Supply Chain

Architecture diagram — a client plane of advisory git hooks (lefthook pre-commit, pre-push) that any agent can skip, and a server plane where a GitHub ruleset enforces required checks, linear history, signed commits and no force-push before a merge reaches protected main

Hooks are advice, rulesets are law

Defense-in-depth for a solo developer running several coding agents against one deployable branch: advisory client-side git hooks (lefthook, pre-push) for latency, a binding server-side GitHub ruleset for integrity. Hooks are bypassable; rulesets are enforced. Pattern + the fitness function that proves the law is still on the books.

Architecture diagram — 4-host NixOS fleet, data plane (hosts) x control plane (flake.nix) x compliance plane (lefthook + GitHub Repository Ruleset)

A 4-host NixOS fleet with multi-agent worktree guards

One flake, four heterogeneous hosts (x86_64-linux + aarch64-darwin + steam-deck + a CI macbook), and a worktree-first git rule that lets multiple Claude Code agents share the same repository without colliding. Hostname-whitelisted push guards catch misrouted commits before they reach origin.

Architecture diagram — three planes (data, control, compliance) for SLSA L2 + Sigstore keyless build pipeline applied across yolo-labz Claude Code plugin repos

SLSA L2 + Sigstore keyless: a solo-dev supply-chain canon for OSS plugin repos

A 9-line GitHub Actions canon — actions/attest-build-provenance + cosign keyless OIDC + dual-format syft SBOM — applied verbatim across six Claude Code plugin repos. SLSA L2 attestations and gh attestation verify smoke tests, no per-plugin overhead, zero rotated secrets.