Excited to announce that I'm launching a new startup, @LilithSemi , together with Sebastian Kraus! 🚀 With Lilith Semi, we're building open-source tools for hardware development and security-critical infrastructure. Our first release is Chock, a security-first harness for AI coding agents. Since 2026, AI agents have become good at tasks beyond simple web development. As companies start dealing with real workflows, enterprises, especially in regulated industries, are becoming more conscious about how they handle sensitive data. I've been dealing with supply chain security for a while, and one thing I've learned is how important it is to work with safe AI harnesses. When you're dealing with sensitive data, the risk simply isn't worth it. That's why Chock sandboxes AI agents in a using standard sandboxing primitives. We're currently working on micro-VMs as the next step. 👉 Check it out: chock.ws And if you're at NixCon 2026 in Kraków, come find us and let's talk. #AISecurity #AIHarness #SupplyChainSecurity #DeveloperTools #OpenSource #NixCon2026

Yes, it's a rehash of what I gave at Teardown but will be better and fitting more of what I've been working on.

Yes, Chock does use seatbelt but there's plans for microVM support.

Would you use Chock as a reference for a strong sandbox? I don't like how a lot of things sandbox, currently every other harness just RO binds the rootfs. Also sandboxing on macOS is a futile attempt since seatbelt is very subpar compared to what Linux offers imo.

Life is Nix

My plane isn't even at the airport yet

Yep, in a couple hours I'll be flying to Poland.

It's airport time, dealing with the beginning of my travels. I get in the evening on Wednesday but I'll be available Thursday if anyone is in town.

Zig and Nix aren't on the list as well

Maybe I work on that on the plane to Poland for NixCon.

I'd be starting from scratch because this would be pure Zig.

Since I've managed to sandbox Fix in Chock, I wonder if upstream could have sandboxed eval. It could be done without requiring root for sandboxing. Landlock V1 has been around for quite some time.

Can it be tomorrow already so I can fly to Poland for NixCon?

I think at some point I need to build my own hypervisor and VMM.

They're also good at looking at something and trying to optimize it. Just telling it "make it faster" isn't immediately the right approach but giving it theories does help. It can also measure bottlenecks and attempt at optimizing them. But you won't get significant results from just vibing it.

There are bugs until you have proven there to not be a bug, that's why we have unit tests. But even with unit tests, there always could be a bug. It's just sensible to cover the vast majority of cases and prevent regressions.

She's a fan of Nix.

Snipe @fmzakari on it? I think he's already got something quite close.

But I like my RISC-V CPU being made in Dart heh