Skip to content

Instantly share code, notes, and snippets.

View ChristopherA's full-sized avatar

Christopher Allen ChristopherA

View GitHub Profile
@ChristopherA
ChristopherA / redactable-append-only-log.md
Last active August 22, 2026 18:05
A redactable append-only log: an audit record separate from live state, with a digest chain, wrap-then-sign entries, and elision that preserves the digest so redacted entries still verify. A stack-agnostic extraction over Gordian Envelope and deterministic CBOR.

A Redactable Append-Only Log

A design for an append-only event log whose entries can be redacted, and disclosed to different readers at different depths, without breaking verification. It is described so that it can be implemented in any language on any platform.

The design rests on four practices: the log is a truth separate from the application's live state rather than the source that state is rebuilt from, redaction preserves the chain instead of breaking it, one committed entry serves every audience at a different depth, and the format's version moves when meaning moves rather than when fields are added.

Scope

The encoding beneath this design is neither new nor specific to it. Entries are Gordian Envelope structures serialized as deterministic CBOR, both published specifications with a reference implementation that this system's output is checked against. What is specified here is the profile written over that stack, together with the practices that came out of operating it.

@ChristopherA
ChristopherA / passkey-identity-with-delegated-agents.md
Last active August 22, 2026 18:05
Passkey identity with delegated agents: multiple credentials per person, authentication separated from authorization, and agent accounts a human controls. A stack-agnostic extraction, with an explicit ledger of what is proven and what is not.

Passkey Identity with Delegated Agents

An architecture for passkey authentication in systems where software agents act on behalf of people. It is described so that it can be implemented in any language on any platform.

The architecture rests on four practices: a person holds many credentials rather than one, authentication is separated from authorization, authority originates with the natural person and agents derive it, and agents can be delegated credentials without holding a key.

Scope

This document specifies the architecture around WebAuthn ceremonies. It assumes a conforming WebAuthn relying party underneath it and does not restate that specification. Origin and relying-party-identifier validation, user-presence and user-verification flags, algorithm acceptance, and attestation policy are defined by the W3C Web Authentication specification. Where a requirement here reaches into ceremony territory, notably challenge handling, it does so because the surrounding architecture depends on that detail.

An Image-Persistent Substrate for Agentic AI -- Concept Brief

Draft, 2026-05-01.

Christopher Allen <ChristopherA@LifeWithAlacrity.com


The pain everyone in the room knows

@ChristopherA
ChristopherA / wikilinks-and-named-edges.md
Last active August 5, 2026 01:08
Wikilinks and Named Edges — Agent Reference Guide (declared edges in plain markdown)
@ChristopherA
ChristopherA / README.md
Last active March 20, 2026 23:54
Open Integrity inception commit proof-of-concept — self-verifying code provenance for Git repositories
  • did: did:repo:423c9aee3c2cfd0d48ccacf645d3432b9b6bf2b2/blob/main/README.md
  • github: https://gist.github.com/ChristopherA/e2d59c62e3e50abe2595d74c0fd6f782
  • updated: 2026-03-20 by Christopher Allen <ChristopherA@LifeWithAlacrity.com>

Open Integrity Inception Commit — Gist Proof of Concept

This gist demonstrates that a GitHub Gist can carry a valid Open Integrity inception commit and that a script within the gist can verify its own provenance.

The Problem with curl | sh

@ChristopherA
ChristopherA / README.md
Last active July 30, 2026 09:49
Self-Improving Claude Code: A bootstrap seed prompt that evolves into a sophisticated configuration system

Self-Improving Claude Code: A Bootstrap Seed

The Hypothesis

A single prompt (~1400 tokens), placed in a project's .claude/CLAUDE.md, can bootstrap a Claude Code instance into a self-improving system — one that captures learnings, extracts patterns, evolves its own configuration, and gets meaningfully better at helping its user with each session.

No pre-built infrastructure required. No user-level config. No hooks, skills, templates, or elaborate folder hierarchies. Just a seed and the affordances Claude Code already provides.

Background

@ChristopherA
ChristopherA / Alpine_UTM_Guide.md
Last active August 6, 2026 23:21
Alpine Linux on UTM: Automation Guide

Alpine Linux on UTM: Automation Guide

A comprehensive guide to automating Alpine Linux VMs on UTM for rapid deploy-test-destroy workflows.


Document Information

Abstract: This guide documents Alpine-specific discoveries and workflows for UTM automation, focusing on P2P protocol testing, rapid iteration, and minimal resource overhead.

Automating UTM VMs on macOS

A comprehensive, distribution-agnostic guide to automating VM creation and management with UTM on macOS.


Document Information

Abstract: This guide documents hard-won lessons from real-world UTM automation, focusing on the challenges unique to UTM/QEMU on macOS rather than any specific Linux distribution.

@ChristopherA
ChristopherA / macOS_security_app_best_practices.md
Created May 22, 2025 00:42
Best Practices for Automating macOS `/usr/bin/security` App in Shell Scripts

Best Practices for Automating macOS /usr/bin/security App in Shell Scripts

WARNING: I've only dabbled with this in some scripts, and am not an expert. This document is based on my explorations, and has not been reviewed as actual best practices. USE AT YOUR OWN RISK!*

Securely managing macOS keychain items from the command line requires careful handling of access controls, error paths, and credential lifecycles. This guide collects recommended patterns and links to official documentation.

1. Principle of Least Privilege

  • Whitelist only necessary binaries
    When adding an item, use -T to restrict which executables can access it.
@ChristopherA
ChristopherA / Linux_Keyboard_Remapping_on_Legacy_MacBooksmd
Last active May 17, 2025 00:56
Linux Keyboard Mapping for Legacy MacBooks
# Linux Keyboard Remapping on Legacy MacBooks
> TO BE TESTED: on Ubuntu 22.04 LTS & Tails 5.x (with Dotfiles persistence).
How to get a MacBook’s keyboard behaving correctly under Linux—and make those settings survive reboots (especially in Tails).
## Debian/Ubuntu-based Distros
1. **Reconfigure the keyboard package**