npx installation command to users. The command is not an automatic instruction of the core Skill, but the documentation explicitly recommends executing it; if run, future upstream CLI updates could change what executes. The supply-chain risk is therefore valid but limited to a user-chosen installation step, with no evidence that the Skill itself downloads or executes code.
DISTRIBUTION.md:17; README.md:180; README.zh-CN.md:234The hit is only a planning-document task heading for creating the installable core Skill and a list of intended files. The context does not request cron jobs, startup items, state files, or any cross-session mechanism, and contains no executable implementation; it does not establish persistence behavior.
docs/superpowers/plans/2026-08-27-boyue-skill.md:45-48Security recommendations
- Pin the CLI package in installation instructions to a reviewed specific version, and record or verify that version’s integrity in the release process; retain a repository commit or release tag as a reviewable source for Skill content.
- Before adoption, review installation commands and their downloaded content in the target host environment. The core Skill requires no external runtime, but the documented npx and git installation paths have network, process, and filesystem effects.
- Carry the partial-coverage limitations into future audits: binary images were not statically pattern-scanned, and no dependency manifests existed, so Trivy and OSV had no usable dependency-vulnerability coverage.
AI evaluation details
This is a well-structured, bilingual methodology Skill suited to AI-assisted development. Centered on reversibility, failure consequence, and long-term ownership, it provides a consistent workflow from exploration through retirement, supported by templates and examples. Its main opportunity is to provide more explicit minimum output formats and operational decision-record examples to reduce interpretation differences across agents and teams.
The core rules, five operating modes, completion check, and relative-path resources are mutually consistent; most local template and reference links were resolved and analyzed. A few scanner reference-resolution ambiguities appear to be metadata or list-text misparsing, but link and release-consistency checks should still be maintained.
The Skill clearly distinguishes low-risk reversible edits from high-impact decisions, reducing unnecessary process overhead. English and Chinese READMEs, examples, templates, and explicit invocation prompts make it easy for different users to get started.
Risk-adaptive shaping, Commit/Defer/Discard, and Maintain/Simplify/Retire mechanisms apply across product, architecture, AI-capability validation, and mature-system governance without relying on arbitrary fixed numeric gates.
The root SKILL.md includes name, description, license, compatibility, and version metadata, and uses relative paths for references and templates that can be loaded as needed, aligning with common Agent Skill organization.
The two boundaries, minimum coherent value slice, and disposable-prototype principle directly address scope creep and long-term complexity risk when AI accelerates option generation. Effectiveness still depends on teams collecting real evidence and applying decision records.
Strengths
- It clearly separates what can be built, what merits investment, and what is worth maintaining through Commitment and Ownership Boundaries.
- It provides a fast path for small reversible changes while requiring validation proportional to risk for high-consequence, hard-to-reverse work.
- It provides templates, references, examples, and English/Chinese entry points, forming a comparatively complete practical toolkit.
Limitations
- The core guidance is principle-oriented; without established team conventions, output length, evidence thresholds, and decision-record granularity may still vary by executor.
- Installation and distribution documentation contains status and compatibility claims about multiple external platforms; these cannot be independently verified from this snapshot alone and can change over time.
- Dependency-vulnerability scanning had no available coverage because no language or package-manifest sources were observed in the snapshot; this is not evidence of dependency security.
Improvements
- Define a concise minimum output contract for each operating mode, such as problem, evidence, risk, decision, review trigger, and next step, to improve consistency across agents.
- Add one or two end-to-end examples showing how Option Map or Spike evidence becomes a Commit/Defer/Discard decision and proceeds to delivery or retirement.
- Automate validation of relative links, version, license, and distribution-statement consistency in release checks, and pin the installation CLI version.
Report metadata
ASR-AFA24D450037C052971dc1b732607f67c8bff93b413221ea5e4ac389552c582cf42c1e0e75b7fc2b72eae1f4a3eb4a652a9762adab204ffa175d48ddgpt-5.6-terraSkillSpector 2.11.1 · Trivy 0.74.0 · Gitleaks 8.30.1 · OSV-Scanner 2.5.11 generation attempt(s) · 0 structural repair(s)2026-09-07T20:24:57+00:00ai_share_skill_auto_review_v2-betaSecurity review reduces installation and usage risk but is not an absolute safety guarantee. Static scanners, third-party engines, and AI semantic review can all have false negatives or false positives.
Learn through sharing, improve through practice.

Community discussion
Discussion and rating
Capture real usage experience first; ratings are optional supporting signals.