TABConf 8

Agentic Engineering
for Bitcoin Developers

allod, n. Land held in absolute ownership; its holder recognizes no higher authority or master.

Declarative nix environments
Ephemeral hosts
Agentic tools and harness
Self-hostable code forge
Interchangeable dependencies

Slidesworkshop.anarch.diy

Discussion

What to take away from this talk

Code doesn't matter anymore.
Architecture barely matters.Soon, it won't.
So what does matter?Design principles. Clarity of goals. Execution. Velocity.

So what should you do?

Learn the principles.
Steal the ideas.
Apply them to your projects.

Applied bitcoin principles

Self-hosting
Resilience through redundancy
Root of trust
Strong security boundaries
Open source

Run

Turn the laptop into a hypervisor

Open https://github.com/allod-stack in Firefox. Copy the two lines under Start here into a terminal.

curl -O https://raw.githubusercontent.com/allod-stack/deploy/master/getting-started.sh
bash getting-started.sh
...
reboot

It asks for your password once, for the bootloader. On Done, reboot and log in as the same user.

Discussion

What is an allod?

A Frankish word. Land owned by occupation, not by a lord's grant. No feudal master. Its holder stood equal to any sovereign, no matter the title or territory size.

What is the allod stack?

A self-sovereign development stack. No cloud, no service dependencies. Everything runs on hardware you own or services you trust.

One human ownerevery trust chain ends with the human at the terminal
A bare-metal hostprovision disposable VMs from declared state

A self-hosted forgepull requests, issues, branch protection, on your machine
Agents are principal actorstrapped in a vm with accounts and tokens of their own

Discussion

The stack in one picture

nexus, the hypervisor

Provisions VMs. Rebuilds VMs and itself. Rotates keys. Holds the git repositories. Never runs agents.

allod-dev dev

Coding agents: claude, codex, pi. git, jq and age.

forge service

Forgejo. Clone-only ssh on its own port, admin ssh on another, plain http on the LAN.

bitcoin-node privacy

Pruned Bitcoin Core. Data directory on the hypervisor. Clearnet for the initial sync, then Tor only.

Archetypes

dev

Coding agents
Forge access
allod tools
Git policy hooks
Git workspaces
Memory tree

service

Root login only
Persistent data disk
Firewall on
No route off the LAN

privacy

One login account
ssh by the host key
Everything else from the profile

Discussion

One key unlocks the whole architecture

Secrets live in the repo as age ciphertext. Readable by the host and one VM.
Keys are scoped. Each VM has its own ssh host key that can't access another vm.
Repos are in three places. The laptop, the forge, an off-site backup.
One key on the host is the root of trust. It decrypts the secrets; the secrets rebuild the rest.

Run

Build the agent's VM

provision-vm allod-dev

Built from local git clones. No forge, no key, no account. Just enough to run an agent.

Discussion

Define the agent environment and take off the leash

Agent permission boundaries

1No containmentthe agent has access to everything you can access

2File permissionsa separate user; shares your kernel and network

3Containerits own filesystem and processes; shares the host kernel

4Virtual machine allod runs hereits own kernel; shares only the hypervisor's device layer

Permission prompts are off.Containment is the VM boundary.
Absence is policy.A capability that should not be used is not installed.
Policy lives in topology.Use the network definition as an enforcement layer.
Per-VM, per-purpose credentials.Any compromise is bound to that machine.

Discussion

Everything rebuilds from a clone

The code is the architecture, and the architecture hosts the code.

Ephemeral VMs.Destroy and rebuild in minutes.
Declarative architecture.Every machine defined in code. Even the forge.
Resiliency through redundancy.Total restore from root of trust and a forge backup.
Reproducible.Nix flakes: build exactly the same code everywhere.

Discussion

No cloud services required

Three supported CLI agents.claude, codex, pi. Or add your own.
Provider model catalogue.Pi supports API keys like nullsink, or self-hosted inference.
Git hosting.Self-host Forgejo or Gitea, or use GitHub.

Run

Give the agent a model

ssh allod-dev pi-key nullsink < ~/nullsink-key
ssh allod-dev
yolo pi

Discussion

Memory: what the agent knows before it starts

Public and private memory.Framework conventions in a public repo. Your deployment's specifics in a private one.
Shimmed into every agent.The VM build writes each agent's pointer file, naming every memory index on the machine.
Skills in the same repositories.Agents have unrestricted repo write access. allod skill lists them.
No permission prompts.yolo claude, yolo codex, yolo pi: approvals off. The VM is the boundary.

Run

But there is no upstream git. Let's fix that.

provision-vm forge
bash ~/work/allod/deploy/getting-started.sh --forge
ssh allod-dev

Discussion

Architecture principles. Distilled from commits, issues, PRs, and design docs.

Own the root; treat everything else as swappable.
One human is the root of trust.
Build public; deploy private.
A boundary that depends on cooperation is not a boundary.
Code, data and keys have different owners; never mix them.
Privilege flows downhill: human, host, VM, agent.
The VM is the cage; inside it, the agent runs free.
One source of truth per fact; consumers derive.
Everything rebuilds from a clone; only keys are precious.
Published is forever.
Fail loud; never fall back silently.
Every significant change justifies itself before it lands.
Believe generated artifacts, not source review.
Lessons become mechanism; agent context is a wasting asset.
Move in small, independently landable steps.
Record what each machine costs to build.

Run

The VM was reprovisioned and the API key was lost

yolo pi
# Warning. No models available. The key died with the VM.

# from the laptop: the quick key again, then back in
ssh allod-dev pi-key nullsink < ~/nullsink-key
ssh allod-dev
yolo pi

Then ask the agent: read the deploy README, section "Giving the agent a model", and walk me through the managed path. It hands you the laptop lines one at a time.

Run

It should give you these commands

mkdir -p ~/work/allod/secrets/secrets/pi-credentials
U=https://nullsink.is/v1
M=glm-5-3-flash
pi-provider add nullsink --credential nullsink --url $U --target allod-dev --model $M
git -C ~/work/allod/profiles commit -am "pi-providers: add nullsink"
git -C ~/work/allod/secrets add -A
git -C ~/work/allod/secrets commit -m "add nullsink token"
cd ~/work/allod/deploy
nix flake update --refresh profiles secrets
git commit -am "lock: nullsink"
rebuild-vm allod-dev

Now your API key will survive reprovision.

Discussion

Only keys are precious

The key is ciphertext.In your secrets repo, readable by two machines: the hypervisor and the VM.
The VM never holds a key file.It decrypts at boot, into memory.
Rotation is one command.Plus the commit, re-lock, and rebuild sequence.
The forge key, the agent token and the host identity share the lifecycle.
Code, data and keys have different owners.Framework repos carry no identity; secrets carry only identity.

Run

Test what the agent can and cannot do

pi auth check --provider nullsink
ls ~/.pi/keys
cd ~/work/allod/tools
forge issue create --title "hello" --body "from allod-dev"
git checkout -b hello
git commit --allow-empty -m "hello from the agent"
git push -u origin hello
forge pr create --title "hello" --body "from allod-dev"
git -c core.hooksPath=/dev/null push origin HEAD:master

The last push is refused by the server: Not allowed to push to protected branch master.

Discussion

What you just proved

The agent can open a pull request.It pushes a branch and files the PR. That is all the write access it has.
The agent cannot push to master.Disable the commit hook and the server still refuses.
The agent cannot merge or create secrets.The forge CLI has no merge command. allod secret is not installed in the VM.
A missing command cannot be misused.A hook can be bypassed. A command that is not there cannot be run.

Discussion

Build tools a human would want to use

# forge copies gh, flag for flag
gh    pr create -t "Fix typo" -F body.md
forge pr create -t "Fix typo" -F body.md

Copy what people already know. Learn gh once; forge comes free.

# allod reads noun, then verb
allod change begin -d fix-typo allod/tools
allod bitcoin status
allod site serve allod-workshop-slides

Ergonomic command names. allod <noun> <verb>

Discussion

Put each control at the layer that holds it

1Skills and memoryinstructions; ignored as the context fills

2Git hookslocal; skipped with one flag

3Scripts and toolsthe tool has no merge verb; raw git is still there

4Repository controlsexternal; no local agent can get around them

5Human gatesmerge, publish, relay; the final arbiter

weaker▼stronger

Weakest to strongest. Each layer backstops the one above it.
A rule that keeps failing moves down. Prose to hook, hook to tool, tool to server rule.

Discussion

Update the machine definitions

# pull latest on all repos
pull-all

# find out which repos need a flake update to the latest commit
flake-status --upstream

# update one or more flake.lock files, dependencies first
flake-update-cascade archetypes

# rebuild the host, or a VM
rebuild-nexus
rebuild-vm allod-dev