Malix - Alix Brunet Malix-Labs

Next-Generation Secret Management Architecture for Declarative Systems & Environments

An Exhaustive Whitepaper and Systems Architecture on Cryptographic Enclaves, Authenticated Boot, Ephemeral Process Scoping, and Threat Modeling across [NixOS][nixos], [nix-darwin][nix-darwin], [nixbsd][nixbsd], [nix-on-droid][nix-on-droid], [home-manager][home-manager], and [hjem][hjem].

1. Executive Summary: The Fundamental Architecture Problem

1.1. A Universal Operating System Dilemma Explored Through the Declarative Lens

The vulnerabilities and architectural design flaws addressed in this whitepaper are not unique to declarative systems; they exist on every modern general-purpose operating system in the world (including Arch Linux, Debian, Ubuntu, Fedora, Alpine, macOS, and FreeBSD):

The Flat POSIX User Boundary: On every standard POSIX system, any unconfined process running under a user account (UID 1000) has full kernel permission to inspect any file owned by that user, dump unhardened

Nix Lib Coreutils

Nix Library for Coreutils

Setup

Flakes

```
inputs.lib-coreutils = {
```

NixOS Test Harvester

Exposes a library helper and a flake-parts module to dynamically inspect NixOS configurations and register their enabled services to Nixpkgs' integration tests for CI/checks.

How to use

Flake Input

inputs.nixos-test-harvester = {
  url = "https://gist.github.com/Malix-Labs/d58d2af9be08519099b17abb25f4d5be";

Agent Quota Timer Utils

An Agent Quota model quota timer handling script

It is packaged as a Nix flake, exposing a standalone package, a Home Manager module, and a native NixOS module to run the script periodically via systemd user services and timers so the cooldown is always maxxed

	{
	genAttr =
	name: value: {
	${name} = value name;
	};
	}

	lib: schemas: flakeOutputs:
	let
	# Recursively collect derivations from an inventory node's children.
	# The inventory is a tagged tree: subtrees live under .children, not as plain nested attrsets.
	collect =
	path: value: children:
	lib.concatMap (
	name:
	let
	node = children.${name};

	target/
	*.nar.zst

	#!/usr/bin/env bash
	set -euCET -o pipefail