From 92a039b0cc8e2b1f6f60e982c69aca159d14e1f4 Mon Sep 17 00:00:00 2001 From: sscoble Date: Wed, 8 Jul 2026 00:53:45 -0700 Subject: [PATCH] Fix framing: Speckl complements Sigstore (upstream of build), not extends it --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 4cca164..d8bda5c 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ ## 1. Why Chainguard -Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. The Speckl × Chainguard demo (Kafka KRaft provenance compile) demonstrates intent-level provenance that *complements* Chainguard's artifact-level provenance, not competes with it. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's. +Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. Speckl is a **complement** to Sigstore, not an extension: Speckl is upstream of the build (specifies what should exist, with what constraints); Sigstore attests to the build output (what was actually built, signed, attested). The two stack — Speckl adds *intent provenance* (the spec the artifact was generated from) on top of Factory 2.0's existing SLSA L3 artifact provenance. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's. ## 2. JD snapshot @@ -80,7 +80,7 @@ Chainguard's product is the canonical dark-factory: supply-chain attacks where a ### Premise -The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. The artifact proves Scott can build the thing that extends what Chainguard ships. +The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. Speckl is upstream of the build (the spec the artifact was generated from); Sigstore attests to the build output. The two stack. The artifact proves Scott can build the thing that composes with what Chainguard ships. ### Repo layout @@ -143,4 +143,4 @@ directive from the parent, surface only. Outreach log stays empty until *Captured 2026-07-07 by the job-pipeline subagent. Parent context: Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist -file: `~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md`.* +file: `~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md`.* \ No newline at end of file