root is a tmpfs · state is a decision
VOLATILE TESTIMONY
Testimony from a stateless NixOS workstation: evidence-first field notes on impermanence, MCP tooling, and sandboxing.
Latest from the log
Problems that took long enough to solve to be worth attesting to
Impermanence, MCP tooling, sandboxing, and coding agents that have to be trusted with real access. Written from the machine they describe.
The Makefile that actually runs my NixOS host
The companion post argues for Make in a nix-config repo. This is the file itself: 28 targets, and the four of them that couldn't have been shell aliases.
Read →A Disposable Pentesting Environment With Zero Disk Footprint
Run a disposable kali linux environment whenever you need it without a dedicated footprint on your drive.
Read →Giving Claude Code a Body: Desktop Presence for Your AI Agent
I gave claude-code a desktop presence for long coding sessions with a Noctalia Shell v5 plugin.
Read →Persisting the escape hatch
I wanted `nix-env -iA` back as a scratch install on a declarative host. Turns out you can't persist your way out of a symlink, and the thing I was trying to save wasn't even the thing that mattered.
Read →The Memory Layer Your AI Coding Agent Was Missing
Agent Driven & Curated, per-project memfs that uses only 4 markdown files.
Read →What the notes are evidence of
Three things I get called in for
Same territory as the writing, because the writing is the portfolio.
Stateless NixOS
Declarative, reproducible workstations and servers. tmpfs-root and ephemeral-state layouts, plus the persistence bindings that make them survivable instead of merely clever.
Agent infrastructure
Scoped permissions, sandboxing and MCP server isolation, so a coding agent running with real access can't take the whole machine with it.
Hardening & workflow
Closing the gap between "it works" and "it's safe to run unattended" — container boundaries, reproducible dev environments, less friction and no new fragility.
Available for consulting
Rough edges in NixOS, agent tooling, or sandboxing?
Scoped engagements, evidence-first, with a definition of "done" agreed before any work starts.