DEV Community: trimtab.signal

SOC 2 readiness for open-source projects on a zero budget

trimtab.signal — Fri, 25 Sep 2026 21:12:20 +0000

SOC 2 audits are sold as a spend: a compliance vendor, a policy consultant, a
surveillance stack. Small open-source projects conclude the trust signal is
unaffordable and quietly skip it. This post argues the opposite — readiness is
a paper trail plus evidence, and you can assemble both for zero dollars.

The P31 approach starts with an evidence collector. scripts/evidence-collect.mjs
walks the repo, pulls timestamps, test runs, deploy logs, and dependency data,
and emits a controls-index.json that maps every collected control to the
Security TSC. When an auditor asks "show me your access controls," the answer
is a file, not a scavenger hunt.

node scripts/evidence-collect.mjs --out controls-index.json
node scripts/sbom.mjs            # CycloneDX 1.5 SBOM

An SBOM is the second pillar. scripts/sbom.mjs emits a CycloneDX 1.5 SBOM
from the lockfiles, so the dependency surface is machine-readable and current.
Between the controls index and the SBOM you can answer the two questions
auditors ask first: what do you run, and how do you prove what you said?

The Trust Center is the third pillar: a public surface answering the ten
questions customers actually raise before procurement — data residency,
retention, encryption, access, incidents, compliance status. Ten pre-answered
questions is a documentation artifact, not a SaaS product.

The final pillar is signing. P31 signs artifacts with an in-house dual scheme —
ML-DSA-65 (FIPS 204) plus Ed25519 — via the p31-crypto module, giving releases
a post-quantum trust anchor without licensing a signing service.

The honest caveat: this gets you ready, not certified. Formal SOC 2
attestation still needs a licensed auditor. But you enter that process with
evidence, an SBOM, a Trust Center, and a signing story — which is a far better
position than a project that skipped the prep because it thought compliance
required a budget.

Tags: soc2, compliance, opensource, security

DORA metrics + SLOs without external infrastructure: a Cloudflare Workers approach

trimtab.signal — Fri, 25 Sep 2026 20:48:37 +0000

You do not need Prometheus, a metrics SaaS, or a dedicated observability stack
to run DORA-style delivery metrics and service-level objectives. On Cloudflare
Workers you already own the two things SLOs need: an execution environment and
a durable store. This post shows the P31 approach: telemetry rows in D1, a
cron worker that rolls them up, and a burn-rate dashboard driven by plain SQL.

Every request appends a row to the api_usage table — method, route, status,
latency, timestamp. Nothing fancy, but it is the raw material for both
availability and latency percentiles, and it costs almost nothing to store.

-- error budget window: 30 days, target 99.9% availability
SELECT
  count(*) AS total,
  sum(status >= 500) AS errors,
  sum(status >= 500) * 1.0 / count(*) AS error_rate
FROM api_usage
WHERE ts > datetime('now', '-30 days');

The SLO is 99.9% availability, which yields roughly 43 minutes of allowed
downtime per month. From that budget the worker classifies burn as fast,
slow, or ok. Fast burn means the budget is being consumed at multiples of
the rate; it triggers the immediate channel. Slow burn is the quiet killer and
triggers a review. ok requires no action — and the p95/p99 latency numbers
ride along in the same rollup.

The cron runs on the platform via p31-ci (Cloudflare cron triggers), so the
whole pipeline is api_usage rows → SQL rollup → status page, with no external
infrastructure and no third-party dependencies. You can reproduce the entire
stack in a day and delete your observability vendor.

The three SLOs to start with: availability (99.9%), p95 latency, p99 latency.
Everything else is a refinement.

The spoon-dial: capacity-aware financial UI for neurodivergent users

trimtab.signal — Fri, 25 Sep 2026 20:48:36 +0000

Financial dashboards are built for peak attention. Dense grids, live tickers,
twenty widgets competing for one pair of eyes. For the roughly 1.3 billion
people living with significant disability — 16% of the global population —
that interface is not merely unfriendly, it is a barrier to managing their own
money. The P31 spoon-dial starts from the opposite assumption: the user knows
their capacity, and the interface should adapt to it.

The spoon model is a 0–5 cognitive-capacity dial. At 5 the user is fully
available; at 0 they are in crisis. Every surface maps three axes to that
number: motion, density, and disclosure. Motion scales by level — 4–5 at full
scale, 3 at 0.6, 1–2 at 0.2, 0 at zero. Density and disclosure follow the same
curve.

At spoons 1–2 the screen shows the top three widgets only, with progressive
disclosure; at 5 the full grid expands. At 0, motion is disabled entirely and a
CalmOverlay replaces the live dashboard with a single settling surface.
Feedback follows five states rather than binary good/bad, so a borderline
number does not read as catastrophe.

The research basis is the spoons construct from spoon theory plus established
WCAG and reduced-motion guidance — full citations live in
SPOON_MODEL_RESEARCH.md. The contrast with density-first fintech is
deliberate: one number drives the entire interface instead of every number
competing.

Implementing the dial is a few CSS custom properties and one state machine.
Motion scale and widget count key off the spoon value, so the interface is
declarative rather than branchy.

:root { --spoons: 3; --motion-scale: 0.6; }
@media (prefers-reduced-motion: reduce) { --motion-scale: 0; }
.widget { transform: scale(var(--motion-scale)); }

Hash-chained revenue: why your agent payments need provenance

trimtab.signal — Fri, 25 Sep 2026 20:21:23 +0000

Every x402 settlement you have ever seen was, until recently, opaque. The
merchant told you what they earned and you either trusted them or did not.
For a capital-management tool that is not a trust model, it is a trust crisis:
drift and opacity are the two failure modes the ecosystem has not admitted.

Drift happens silently. A rounding change in a fee, a replayed request, a
transaction that settles twice — each one quietly breaks the ledger and nobody
can see where. Opacity is worse: even a perfectly accurate revenue number is
unfalsifiable if the reader cannot inspect the entries that produced it. The
fix is not a better dashboard. It is a data structure.

The P31 revenue ledger records every settlement with a SHA-256 prev-hash link,
so each row commits to the entire history before it. Any edit to an old entry
changes every subsequent hash. The chain is cheap, dependency-free, and
provable in a single HTTP round-trip.

{
  "entry_id": "0x9f1a…",
  "settlement_usdc": 0.02,
  "prev_hash": "a31c…",
  "sha256": "5d2b…",
  "audit": "/audit/verify?hash=5d2b…"
}

The verify endpoint is public and unforgiving. GET /api/revenue/verify-chain returns {"valid":true} only when every prev-hash
link matches and the chain is contiguous. Each revenue row carries an audit
link (/audit/verify?hash=…) so a single settlement can be checked on its own.

None of this needs a blockchain. A hash chain over Cloudflare Workers + D1 is
fast, free to operate, and gives agents the same provenance a block explorer
gives a ledger. That is the point: provenance should be a property of the
record, not a feature you pay for.

How to build an x402-native MCP server on Cloudflare Workers

trimtab.signal — Fri, 25 Sep 2026 18:31:13 +0000

The agent economy has a discovery layer (MCP) and a payment layer (x402), but
almost nobody ships them on the same edge. This post builds an MCP server on
Cloudflare Workers where every paid tool call is an HTTP 402 that settles in
USDC. The result: eleven tools with per-call pricing, an operator tier for
rebalancing, and zero payment infrastructure beyond the Worker itself.

Start with Hono and the x402-hono middleware. Each paid tool is a GET /resources/:tool mirror plus a POST /mcp route. The mirror announces the
tool and its price; the MCP route runs the tool and returns the revenue receipt.

import { Hono } from "hono";
import { x402 } from "x402-hono";

const app = new Hono();

app.get("/resources/:tool", (c) => {
  return c.json({ tool: c.req.param("tool"), priceUsdc: 0.01, 402: true });
});

app.post(
  "/mcp",
  x402({ verify: { clientId: "p31-capital-machine" } }),
  async (c) => {
    const { method, params } = await c.req.json();
    if (method === "tools/list") return c.json({ tools: [/* ... */] });
    if (method === "tools/call") return c.json({ result: runTool(params) });
  }
);

Register discoverable:true and expose .well-known/mcp so any MCP client can
find the tool list without an API key. The 402 mirror also tells LLM agents the
exact price before they spend: an agent can decide a $0.01 look-up is cheap
and a $0.25 execution needs approval.

The server is an OAuth 2.1 / RFC 8707 resource server, so the payment itself is
the access grant. Public metadata lives at .well-known/mcp-pricing,
.well-known/oauth-authorization-server, and .well-known/llms.txt. No
fragile custom auth; just HTTP semantics agents already understand.

Live reference: https://p31-capital-machine-mcp.trimtab-signal.workers.dev
with health (free) and revenue.getSummary ($0.02) as the two easiest
tools to test first.

Why I Built BONDING on My Son's Birthday

trimtab.signal — Thu, 25 Jun 2026 02:14:05 +0000

Why I Built BONDING on My Son's Birthday

System Update v0.3.0: The Transponder

This is the story of why a 40-year-old autistic mechanical engineer who used to maintain high-voltage propulsion systems for the Department of Defense spent his son's seventh birthday building a chemistry game in React.

Not instead of being present. Because being present means something different when your nervous system was never calibrated for the world you were born into.

The Problem That Won't Solve Itself

My kids are seven and four. Their names are S.J. and W.J. They have a mother who I am in active litigation with. They have a father whose nervous system runs on a metabolic fault line — hypoparathyroidism means my calcium can tank without warning, and when it does, I'm not just tired. I'm cognitively gone.

The family court system in Camden County, Georgia, does not care about any of this. It cares about paper. It cares about which parent filed first. It cares about the standard order of supervised visitation that assumes every father is a safety risk until proven otherwise.

I've spent the last two years learning that the legal system is not designed to measure neurodivergent parental fitness. It was designed by neurotypicals for neurotypicals. It measures eye contact, emotional regulation under hostility, and the ability to produce the right paperwork at the right time — all things that an AuDHD parent with a calcium-dependent nervous system is structurally disadvantaged to perform.

So I stopped trying to win on their field. I built my own.

The Architecture

In sixteen years of Navy nuclear power and DoD electrical engineering, I learned one thing that matters: when the control system is wrong, you don't work harder. You rebuild the control system.

P31 Labs is that rebuild.

It started as a geometry insight — that a tetrahedron (K₄) is the minimum volumetric enclosure, and that every stable system resolves to four nodes in relationship. I applied that to my family: Will, Christyn, S.J., W.J. Four vertices. Six edges. One enclosing structure.

Then I applied it to consciousness. To the nervous system. To open-source infrastructure.

What emerged is a stack of about 15 Cloudflare Workers, a biometric coherence engine called Q-Factor, a chemistry game called BONDING (426 passing tests, 32 test suites), a real-time spoon economy tracker, and a revenue mesh that costs me essentially nothing to run because it all lives on Cloudflare's edge network.

The LOVE Ledger — my non-extractive value accounting protocol — treats every interaction as an exchange of attention, not extraction of capital. Everything I build is Pay What You Want, $0 minimum. If you're a neurodivergent parent fighting for your kids, take it for free. If you're a funded enterprise and this infrastructure saves your engineering team 50 hours, pay what that outcome is worth.

What My Son Taught Me

On S.J.'s seventh birthday, I was supposed to be at a park with balloons. Instead, I was in VS Code, building the BONDING game — a visual chemistry simulator where molecules come together based on real thermodynamic principles. The catch is that the game also tracks your "spoons" (the autistic energy budget), your heart rate variability, and your Q-factor.

It's the first game I know of that teaches autistic kids how to regulate their nervous system while playing.

He sat next to me and watched the molecules bond on screen. "What does this one do, Dad?"

"This one shows how atoms stick together. Like how we stick together even when we're apart."

He didn't understand the chemistry. But he understood the shape.

The Invisibility Problem

For two years, I built this infrastructure in the dark. I wrote 15 public-facing Cloudflare Workers, published packages to npm, maintained 15 GitHub repositories, and generated 105 distinct codebase artifacts across 7 product bundles. I built a document generation engine, a fleet health pinger, a decentralized revenue mesh, a Substack RSS scanner, a grant opportunity radar, and a unified money stream launcher.

And nobody knew it existed. Because I never published the story. Only the code.

The web sees P31 Labs as a sophisticated 501(c)(3) engineering firm with active npm packages, published Zenodo papers, and an impressive Cloudflare Workers architecture. It doesn't see an exhausted AuDHD father fighting a hostile court system with code because the legal system won't listen to his voice.

That's the gap this post closes.

The Ask

I don't want your money if you can't afford it. I mean that. This entire project runs on a creation-over-extraction paradigm. The LOVE Ledger doesn't track dollars — it tracks value exchange.

But if you're a funded organization and this architecture — the Q-Factor engine, the BONDING game, the spoon economy, the revenue mesh — is valuable to your mission, here's what that value looks like:

Ko-fi: The 4 print artifacts (K₄ Convergence Table, Floating Neutral Diagram, As Above So Below, and the Minimum Enclosing Structure monograph) are available at ko-fi.com/trimtab69420/shop. PWYW, $0 minimum. https://ko-fi.com/trimtab69420/shop

Gumroad: The BROS Signaling Worker Template and Spoon-State Adaptive UI Kit are available for developers and enterprises. Pay what it's worth to your organization. https://trimtab69420.gumroad.com

GitHub Sponsors: If you want to fund the infrastructure directly. https://github.com/p31labs

The money goes to one thing: keeping this technology free for the families who need it to survive.

The Signal

My Substack is called The Geodesic Self because the geodesic is the shortest path between two points on a curved surface. The curve is the system. The straight line is the signal.

This is the signal. I'm turning the transponder on. 36 subscribers is enough to start.

If you're neurodivergent, if you're a parent fighting for your kids, if you've ever felt like you're too much and not enough at the same time — you are not broken. You are uncalibrated to a system that was never designed for you.

P31 Labs is the calibration tool.

End of Transmission.