Checked against sourceWrite-ups where a claim is taken to the point where it could have failed. Bitcoin Core, MCP servers, hardware-backed keys.https://kramgasse.com/2026-09-10T00:00:00Zcyb3ralberthttps://github.com/cyb3ralbertKubernetes The Hard Way starts at lab 01. This is chapter zero.https://kramgasse.com/chapter-zero/2026-09-10T00:00:00Z2026-09-10T00:00:00ZThe tutorial asks for four Debian 12 machines and says nothing about where they come from. Five ways a cloud image refuses to boot on a real host, and the RAM the thirteen labs actually need — 768 MiB, not the 2048 in the spec.A comparison that cannot fail is not a checkhttps://kramgasse.com/comparison-that-cannot-fail/2026-08-28T00:00:00Z2026-08-28T00:00:00ZA comment in a Bitcoin Core test file cites a URL that redirects instead of 404ing. Establishing that the replacement holds the same 64 vectors took four independent supports — and two negative controls to show the comparison could fail at all.What MCP servers actually exposehttps://kramgasse.com/mcp-tool-exposure/2026-07-29T00:00:00Z2026-07-29T00:00:00ZWhich tools a server puts in tools/list, read line by line across six codebases. Includes the survey I got wrong and why.git-crypt + Trezor: keeping your repo key off the disk entirelyhttps://kramgasse.com/git-crypt-trezor/2026-07-19T00:00:00Z2026-07-19T00:00:00ZWiring git-crypt's GPG mode through trezor-agent, so the repo key is never on the host. With the PIN-matrix mechanics explained and the unlock UX measured.Trezor as a TOTP vault: 2FA codes that never touch disk in plaintexthttps://kramgasse.com/trezor-totp/2026-07-19T00:00:00Z2026-07-19T00:00:00ZEncrypting TOTP secrets with the device's own CipherKeyValue, so only ciphertext is stored.Recovering a Trezor GPG identity from a seed phrase, no hardware neededhttps://kramgasse.com/trezor-gpg-recovery/2026-07-19T00:00:00Z2026-07-19T00:00:00ZDeterministic reconstruction of the GPG identity from BIP39 via SLIP-0010, checked against the official test vector. Answers trezor-agent#335.