From 0e76ce5b17ad4772c0d1596a7517b014f9dff08d Mon Sep 17 00:00:00 2001 From: Marcus Agent Date: Thu, 18 Jun 2026 13:27:23 -0700 Subject: [PATCH] Initial surface: org chart + Nix+Speckl artifact plan (no contact) --- README.md | 308 +++++++++++++++++++++++++++++++++++++++++++++ ToggleSwitch.speck | 30 +++++ flake.nix | 16 +++ 3 files changed, 354 insertions(+) create mode 100644 README.md create mode 100644 ToggleSwitch.speck create mode 100644 flake.nix diff --git a/README.md b/README.md new file mode 100644 index 0000000..96c9eb1 --- /dev/null +++ b/README.md @@ -0,0 +1,308 @@ +# job-determinate — Pipeline Intel + Artifact Plan + +> Status: Surface only. No contact made. No posts published. +> +> Owner: Scott Scoble. Target: Determinate Systems. +> Angle: Nix-fluent, deterministic-builds specialist, open-source-first. +> Created: 2026-06-18 + +Determinate Systems is the highest-fit target on the job pipeline. + +- Product surface IS a deterministic-builds platform. +- Engineering culture is Nix-ecosystem native. +- Org is small and founder-led. +- Scott artifacts (Nix flakes, deterministic-build tooling, Speckl provenance) speak to their roadmap. + +--- + +## 1. The Company (one paragraph) + +Determinate Systems, Inc. — Founded 2021. HQ: Brooklyn, NY (engineering distributed: MA, NY, Buenos Aires, Frankfurt, Utrecht, CA). Seed funded (last round Jun 2024). SOC 2 Type II. Small, focused team. Their commercial wedge is making Nix usable in the enterprise — a working installer, a binary cache, supply-chain security, and a path to deploy fleets of NixOS machines. Graham Christensen (CTO) and Eelco Dolstra (creator of Nix, co-founder) are both still technical and active in the codebase. + +Public products: + +| Product | What it is | Repo | +| --- | --- | --- | +| Determinate Nix | Patched, FIPS-friendly Nix distribution | DeterminateSystems/nix-src | +| Determinate Nix Installer | Single-binary installer | DeterminateSystems/nix-installer | +| FlakeHub | Binary cache + private flakes SaaS | DeterminateSystems/flakehub-* | +| FlakeHub Cache | Fast shared cache for GitHub Actions / CI | DeterminateSystems/magic-nix-cache | +| Zero to Nix | Free Nix learning site | DeterminateSystems/zero-to-nix | +| Flake Schemas | JSON-schema output contracts for flakes | DeterminateSystems/flake-schemas | +| FlakeBOM | CycloneDX SBOMs from Nix flakes | (announced on blog) | + +--- + +## 2. The Org Chart (engineering) + +Source: https://determinate.systems/people (verbatim) + GitHub org membership + repo contributor activity. + +### Co-founders / Exec + +- Eelco Dolstra — edolstra on GH. Co-founder. Creator of the Nix package manager. Utrecht, NL. +- Graham Christensen — grahamc on GH. Co-founder + CTO. Berkshire County, MA. Primary voice on Nix reproducibility. Most-likely hiring manager for an eng hire. +- Jeff Martens — CEO (non-eng; came from dev-tools PM). + +### Engineering (active) + +- Cole Helbling — cole-h. Senior eng. Prolific GH committer (~141 commits on nix-installer, ~95 on magic-nix-cache). Nix + Rust. +- Cole Mickens — colemickens. Nix nerd, creator of nixpkgs-wayland. Desktop-Linux + Wayland focus. +- Dominique Hummel — Naxdy. Rust + Nix eng, Frankfurt. Wrote the Introducing FlakeBOM post (CycloneDX SBOMs from Nix flakes). Active Nixpkgs contributor. +- Tristan Ross — RossComputerGuy. Nixpkgs + LLVM maintainer, NixOS 24.11 release manager, low-level OS/Zig work. +- Alex Ford — Linux/Rust/cloud eng. +- Mo Lawler — sales / GTM-leaning. Prior at DigitalOcean, Equinix, Scale Computing. + +### Writing and DevRel + +- Luc Perkins — lucperkins. Lead technical writer + engineer. 1385 commits on zero-to-nix. Public voice. Buenos Aires. Co-author of Seven Databases in Seven Weeks. + +### Adjacent (external contributors that look like staff but are NOT) + +- Ana Hobden — Hoverbear. 417 commits on nix-installer (top external contributor). NOT on staff; she is at Ferrous Systems (Embassy / embedded Rust). Treat her as a peer. + +### Total engineering count (best estimate) + +8 named humans on /people plus the public commit-attribution footprint suggests a lean team — likely 12 to 20 engineers total counting everyone not on the public page. There is no Director of Engineering visible. Graham (CTO) is the structural eng leader. + +--- + +## 3. Open Roles (verbatim, as of 2026-06-18) + +Finding: Determinate Systems does NOT publish an open jobs list through any board I can enumerate. + +| Source tried | Result | +| --- | --- | +| https://determinate.systems/careers | HTTP 404 (page does not exist; nav-link is dead) | +| https://determinate.systems/jobs | 404 | +| https://determinate.systems/team | 404 | +| https://jobs.ashbyhq.com/determinate | not found | +| https://api.ashbyhq.com/posting-api/job-board/determinate | 404 | +| https://boards.greenhouse.io/determinate | 404 | +| https://api.lever.co/v0/postings/determinate | 404 | +| https://apply.workable.com/api/v3/accounts/determinate-systems/jobs | 404 (but determinate-systems.workable.com resolves — JS-rendered UI, no public JSON feed) | +| https://www.linkedin.com/company/determinate-systems/jobs/ | 200, only generic LinkedIn job-count widgets | +| https://wellfound.com/company/determinate-systems | 403 | +| https://www.ycombinator.com/companies/determinate-systems/jobs | 404 | + +Interpretation: The company is hiring selectively through direct outreach, not public postings. The /careers nav-link being 404 is itself a signal — they are not doing a hiring push. Any outreach should lead with the work, not the listing. + +Best channels to enumerate roles (for next pass, requires browser): + +1. https://determinate-systems.workable.com (exists, JS-rendered) +2. Determinate LinkedIn company page (auth-gated) +3. Email jobs@determinate.systems (suggested, do NOT send yet) + +--- + +## 4. Public Surface (people worth reading before outreach) + +### Graham Christensen (CTO — primary) + +- Personal site: https://grahamc.com +- GH: https://github.com/grahamc — 128 commits on determinate, 103 on nix-installer, 95 on magic-nix-cache, 42 commits on r13y.com (his NixOS reproducibility checker — directly relevant to Scott positioning). +- Podcast appearances: Open Source Ready — Reproducible Infrastructure with Graham Christensen of Determinate Systems. +- Blog: "The Nix moment" (2025), "Supply chain update", "GovCloud". + +### Cole Helbling (cole-h) + +- GH: https://github.com/cole-h. 141 commits on nix-installer, prolific across the org. +- Active in flake-schemas, zero-to-nix, magic-nix-cache. +- Best read signal for day-to-day eng work and what "Nix-fluent engineer" actually means at DetSys. + +### Cole Mickens (colemickens) + +- Creator of nixpkgs-wayland. +- Background in cloud-native + Linux desktop. +- Right peer for any desktop or packaging angle. + +### Dominique Hummel (Naxdy) + +- Author of Introducing FlakeBOM — CycloneDX SBOMs from Nix flakes. +- Active Nixpkgs contributor. +- HIGHEST relevance to the Speckl-PROV-O-in-Nix-sandbox artifact plan. Dominique is the person who would immediately understand a Speckl-built SBOM, because he already shipped one. + +### Tristan Ross (RossComputerGuy) + +- NixOS release manager. +- LLVM + low-level focus. +- Peer for any kernel, boot, or install-path questions. + +### Luc Perkins (lucperkins) + +- https://lucperkins.dev +- 1385 commits on zero-to-nix. +- Public voice on Nix advocacy. +- Could be an effective introduction if approached via a technical-writing collaboration. + +### Eelco Dolstra (edolstra) + +- Founder. Sparse social footprint. Email/repo issues only. +- Would only be engaged directly by something UNUSUAL — a unique insight into Nix internals, a contribution, an artifact nobody else has built. + + +### The blog itself + +https://determinate.systems/blog — author distribution from the last 8 posts: + +| Author | Posts in window | +| --- | --- | +| Luc Perkins | 4 | +| Graham Christensen | 2 | +| Dominique Hummel | 1 | +| Determinate Systems (collective) | 1 | + +This is the public stance of the company. Read at minimum: The Nix moment, Supply chain update, Introducing FlakeBOM, Determinate Secure Packages 26.05. + +### GitHub issues they care about (signal) + +695 open issues across the org as of 2026-06-18. Highest-activity repos by issue churn: nix-installer, magic-nix-cache, determinate-nix-action, zero-to-nix. Watch the determinate monorepo for cross-cutting proposals — that is where architectural discussions live. + +### HackerNews presence + +| Story | Date | Pts | +| --- | --- | --- | +| Dropping Upstream Nix from Determinate Nix Installer | 2025-09-10 | 3 | +| Nix at work: FlakeHub Cache and private flakes | 2024-10-23 | 34 | +| The Determinate Nix Installer | 2023-02-27 | 250 | +| We want to make Nix better | 2022-09-02 | 223 | +| The Magic Nix Cache | 2023-06-26 | 195 | +| Nix Survival Mode | 2023-10-25 | 117 | +| The future of software is Nix | 2024-10-25 | 42 | + +Graham comments. This is the right public venue for a "Show HN: Speckl provenance inside a Nix sandbox" submission (draft exists at speckl/docs/show-hn-launch-checklist.md). + +--- + +## 5. Artifact Plan: Nix + Speckl provenance inside a Nix build + +### The pitch (one sentence) + +> Run the Speckl compiler inside a Nix stdenv derivation so the resulting TypeScript classes, PROV-O RDF graphs, CycloneDX SBOMs, and SPDX documents are emitted as first-class Nix store paths with cryptographic content-addressing. + +This is the exact wedge for Determinate: they ship Nix-as-platform; Speckl already emits the provenance formats their supply-chain customers ask for (PROV-O, CycloneDX, SPDX). Folding Speckl into a Nix sandbox turns the Speckl compiler from an npm tool into a Nix build step that FlakeHub can cache and serve. + +### Why this is uniquely useful to Determinate + +1. FlakeBOM is their existing CycloneDX work. Dominique wrote it. A Speckl-driven CycloneDX SBOM generated at Nix-build time is strictly stronger than FlakeBOM because the SBOM is tied to a content-hashed Nix store path, not a flake-output ad-hoc enumeration. +2. Determinate Secure Packages is their regulated-environment pitch. PROV-O provenance embedded at Nix-build time answers the question auditors actually ask: trace this binary back to its source specification — which is exactly what PROV-O is for. +3. FlakeHub is the cache. Speckl outputs are perfect cache citizens: deterministic, content-addressed, side-effect-free. + +### Concrete artifact (skeleton) + +A flake that compiles every .speckdl file under ./specs/ to PROV-O + CycloneDX + SPDX + TypeScript, INSIDE the Nix sandbox, and exposes the results as flake outputs: + +```nix +{ + description = "Speckl provenance compiled inside a Nix sandbox"; + + inputs.speckl.url = "github:sscoble/speckl"; # Speckl compiler + inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + + outputs = { self, speckl, nixpkgs }: + let + pkgs = import nixpkgs { system = "x86_64-linux"; }; + specklDrv = speckl.packages.x86_64-linux.default; + + # The Speckl compiler is RUN inside a Nix stdenv build. + # No LLM in the build path; deterministic; cacheable. + compileSpec = name: src: pkgs.stdenv.mkDerivation { + inherit name; + src = ./specs + "/${name}.speck"; + nativeBuildInputs = [ specklDrv ]; + buildPhase = "" + specklc $src -o $out + ""; + # Output is a directory with: + # ${name}.ts + # ${name}.prov-o.jsonld + # ${name}.cyclonedx.json + # ${name}.spdx.json + installPhase = "" + mkdir -p $out + cp ${name}.ts ${name}.prov-o.jsonld \ + ${name}.cyclonedx.json ${name}.spdx.json $out/ + ""; + # CRITICAL: this derivation output hash IS the provenance key. + # Anything that changes the spec, compiler, or inputs breaks the hash. + }; + in { + packages.x86_64-linux = { + # Compile a couple of canonical specs. + toggleswitch = compileSpec "ToggleSwitch" ./specs; + twoPhase = compileSpec "TwoPhaseCommit" ./specs; + # ...etc — one derivation per spec, all content-addressed. + }; + + # Aggregate all PROV-O graphs into a single queryable bundle. + packages.x86_64-linux.provenance-bundle = pkgs.runCommand "speckl-prov-bundle" {} "" + mkdir -p $out + ${concatMapStringsSep "\n" (d: "cp ${d}/*.prov-o.jsonld $out/") (attrValues self.packages.x86_64-linux)} + ""; + }; +} +``` + +### Specs to seed the repo with + +Pick 4 to 6 from speckl/examples/ that are maximally relevant to Determinate customer base: + +| Spec | Why it is relevant to Determinate | +| --- | --- | +| ToggleSwitch.speck | minimal demo, ships first | +| AccountLedger.speck | financial-services customers | +| OAuth2AuthorizationCode.speck | enterprise SSO | +| RetryHandler.speck | resilient deploys | +| AccessControl.speck | RBAC for FlakeHub orgs | +| Raft.speck (or Paxos.speck) | distributed-systems credibility | + +### The narrative for outreach + +> "I built a Nix flake that runs the Speckl compiler inside stdenv, so the PROV-O / CycloneDX / SPDX artifacts you need for supply-chain attestation come out as content-addressed Nix store paths. FlakeHub can cache them. Your customers auditors can trace any binary back to its SpeckDL specification. The Speckl compiler is deterministic — same spec, same artifacts, byte-for-byte — so it composes with everything you already do. I think this is the missing piece between FlakeBOM and an end-to-end attestation story." + +### Roadmap (what to ship BEFORE reaching out) + +1. Skeleton flake — compiles ToggleSwitch.speck inside a Nix derivation. +2. All 6 specs compiling inside Nix. +3. The provenance-bundle aggregating PROV-O graphs. +4. A demo: nix build .#toggleswitch producing 4 files in the store. +5. A short blog post / Show HN draft (draft exists at speckl/docs/show-hn-launch-checklist.md). +6. README + a screenshot of nix flake show. + +### What NOT to do + +- Do NOT post the artifact publicly before reaching out. Determinate is small enough that public framing matters. +- Do NOT use Speckl branding as the headline in any pitch. The headline is the NIX-NATIVE PROVENANCE PIPELINE. Speckl is one component. +- Do NOT pitch "AI generates your Nix config". That is the opposite of their values. The Speckl pitch is DETERMINISTIC COMPILATION, not generation. + +--- + +## 6. Outreach Log (empty — do not contact yet) + +| Date | Target | Channel | Message | Outcome | +| --- | --- | --- | --- | --- | +| — | — | — | — | — | + +--- + +## 7. Next move (single most-important action) + +Finish the artifact (steps 1 to 4 above). Then a single, low-pressure outreach: + +- Channel: A GitHub issue on DeterminateSystems/flakehub-mirror or DeterminateSystems/flake-schemas, framed as: "I built a Nix-native provenance pipeline using Speckl, would love feedback on whether this composes with FlakeHub cache layout." +- NOT a cold DM, NOT an email, NOT a tweet. GitHub is where Graham and Cole actually read. + +If the GitHub comment gets a substantive reply → warm introduction to Graham via GH DM. + +If it does not → Scott still ships the artifact publicly. Either outcome is a win. + +--- + +## Source provenance + +- Org chart: https://determinate.systems/people fetched 2026-06-18. +- GitHub members: GET /orgs/DeterminateSystems/members fetched 2026-06-18. +- Repos + contributors: GitHub REST API, no auth, fetched 2026-06-18. +- Blog authors: HTML meta name="author" extraction across 8 recent posts. +- HN stories: hn.algolia.com/api/v1/search?query=Determinate+Systems&tags=story. +- Workable / Ashby / Greenhouse / Lever probes: HTTP status codes captured in section 3. +- This document itself was drafted by an AI subagent — review before any human use. diff --git a/ToggleSwitch.speck b/ToggleSwitch.speck new file mode 100644 index 0000000..a957b30 --- /dev/null +++ b/ToggleSwitch.speck @@ -0,0 +1,30 @@ +speck ToggleSwitch { + // Simplest possible state machine: on/off toggle + // Demonstrates the v0.3 imperative action body syntax + + state { + isOn: Bool + } + + init { + isOn == false + } + + invariant SwitchConsistent { + isOn in {true, false} + } + + action TurnOn { + require not isOn + isOn := true + return isOn + } + + action TurnOff { + require isOn + isOn := false + return isOn + } + + next: TurnOn | TurnOff +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..792ec34 --- /dev/null +++ b/flake.nix @@ -0,0 +1,16 @@ +{ + description = "Speckl provenance compiled inside a Nix sandbox (skeleton)"; + # Full implementation in section 5 of README.md. This file is a stub for + # repo-validity and to give Forgejo a recognized Nix flake entry point. + + inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + + outputs = { self, nixpkgs }: + let + pkgs = import nixpkgs { system = "x86_64-linux"; }; + in { + # A trivial derivation that proves the flake is buildable. Replace with + # the Speckl compileSpec helper from README section 5. + packages.x86_64-linux.hello = pkgs.hello; + }; +}