add the infraslopture blog post

[ellotheth]

Gently adapted from the original

Changes

• Post: "Infraslopture and Other Paradoxes", an editorial on building agent-oriented infrastructure (NixOS, colmena, sops-nix, Incus, Tailscale) with Claude, and on Skills as the documentation layer that gets read because nobody reads.
• Series: joins the "Agentic engineering at Prisma" series as part 5, picking up the series banner and prev/next navigation on the post page.
• Cover: hero SVG and social-card PNG in the Eclipse house style: the post's opening prompt resolving into a checklist of the chosen toolchain.
• Links: first mentions of the surveyed ecosystem tools (Nix, Puppet, Ansible, Terraform, Kubernetes, Tailscale) link to their official sites.
• Fix: the draft carried a tag outside the blog's allowed tag set, which failed content validation; retagged to platform.

🤖 Generated with stochastic optimism by clankers 🤖

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blog	Ready	Preview	Aug 4, 2026 9:30am
docs	Ready	Preview	Aug 4, 2026 9:30am
eclipse	Ready	Preview	Aug 4, 2026 9:30am
site	Ready	Preview	Aug 4, 2026 9:30am

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	Aug 4, 2026, 9:36 AM

[coderabbitai]

Walkthrough

The pull request adds a blog article about AI-assisted infrastructure design. It covers NixOS, Incus, Tailscale, operational Skills, repository guidance, and development reflections.

Changes

Infrastructure and AI agents article

Layer / File(s)	Summary
Infrastructure proof of concept apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx	Adds article metadata and discusses infrastructure requirements, research findings, and a proof of concept using NixOS, Incus, colmena, deploy-rs, sops-nix, and Tailscale subnet routing.
Access and operational tooling apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx	Describes Skills for provisioning NixOS hosts, onboarding and offboarding operators, managing Incus and Tailscale, and maintaining NixOS configuration.
Repository guidance and conclusions apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx	Explains repository-based infrastructure documentation and concludes with reflections on AI-assisted development, model limitations, and the Prisma prototype.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the infraslopture blog post.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gemma/infraslopture-blog

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (2)

apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx (2)

75-83: 🔒 Security & Privacy | 🔵 Trivial

Document the execution boundary for the Skills.

These Skills provision hosts, provision secrets, modify Tailscale, and offboard users. State which credentials each Skill receives, the scope of those credentials, and which destructive actions require human approval and audit records. This makes the agent-access guidance actionable and safer for persistent infrastructure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx` around
lines 75 - 83, Expand the Skills section around the listed provisioning and
operations Skills to document each Skill’s credential inputs and least-privilege
scope, including host, secret, Incus, Tailscale, and offboarding access. Also
specify which destructive actions require explicit human approval and audit
records, so the execution boundary for persistent infrastructure is actionable.

---

42-42: 🔒 Security & Privacy | 🔵 Trivial

Clarify who defines and enforces the guardrails.

State that operators configure project limits and security restrictions, while developers receive confined access limited to their project. Do not grant incus-admin; it provides full daemon access and can enable host-root access.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx` at line
42, Revise the Incus project description to clarify that operators configure and
enforce project resource limits and security restrictions, while developers
receive confined access limited to their assigned project. Explicitly avoid
granting incus-admin, since it provides full daemon access and can enable
host-root access.

Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx`:
- Line 30: Revise the NixOS and Guix sentence to present them as two options
rather than the only qualifying tools, and qualify the no-reboot behavior as
applying only to changes that do not affect the kernel, initrd, or kernel
modules; acknowledge that some Guix service changes may require manual restarts.
- Line 97: Update the System Initiative passage to accurately state that it shut
down its cloud service, archived the systeminit/si repository on February 6,
2026, and pivoted to the AI-native “Swamp” project. Replace the characterization
that the startup folded while preserving the surrounding skepticism and linked
reference.
- Line 32: Update the Nix CLI wording in the paragraph so it names the specific
modern command matching the intended workflow—use “nix develop” for development
environments or “nix env shell” for ad-hoc package environments—instead of
contrasting “new nix” with “old nix-shell”; preserve the surrounding links and
prose.
- Around line 52-57: Update the Tailscale explanation to separate subnet-route
advertisement from DNS and access configuration: clarify that subnet routing
only directs traffic to 10.69.0.0/24, while split DNS must use a reachable
resolver serving the .incus zone, such as the bridge dnsmasq resolver or an
external DNS server. Preserve the separate roles of route approval and access
rules, and avoid implying routing alone makes ellobox.incus resolve.

---

Nitpick comments:
In `@apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx`:
- Around line 75-83: Expand the Skills section around the listed provisioning
and operations Skills to document each Skill’s credential inputs and
least-privilege scope, including host, secret, Incus, Tailscale, and offboarding
access. Also specify which destructive actions require explicit human approval
and audit records, so the execution boundary for persistent infrastructure is
actionable.
- Line 42: Revise the Incus project description to clarify that operators
configure and enforce project resource limits and security restrictions, while
developers receive confined access limited to their assigned project. Explicitly
avoid granting incus-admin, since it provides full daemon access and can enable
host-root access.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3d374ece-b856-402e-9821-202cf28a276e

📥 Commits

Reviewing files that changed from the base of the PR and between e140430 and 81c1e3c.

📒 Files selected for processing (1)

• apps/blog/content/blog/infraslopture-and-other-paradoxes/index.mdx