poelzi

This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.

I guess, this is why I'm building tix.im ...

The trick was: Lime CHUNKS, proper volcanic fly ash, salt water + no steel. Self repairing and more flexible

i'm doing this using nix2container and a rust program that generates a landlock filter so i can mount nix store and only the supplied derivates are visible :) coming to you in a few month, tix.im

tbh, this is the most powerful computer program I have ever seen. Working on this now for over 6 month, ~600k LOC. I think it will grow to 800k in the base package. Unfortunately, uncompromised security requires quite some LOC.

This works: tix workflow submit ../vx-maintainer/workflows/change-management/default.nix --follow -- --feature-branch="feat/2lines" --instructions="tui overview should show running flows in 2 lines. 2 line: running steps, done, failed, etc. reports counter: info/success/failed/warning/error sparkle line with load ... . then if extended by double click, each running step has a line. what step, memory, cpu usage, token counters, ... subgraphs should be rendered under the parent flow. Title should always show that subgraph. details has link to parent " --source-repo=/home/poelzi/Projects/tix/tixim --implementor=opencode\#gpt-5.5

I get a human gate after the plan is finished where I can give feedback (in this workflow). And then another gate when everything is done. 4 different models, multiple harnesses, multiple reviews, rest cases etc. :) It makes me so smile watching the workflow progress. And the shit becomes global in a few days...

I have build a proper workflow system for complex work that composes environments from nix flakes (very extended flakes) - it allows you to combines deterministic with agentic steps. The release process is a workflow in your project that requires to generate reproducible outputs - nix does this for you. The network basically is a distributed CI system - Multiple parties need to check and build your release. When all parties agree, that the package is correct, the SUI smart contract gives it's go. IKA is a multi party encryption network which implements a novel MCP-2pc algorithm. Your release key is split in half - IKA has one part, you have the other. Only is both parties sign the transaction, your software package gets release. Every party, even your PC can be compromised, and it is very hard to just release malware in your package. The whole release pipeline needs to succeed ant then you need to sign it with your hardware token. There are mandatory workflows in the release pipeline that check your software for side loading, comparing your dependency tree to the last version published, etc.

It is the largest project I have ever build and I code since 25 years.

I was just not satisfied with the agentic tools out there, nor with the CI / build infrastructure. Nix is nice, but the way packages are build / signed is just half way to perfect.

We can be lucky that the github hack did not infect the CI infrastructure. Imagine you infect the compilers in github CI to add a sleeper worm that does nothing for a month...

Only if you have multiple parties, building the same software with bootstrapped compilers and every artifact is hash compared, you can be sure it is legit

Working hard on the github killer. Fully decentralized with nearly unbreakable release system. Multiple parties need to produce the same artifacts in the release workflow. IKA then signs the release on the network side, you sign your release using hardware token. Release pipeline analysis source code for malware on the complete dependency chain. Rust + Nix + SUI + WALRUS + SEAL + IKA - a complete decentralized economy. A few more weeks until testnet :)

Nobody uses grok except checking shit on X At least the hardware is not idle

I'm building a fix since over half a year. Very sophisticated workflow engine for the paranoid with strong AI integration and fully decentralized and deterministic behavior. Nix, Rust, SUI, Walrus, SEAL, IKA and my engine/framework + many tools. One goal is to have multiple workflows by independent parties that not only check the compiler output, but do advanced source chain analysis. When enough parties report successful run, the IKA network signs the build digests. You can hold the second part of the key, so only you + successful pipeline will result in a release. No single point of failure, no single party that can be hacked.

Overwhelming and overloaded. Terminals need to be 1 thing first: fast, and there it fails miserably.

I love niri. I'm half way through getting hdr rendering running

And also bridges the HDMI monitor into his network or does any OS automatically link that ? EoH is mostly for smart TVs

The nix store can do hard linking for the hashsum files. The nix store is read-only so you don't get modifications in general - does not really matter for boot disks, but in general.

The difference is, you can create proper abstraction modules that put everything together, from dependencies, to config files, firewall rules etc and have nice options for your abstraction.

No other system provides this in that sane way. I used countless configuration systems, from custom bash hacks, ansible, chef, puppet, salt - I have seen a lot.

Nix is just on another level. Never going back