marcus/job-determinate
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial surface: org chart + Nix+Speckl artifact plan (no contact)

Browse source
This commit is contained in:
Marcus Agent 2026-06-18 13:27:23 -07:00
commit 0e76ce5b17
3 changed files with 354 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

308
README.md Normal file
View file

@ -0,0 +1,308 @@
# job-determinate — Pipeline Intel + Artifact Plan
> Status: Surface only. No contact made. No posts published.
>
> Owner: Scott Scoble. Target: Determinate Systems.
> Angle: Nix-fluent, deterministic-builds specialist, open-source-first.
> Created: 2026-06-18
Determinate Systems is the highest-fit target on the job pipeline.
- Product surface IS a deterministic-builds platform.
- Engineering culture is Nix-ecosystem native.
- Org is small and founder-led.
- Scott artifacts (Nix flakes, deterministic-build tooling, Speckl provenance) speak to their roadmap.
---
## 1. The Company (one paragraph)
Determinate Systems, Inc. — Founded 2021. HQ: Brooklyn, NY (engineering distributed: MA, NY, Buenos Aires, Frankfurt, Utrecht, CA). Seed funded (last round Jun 2024). SOC 2 Type II. Small, focused team. Their commercial wedge is making Nix usable in the enterprise — a working installer, a binary cache, supply-chain security, and a path to deploy fleets of NixOS machines. Graham Christensen (CTO) and Eelco Dolstra (creator of Nix, co-founder) are both still technical and active in the codebase.
Public products:
| Product | What it is | Repo |
| --- | --- | --- |
| Determinate Nix | Patched, FIPS-friendly Nix distribution | DeterminateSystems/nix-src |
| Determinate Nix Installer | Single-binary installer | DeterminateSystems/nix-installer |
| FlakeHub | Binary cache + private flakes SaaS | DeterminateSystems/flakehub-* |
| FlakeHub Cache | Fast shared cache for GitHub Actions / CI | DeterminateSystems/magic-nix-cache |
| Zero to Nix | Free Nix learning site | DeterminateSystems/zero-to-nix |
| Flake Schemas | JSON-schema output contracts for flakes | DeterminateSystems/flake-schemas |
| FlakeBOM | CycloneDX SBOMs from Nix flakes | (announced on blog) |
---
## 2. The Org Chart (engineering)
Source: https://determinate.systems/people (verbatim) + GitHub org membership + repo contributor activity.
### Co-founders / Exec
- Eelco Dolstra — edolstra on GH. Co-founder. Creator of the Nix package manager. Utrecht, NL.
- Graham Christensen — grahamc on GH. Co-founder + CTO. Berkshire County, MA. Primary voice on Nix reproducibility. Most-likely hiring manager for an eng hire.
- Jeff Martens — CEO (non-eng; came from dev-tools PM).
### Engineering (active)
- Cole Helbling — cole-h. Senior eng. Prolific GH committer (~141 commits on nix-installer, ~95 on magic-nix-cache). Nix + Rust.
- Cole Mickens — colemickens. Nix nerd, creator of nixpkgs-wayland. Desktop-Linux + Wayland focus.
- Dominique Hummel — Naxdy. Rust + Nix eng, Frankfurt. Wrote the Introducing FlakeBOM post (CycloneDX SBOMs from Nix flakes). Active Nixpkgs contributor.
- Tristan Ross — RossComputerGuy. Nixpkgs + LLVM maintainer, NixOS 24.11 release manager, low-level OS/Zig work.
- Alex Ford — Linux/Rust/cloud eng.
- Mo Lawler — sales / GTM-leaning. Prior at DigitalOcean, Equinix, Scale Computing.
### Writing and DevRel
- Luc Perkins — lucperkins. Lead technical writer + engineer. 1385 commits on zero-to-nix. Public voice. Buenos Aires. Co-author of Seven Databases in Seven Weeks.
### Adjacent (external contributors that look like staff but are NOT)
- Ana Hobden — Hoverbear. 417 commits on nix-installer (top external contributor). NOT on staff; she is at Ferrous Systems (Embassy / embedded Rust). Treat her as a peer.
### Total engineering count (best estimate)
8 named humans on /people plus the public commit-attribution footprint suggests a lean team — likely 12 to 20 engineers total counting everyone not on the public page. There is no Director of Engineering visible. Graham (CTO) is the structural eng leader.
---
## 3. Open Roles (verbatim, as of 2026-06-18)
Finding: Determinate Systems does NOT publish an open jobs list through any board I can enumerate.
| Source tried | Result |
| --- | --- |
| https://determinate.systems/careers | HTTP 404 (page does not exist; nav-link is dead) |
| https://determinate.systems/jobs | 404 |
| https://determinate.systems/team | 404 |
| https://jobs.ashbyhq.com/determinate | not found |
| https://api.ashbyhq.com/posting-api/job-board/determinate | 404 |
| https://boards.greenhouse.io/determinate | 404 |
| https://api.lever.co/v0/postings/determinate | 404 |
| https://apply.workable.com/api/v3/accounts/determinate-systems/jobs | 404 (but determinate-systems.workable.com resolves — JS-rendered UI, no public JSON feed) |
| https://www.linkedin.com/company/determinate-systems/jobs/ | 200, only generic LinkedIn job-count widgets |
| https://wellfound.com/company/determinate-systems | 403 |
| https://www.ycombinator.com/companies/determinate-systems/jobs | 404 |
Interpretation: The company is hiring selectively through direct outreach, not public postings. The /careers nav-link being 404 is itself a signal — they are not doing a hiring push. Any outreach should lead with the work, not the listing.
Best channels to enumerate roles (for next pass, requires browser):
1. https://determinate-systems.workable.com (exists, JS-rendered)
2. Determinate LinkedIn company page (auth-gated)
3. Email jobs@determinate.systems (suggested, do NOT send yet)
---
## 4. Public Surface (people worth reading before outreach)
### Graham Christensen (CTO — primary)
- Personal site: https://grahamc.com
- GH: https://github.com/grahamc — 128 commits on determinate, 103 on nix-installer, 95 on magic-nix-cache, 42 commits on r13y.com (his NixOS reproducibility checker — directly relevant to Scott positioning).
- Podcast appearances: Open Source Ready — Reproducible Infrastructure with Graham Christensen of Determinate Systems.
- Blog: "The Nix moment" (2025), "Supply chain update", "GovCloud".
### Cole Helbling (cole-h)
- GH: https://github.com/cole-h. 141 commits on nix-installer, prolific across the org.
- Active in flake-schemas, zero-to-nix, magic-nix-cache.
- Best read signal for day-to-day eng work and what "Nix-fluent engineer" actually means at DetSys.
### Cole Mickens (colemickens)
- Creator of nixpkgs-wayland.
- Background in cloud-native + Linux desktop.
- Right peer for any desktop or packaging angle.
### Dominique Hummel (Naxdy)
- Author of Introducing FlakeBOM — CycloneDX SBOMs from Nix flakes.
- Active Nixpkgs contributor.
- HIGHEST relevance to the Speckl-PROV-O-in-Nix-sandbox artifact plan. Dominique is the person who would immediately understand a Speckl-built SBOM, because he already shipped one.
### Tristan Ross (RossComputerGuy)
- NixOS release manager.
- LLVM + low-level focus.
- Peer for any kernel, boot, or install-path questions.
### Luc Perkins (lucperkins)
- https://lucperkins.dev
- 1385 commits on zero-to-nix.
- Public voice on Nix advocacy.
- Could be an effective introduction if approached via a technical-writing collaboration.
### Eelco Dolstra (edolstra)
- Founder. Sparse social footprint. Email/repo issues only.
- Would only be engaged directly by something UNUSUAL — a unique insight into Nix internals, a contribution, an artifact nobody else has built.
### The blog itself
https://determinate.systems/blog — author distribution from the last 8 posts:
| Author | Posts in window |
| --- | --- |
| Luc Perkins | 4 |
| Graham Christensen | 2 |
| Dominique Hummel | 1 |
| Determinate Systems (collective) | 1 |
This is the public stance of the company. Read at minimum: The Nix moment, Supply chain update, Introducing FlakeBOM, Determinate Secure Packages 26.05.
### GitHub issues they care about (signal)
695 open issues across the org as of 2026-06-18. Highest-activity repos by issue churn: nix-installer, magic-nix-cache, determinate-nix-action, zero-to-nix. Watch the determinate monorepo for cross-cutting proposals — that is where architectural discussions live.
### HackerNews presence
| Story | Date | Pts |
| --- | --- | --- |
| Dropping Upstream Nix from Determinate Nix Installer | 2025-09-10 | 3 |
| Nix at work: FlakeHub Cache and private flakes | 2024-10-23 | 34 |
| The Determinate Nix Installer | 2023-02-27 | 250 |
| We want to make Nix better | 2022-09-02 | 223 |
| The Magic Nix Cache | 2023-06-26 | 195 |
| Nix Survival Mode | 2023-10-25 | 117 |
| The future of software is Nix | 2024-10-25 | 42 |
Graham comments. This is the right public venue for a "Show HN: Speckl provenance inside a Nix sandbox" submission (draft exists at speckl/docs/show-hn-launch-checklist.md).
---
## 5. Artifact Plan: Nix + Speckl provenance inside a Nix build
### The pitch (one sentence)
> Run the Speckl compiler inside a Nix stdenv derivation so the resulting TypeScript classes, PROV-O RDF graphs, CycloneDX SBOMs, and SPDX documents are emitted as first-class Nix store paths with cryptographic content-addressing.
This is the exact wedge for Determinate: they ship Nix-as-platform; Speckl already emits the provenance formats their supply-chain customers ask for (PROV-O, CycloneDX, SPDX). Folding Speckl into a Nix sandbox turns the Speckl compiler from an npm tool into a Nix build step that FlakeHub can cache and serve.
### Why this is uniquely useful to Determinate
1. FlakeBOM is their existing CycloneDX work. Dominique wrote it. A Speckl-driven CycloneDX SBOM generated at Nix-build time is strictly stronger than FlakeBOM because the SBOM is tied to a content-hashed Nix store path, not a flake-output ad-hoc enumeration.
2. Determinate Secure Packages is their regulated-environment pitch. PROV-O provenance embedded at Nix-build time answers the question auditors actually ask: trace this binary back to its source specification — which is exactly what PROV-O is for.
3. FlakeHub is the cache. Speckl outputs are perfect cache citizens: deterministic, content-addressed, side-effect-free.
### Concrete artifact (skeleton)
A flake that compiles every .speckdl file under ./specs/ to PROV-O + CycloneDX + SPDX + TypeScript, INSIDE the Nix sandbox, and exposes the results as flake outputs:
```nix
{
description = "Speckl provenance compiled inside a Nix sandbox";
inputs.speckl.url = "github:sscoble/speckl"; # Speckl compiler
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
outputs = { self, speckl, nixpkgs }:
let
pkgs = import nixpkgs { system = "x86_64-linux"; };
specklDrv = speckl.packages.x86_64-linux.default;
# The Speckl compiler is RUN inside a Nix stdenv build.
# No LLM in the build path; deterministic; cacheable.
compileSpec = name: src: pkgs.stdenv.mkDerivation {
inherit name;
src = ./specs + "/${name}.speck";
nativeBuildInputs = [ specklDrv ];
buildPhase = ""
specklc $src -o $out
"";
# Output is a directory with:
# ${name}.ts
# ${name}.prov-o.jsonld
# ${name}.cyclonedx.json
# ${name}.spdx.json
installPhase = ""
mkdir -p $out
cp ${name}.ts ${name}.prov-o.jsonld \
${name}.cyclonedx.json ${name}.spdx.json $out/
"";
# CRITICAL: this derivation output hash IS the provenance key.
# Anything that changes the spec, compiler, or inputs breaks the hash.
};
in {
packages.x86_64-linux = {
# Compile a couple of canonical specs.
toggleswitch = compileSpec "ToggleSwitch" ./specs;
twoPhase = compileSpec "TwoPhaseCommit" ./specs;
# ...etc — one derivation per spec, all content-addressed.
};
# Aggregate all PROV-O graphs into a single queryable bundle.
packages.x86_64-linux.provenance-bundle = pkgs.runCommand "speckl-prov-bundle" {} ""
mkdir -p $out
${concatMapStringsSep "\n" (d: "cp ${d}/*.prov-o.jsonld $out/") (attrValues self.packages.x86_64-linux)}
"";
};
}
```
### Specs to seed the repo with
Pick 4 to 6 from speckl/examples/ that are maximally relevant to Determinate customer base:
| Spec | Why it is relevant to Determinate |
| --- | --- |
| ToggleSwitch.speck | minimal demo, ships first |
| AccountLedger.speck | financial-services customers |
| OAuth2AuthorizationCode.speck | enterprise SSO |
| RetryHandler.speck | resilient deploys |
| AccessControl.speck | RBAC for FlakeHub orgs |
| Raft.speck (or Paxos.speck) | distributed-systems credibility |
### The narrative for outreach
> "I built a Nix flake that runs the Speckl compiler inside stdenv, so the PROV-O / CycloneDX / SPDX artifacts you need for supply-chain attestation come out as content-addressed Nix store paths. FlakeHub can cache them. Your customers auditors can trace any binary back to its SpeckDL specification. The Speckl compiler is deterministic — same spec, same artifacts, byte-for-byte — so it composes with everything you already do. I think this is the missing piece between FlakeBOM and an end-to-end attestation story."
### Roadmap (what to ship BEFORE reaching out)
1. Skeleton flake — compiles ToggleSwitch.speck inside a Nix derivation.
2. All 6 specs compiling inside Nix.
3. The provenance-bundle aggregating PROV-O graphs.
4. A demo: nix build .#toggleswitch producing 4 files in the store.
5. A short blog post / Show HN draft (draft exists at speckl/docs/show-hn-launch-checklist.md).
6. README + a screenshot of nix flake show.
### What NOT to do
- Do NOT post the artifact publicly before reaching out. Determinate is small enough that public framing matters.
- Do NOT use Speckl branding as the headline in any pitch. The headline is the NIX-NATIVE PROVENANCE PIPELINE. Speckl is one component.
- Do NOT pitch "AI generates your Nix config". That is the opposite of their values. The Speckl pitch is DETERMINISTIC COMPILATION, not generation.
---
## 6. Outreach Log (empty — do not contact yet)
| Date | Target | Channel | Message | Outcome |
| --- | --- | --- | --- | --- |
| — | — | — | — | — |
---
## 7. Next move (single most-important action)
Finish the artifact (steps 1 to 4 above). Then a single, low-pressure outreach:
- Channel: A GitHub issue on DeterminateSystems/flakehub-mirror or DeterminateSystems/flake-schemas, framed as: "I built a Nix-native provenance pipeline using Speckl, would love feedback on whether this composes with FlakeHub cache layout."
- NOT a cold DM, NOT an email, NOT a tweet. GitHub is where Graham and Cole actually read.
If the GitHub comment gets a substantive reply → warm introduction to Graham via GH DM.
If it does not → Scott still ships the artifact publicly. Either outcome is a win.
---
## Source provenance
- Org chart: https://determinate.systems/people fetched 2026-06-18.
- GitHub members: GET /orgs/DeterminateSystems/members fetched 2026-06-18.
- Repos + contributors: GitHub REST API, no auth, fetched 2026-06-18.
- Blog authors: HTML meta name="author" extraction across 8 recent posts.
- HN stories: hn.algolia.com/api/v1/search?query=Determinate+Systems&tags=story.
- Workable / Ashby / Greenhouse / Lever probes: HTTP status codes captured in section 3.
- This document itself was drafted by an AI subagent — review before any human use.

30
ToggleSwitch.speck Normal file
View file

@ -0,0 +1,30 @@
speck ToggleSwitch {
// Simplest possible state machine: on/off toggle
// Demonstrates the v0.3 imperative action body syntax
state {
isOn: Bool
}
init {
isOn == false
}
invariant SwitchConsistent {
isOn in {true, false}
}
action TurnOn {
require not isOn
isOn := true
return isOn
}
action TurnOff {
require isOn
isOn := false
return isOn
}
next: TurnOn | TurnOff
}

16
flake.nix Normal file
View file

@ -0,0 +1,16 @@
{
description = "Speckl provenance compiled inside a Nix sandbox (skeleton)";
# Full implementation in section 5 of README.md. This file is a stub for
# repo-validity and to give Forgejo a recognized Nix flake entry point.
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
outputs = { self, nixpkgs }:
let
pkgs = import nixpkgs { system = "x86_64-linux"; };
in {
# A trivial derivation that proves the flake is buildable. Replace with
# the Speckl compileSpec helper from README section 5.
packages.x86_64-linux.hello = pkgs.hello;
};
}