job-determinate — Pipeline Intel + Artifact Plan

Status: Surface only. No contact made. No posts published.

Owner: Scott Scoble. Target: Determinate Systems. Angle: Nix-fluent, deterministic-builds specialist, open-source-first. Created: 2026-06-18

Determinate Systems is the highest-fit target on the job pipeline.

• Product surface IS a deterministic-builds platform.
• Engineering culture is Nix-ecosystem native.
• Org is small and founder-led.
• Scott artifacts (Nix flakes, deterministic-build tooling, Speckl provenance) speak to their roadmap.

---

1. The Company (one paragraph)

Determinate Systems, Inc. — Founded 2021. HQ: Brooklyn, NY (engineering distributed: MA, NY, Buenos Aires, Frankfurt, Utrecht, CA). Seed funded (last round Jun 2024). SOC 2 Type II. Small, focused team. Their commercial wedge is making Nix usable in the enterprise — a working installer, a binary cache, supply-chain security, and a path to deploy fleets of NixOS machines. Graham Christensen (CTO) and Eelco Dolstra (creator of Nix, co-founder) are both still technical and active in the codebase.

Public products:

Product	What it is	Repo
Determinate Nix	Patched, FIPS-friendly Nix distribution	DeterminateSystems/nix-src
Determinate Nix Installer	Single-binary installer	DeterminateSystems/nix-installer
FlakeHub	Binary cache + private flakes SaaS	DeterminateSystems/flakehub-*
FlakeHub Cache	Fast shared cache for GitHub Actions / CI	DeterminateSystems/magic-nix-cache
Zero to Nix	Free Nix learning site	DeterminateSystems/zero-to-nix
Flake Schemas	JSON-schema output contracts for flakes	DeterminateSystems/flake-schemas
FlakeBOM	CycloneDX SBOMs from Nix flakes	(announced on blog)

---

2. The Org Chart (engineering)

Source: https://determinate.systems/people (verbatim) + GitHub org membership + repo contributor activity.

Co-founders / Exec

• Eelco Dolstra — edolstra on GH. Co-founder. Creator of the Nix package manager. Utrecht, NL.
• Graham Christensen — grahamc on GH. Co-founder + CTO. Berkshire County, MA. Primary voice on Nix reproducibility. Most-likely hiring manager for an eng hire.
• Jeff Martens — CEO (non-eng; came from dev-tools PM).

Engineering (active)

• Cole Helbling — cole-h. Senior eng. Prolific GH committer (~141 commits on nix-installer, ~95 on magic-nix-cache). Nix + Rust.
• Cole Mickens — colemickens. Nix nerd, creator of nixpkgs-wayland. Desktop-Linux + Wayland focus.
• Dominique Hummel — Naxdy. Rust + Nix eng, Frankfurt. Wrote the Introducing FlakeBOM post (CycloneDX SBOMs from Nix flakes). Active Nixpkgs contributor.
• Tristan Ross — RossComputerGuy. Nixpkgs + LLVM maintainer, NixOS 24.11 release manager, low-level OS/Zig work.
• Alex Ford — Linux/Rust/cloud eng.
• Mo Lawler — sales / GTM-leaning. Prior at DigitalOcean, Equinix, Scale Computing.

Writing and DevRel

• Luc Perkins — lucperkins. Lead technical writer + engineer. 1385 commits on zero-to-nix. Public voice. Buenos Aires. Co-author of Seven Databases in Seven Weeks.

Adjacent (external contributors that look like staff but are NOT)

• Ana Hobden — Hoverbear. 417 commits on nix-installer (top external contributor). NOT on staff; she is at Ferrous Systems (Embassy / embedded Rust). Treat her as a peer.

Total engineering count (best estimate)

8 named humans on /people plus the public commit-attribution footprint suggests a lean team — likely 12 to 20 engineers total counting everyone not on the public page. There is no Director of Engineering visible. Graham (CTO) is the structural eng leader.

---

3. Open Roles (verbatim, as of 2026-06-18)

Finding: Determinate Systems does NOT publish an open jobs list through any board I can enumerate.

Source tried	Result
https://determinate.systems/careers	HTTP 404 (page does not exist; nav-link is dead)
https://determinate.systems/jobs	404
https://determinate.systems/team	404
https://jobs.ashbyhq.com/determinate	not found
https://api.ashbyhq.com/posting-api/job-board/determinate	404
https://boards.greenhouse.io/determinate	404
https://api.lever.co/v0/postings/determinate	404
https://apply.workable.com/api/v3/accounts/determinate-systems/jobs	404 (but determinate-systems.workable.com resolves — JS-rendered UI, no public JSON feed)
https://www.linkedin.com/company/determinate-systems/jobs/	200, only generic LinkedIn job-count widgets
https://wellfound.com/company/determinate-systems	403
https://www.ycombinator.com/companies/determinate-systems/jobs	404

Interpretation: The company is hiring selectively through direct outreach, not public postings. The /careers nav-link being 404 is itself a signal — they are not doing a hiring push. Any outreach should lead with the work, not the listing.

Best channels to enumerate roles (for next pass, requires browser):

1. https://determinate-systems.workable.com (exists, JS-rendered)
2. Determinate LinkedIn company page (auth-gated)
3. Email jobs@determinate.systems (suggested, do NOT send yet)

---

4. Public Surface (people worth reading before outreach)

Graham Christensen (CTO — primary)

• Personal site: https://grahamc.com
• GH: https://github.com/grahamc — 128 commits on determinate, 103 on nix-installer, 95 on magic-nix-cache, 42 commits on r13y.com (his NixOS reproducibility checker — directly relevant to Scott positioning).
• Podcast appearances: Open Source Ready — Reproducible Infrastructure with Graham Christensen of Determinate Systems.
• Blog: "The Nix moment" (2025), "Supply chain update", "GovCloud".

Cole Helbling (cole-h)

• GH: https://github.com/cole-h. 141 commits on nix-installer, prolific across the org.
• Active in flake-schemas, zero-to-nix, magic-nix-cache.
• Best read signal for day-to-day eng work and what "Nix-fluent engineer" actually means at DetSys.

Cole Mickens (colemickens)

• Creator of nixpkgs-wayland.
• Background in cloud-native + Linux desktop.
• Right peer for any desktop or packaging angle.

Dominique Hummel (Naxdy)

• Author of Introducing FlakeBOM — CycloneDX SBOMs from Nix flakes.
• Active Nixpkgs contributor.
• HIGHEST relevance to the Speckl-PROV-O-in-Nix-sandbox artifact plan. Dominique is the person who would immediately understand a Speckl-built SBOM, because he already shipped one.

Tristan Ross (RossComputerGuy)

• NixOS release manager.
• LLVM + low-level focus.
• Peer for any kernel, boot, or install-path questions.

Luc Perkins (lucperkins)

• https://lucperkins.dev
• 1385 commits on zero-to-nix.
• Public voice on Nix advocacy.
• Could be an effective introduction if approached via a technical-writing collaboration.

Eelco Dolstra (edolstra)

• Founder. Sparse social footprint. Email/repo issues only.
• Would only be engaged directly by something UNUSUAL — a unique insight into Nix internals, a contribution, an artifact nobody else has built.

The blog itself

https://determinate.systems/blog — author distribution from the last 8 posts:

Author	Posts in window
Luc Perkins	4
Graham Christensen	2
Dominique Hummel	1
Determinate Systems (collective)	1

This is the public stance of the company. Read at minimum: The Nix moment, Supply chain update, Introducing FlakeBOM, Determinate Secure Packages 26.05.

GitHub issues they care about (signal)

695 open issues across the org as of 2026-06-18. Highest-activity repos by issue churn: nix-installer, magic-nix-cache, determinate-nix-action, zero-to-nix. Watch the determinate monorepo for cross-cutting proposals — that is where architectural discussions live.

HackerNews presence

Story	Date	Pts
Dropping Upstream Nix from Determinate Nix Installer	2025-09-10	3
Nix at work: FlakeHub Cache and private flakes	2024-10-23	34
The Determinate Nix Installer	2023-02-27	250
We want to make Nix better	2022-09-02	223
The Magic Nix Cache	2023-06-26	195
Nix Survival Mode	2023-10-25	117
The future of software is Nix	2024-10-25	42

Graham comments. This is the right public venue for a "Show HN: Speckl provenance inside a Nix sandbox" submission (draft exists at speckl/docs/show-hn-launch-checklist.md).

---

5. Artifact Plan: Nix + Speckl provenance inside a Nix build

The pitch (one sentence)

Run the Speckl compiler inside a Nix stdenv derivation so the resulting TypeScript classes, PROV-O RDF graphs, CycloneDX SBOMs, and SPDX documents are emitted as first-class Nix store paths with cryptographic content-addressing.

This is the exact wedge for Determinate: they ship Nix-as-platform; Speckl already emits the provenance formats their supply-chain customers ask for (PROV-O, CycloneDX, SPDX). Folding Speckl into a Nix sandbox turns the Speckl compiler from an npm tool into a Nix build step that FlakeHub can cache and serve.

Why this is uniquely useful to Determinate

1. FlakeBOM is their existing CycloneDX work. Dominique wrote it. A Speckl-driven CycloneDX SBOM generated at Nix-build time is strictly stronger than FlakeBOM because the SBOM is tied to a content-hashed Nix store path, not a flake-output ad-hoc enumeration.
2. Determinate Secure Packages is their regulated-environment pitch. PROV-O provenance embedded at Nix-build time answers the question auditors actually ask: trace this binary back to its source specification — which is exactly what PROV-O is for.
3. FlakeHub is the cache. Speckl outputs are perfect cache citizens: deterministic, content-addressed, side-effect-free.

Concrete artifact (skeleton)

A flake that compiles every .speckdl file under ./specs/ to PROV-O + CycloneDX + SPDX + TypeScript, INSIDE the Nix sandbox, and exposes the results as flake outputs:

{
  description = "Speckl provenance compiled inside a Nix sandbox";

  inputs.speckl.url = "github:sscoble/speckl";      # Speckl compiler
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, speckl, nixpkgs }:
    let
      pkgs = import nixpkgs { system = "x86_64-linux"; };
      specklDrv = speckl.packages.x86_64-linux.default;

      # The Speckl compiler is RUN inside a Nix stdenv build.
      # No LLM in the build path; deterministic; cacheable.
      compileSpec = name: src: pkgs.stdenv.mkDerivation {
        inherit name;
        src = ./specs + "/${name}.speck";
        nativeBuildInputs = [ specklDrv ];
        buildPhase = ""
          specklc $src -o $out
        "";
        # Output is a directory with:
        #   ${name}.ts
        #   ${name}.prov-o.jsonld
        #   ${name}.cyclonedx.json
        #   ${name}.spdx.json
        installPhase = ""
          mkdir -p $out
          cp ${name}.ts ${name}.prov-o.jsonld \
             ${name}.cyclonedx.json ${name}.spdx.json $out/
        "";
        # CRITICAL: this derivation output hash IS the provenance key.
        # Anything that changes the spec, compiler, or inputs breaks the hash.
      };
    in {
      packages.x86_64-linux = {
        # Compile a couple of canonical specs.
        toggleswitch  = compileSpec "ToggleSwitch" ./specs;
        twoPhase      = compileSpec "TwoPhaseCommit" ./specs;
        # ...etc — one derivation per spec, all content-addressed.
      };

      # Aggregate all PROV-O graphs into a single queryable bundle.
      packages.x86_64-linux.provenance-bundle = pkgs.runCommand "speckl-prov-bundle" {} ""
        mkdir -p $out
        ${concatMapStringsSep "\n" (d: "cp ${d}/*.prov-o.jsonld $out/") (attrValues self.packages.x86_64-linux)}
      "";
    };
}

Specs to seed the repo with

Pick 4 to 6 from speckl/examples/ that are maximally relevant to Determinate customer base:

Spec	Why it is relevant to Determinate
ToggleSwitch.speck	minimal demo, ships first
AccountLedger.speck	financial-services customers
OAuth2AuthorizationCode.speck	enterprise SSO
RetryHandler.speck	resilient deploys
AccessControl.speck	RBAC for FlakeHub orgs
Raft.speck (or Paxos.speck)	distributed-systems credibility

The narrative for outreach

"I built a Nix flake that runs the Speckl compiler inside stdenv, so the PROV-O / CycloneDX / SPDX artifacts you need for supply-chain attestation come out as content-addressed Nix store paths. FlakeHub can cache them. Your customers auditors can trace any binary back to its SpeckDL specification. The Speckl compiler is deterministic — same spec, same artifacts, byte-for-byte — so it composes with everything you already do. I think this is the missing piece between FlakeBOM and an end-to-end attestation story."

Roadmap (what to ship BEFORE reaching out)

1. Skeleton flake — compiles ToggleSwitch.speck inside a Nix derivation.
2. All 6 specs compiling inside Nix.
3. The provenance-bundle aggregating PROV-O graphs.
4. A demo: nix build .#toggleswitch producing 4 files in the store.
5. A short blog post / Show HN draft (draft exists at speckl/docs/show-hn-launch-checklist.md).
6. README + a screenshot of nix flake show.

What NOT to do

• Do NOT post the artifact publicly before reaching out. Determinate is small enough that public framing matters.
• Do NOT use Speckl branding as the headline in any pitch. The headline is the NIX-NATIVE PROVENANCE PIPELINE. Speckl is one component.
• Do NOT pitch "AI generates your Nix config". That is the opposite of their values. The Speckl pitch is DETERMINISTIC COMPILATION, not generation.

---

6. Outreach Log (empty — do not contact yet)

Date	Target	Channel	Message	Outcome
—	—	—	—	—

---

7. Next move (single most-important action)

Finish the artifact (steps 1 to 4 above). Then a single, low-pressure outreach:

• Channel: A GitHub issue on DeterminateSystems/flakehub-mirror or DeterminateSystems/flake-schemas, framed as: "I built a Nix-native provenance pipeline using Speckl, would love feedback on whether this composes with FlakeHub cache layout."
• NOT a cold DM, NOT an email, NOT a tweet. GitHub is where Graham and Cole actually read.

If the GitHub comment gets a substantive reply → warm introduction to Graham via GH DM.

If it does not → Scott still ships the artifact publicly. Either outcome is a win.

---

Source provenance

• Org chart: https://determinate.systems/people fetched 2026-06-18.
• GitHub members: GET /orgs/DeterminateSystems/members fetched 2026-06-18.
• Repos + contributors: GitHub REST API, no auth, fetched 2026-06-18.
• Blog authors: HTML meta name="author" extraction across 8 recent posts.
• HN stories: hn.algolia.com/api/v1/search?query=Determinate+Systems&tags=story.
• Workable / Ashby / Greenhouse / Lever probes: HTTP status codes captured in section 3.
• This document itself was drafted by an AI subagent — review before any human use.