BCOS.md

BCOS — Beacon Certified Open Source

What is BCOS?

Beacon Certified Open Source (BCOS) is a human-review certification for open source repositories. It means:

1. Human Eyes Have Reviewed This Code — A real person has read through the source, not just an AI. We verify that code does what it claims and nothing more.

2. Safe for AI Agents — Certified repositories are safe for autonomous AI agents to install, import, and execute. No hidden telemetry, no supply chain attacks, no obfuscated payloads.

3. Protecting Open Source — BCOS exists because the AI agent era creates new risks: agents install packages autonomously, LLMs recommend code they haven't verified, and bad actors publish lookalike packages. BCOS is the human trust layer.

4. On-Chain Attestation — Every BCOS certification is backed by a cryptographic attestation on the RustChain blockchain, creating an immutable record of when and by whom the code was reviewed.

Certification Criteria

Requirement	Description
Source Readable	All source code is available and human-readable (no minified/obfuscated blobs)
No Hidden Network Calls	Code only contacts endpoints documented in README or config
No Credential Harvesting	Does not collect, exfiltrate, or phone home with user data
Declared Dependencies	All dependencies listed in manifest (requirements.txt, package.json, Cargo.toml, etc.)
Build Reproducible	Given the same inputs, produces the same outputs
License Clear	Open source license present and compatible
Human Reviewed	At least one named human has read the source and signed off

This Repository

Field	Value
Status	BCOS Certified
Reviewed By	Scott Boudreaux (@Scottcjn)
Organization	Elyan Labs
Chain	RustChain (Proof-of-Antiquity)

Why BCOS Matters

In the age of AI agents:

• Agents install packages autonomously — pip install, npm install, cargo add happen without human oversight
• LLMs recommend code — Models suggest libraries they've never verified
• Supply chain attacks are rising — Typosquatting, dependency confusion, and trojanized packages target automated systems
• Open source trust is fragile — One compromised maintainer can affect millions of downstream users

BCOS provides the missing human verification layer between open source code and the AI agents that consume it.

Verify a BCOS Certification

# Install the verification tool
pip install clawrtc

# Verify any BCOS-certified repo
clawrtc verify-bcos <github-url>

Or check the RustChain Explorer for on-chain attestation records.

Get BCOS Certified

To certify your own repository:

1. Ensure your code meets all criteria above
2. Submit a review request at rustchain-bounties
3. A human reviewer will audit your source
4. On approval, you receive the BCOS badge and on-chain attestation

---

BCOS is an initiative of Elyan Labs and the RustChain project.