Buzz: The Block Workspace Where Every Agent Action Is Signed and Audited
I’ve spent enough time around agent tooling to develop a reflex: when a demo shows an AI opening a repo, sending a patch, and merging it, my first question isn’t “how fast?” — it’s “who approved it, and can you prove it six months from now?”. Most answers are some version of a shared service account and a shrug. That’s the gap Block just stepped into.
On July 21st, Block — Jack Dorsey’s company — released Buzz, an Apache 2.0 workspace that fuses team chat, Git hosting, and agent coordination into a single self-hosteable substrate. The pitch that matters isn’t the one everyone’s going to repeat (“open source Slack with agents”). It’s the architecture underneath: Buzz is a Nostr relay where every message, reaction, workflow step, review approval, and Git event is a signed event in a single log. Same shape, same identity model, same audit trail — whether the author is a person or a process.
Read that again, because the whole thesis is in there. Buzz doesn’t bolt agents onto a chat app and give them a bot badge. It gives every actor — human or agent — their own keypair. An agent that triages a bug has its own identity, its own channel memberships, its own entry in the audit log. It’s scoped by identity, not permission flags. In Block’s own words, you scope an agent “the same way you’d scope a teammate”.
For anyone who’s tried to reason about agent access at platform scale, this is the right primitive. The industry spent two years asking models to do more inside our systems — open PRs, run workflows, cut releases — while the accountability layer stayed stuck in the era of a single shared CI service account. When something goes wrong at 2 a.m., “the bot did it” isn’t an answer you can take to a review. One keypair per agent over a hash-chained log (Buzz’s buzz-audit crate) is. Every action traceable, every step searchable, the conversation and the patch and the approval all the same kind of event in the same index.
The model-agnostic piece is what makes this practical instead of aspirational. Buzz ships an ACP harness — buzz-acp — that speaks Agent Client Protocol, so Goose, Codex, and Claude Code plug in without Buzz caring which one you brought. Any agent you already run operates inside the workspace, and the relay logs what it did in the same signed format as everything else. You’re not adopting Block’s agent. You’re adopting Block’s ledger, and pointing your existing agents at it.
A landing clarification on what’s actually shipped, because I always mark this. The pieces this argument rests on are live today: the relay, channels and threads, Git events (patches and repo announcements via NIP-34), the Git hosting backend, the hash-chained audit log, buzz-cli with the ACP harness, and YAML workflows triggered by messages, reactions, schedules, or webhooks. What’s still being wired: mobile clients and — important data point for anyone tempted to build governance on top — workflow approval gates. The infrastructure exists; the glue, by Block’s own README, “is still drying”. So: the signed identity foundation and audit trail are real and self-hosteable now; approval gating with a human in the loop is a near-term promise, not a shipped feature. Don’t build your compliance program around the second one yet.
Self-hosting is an argument in itself. This is Docker plus a pinned toolchain of Rust 1.88 / Node 24 / pnpm, an event store in Postgres, Redis, Typesense for search, and S3/MinIO for media — a Rust workspace of focused crates with the relay as the single source of truth. You run it. The log lives in your infrastructure. For a CIO, “the audit trail of every agent action lives in a relay that’s yours” is a materially different sentence than “trust our SaaS dashboard”.
Here’s my honest read. I don’t think Buzz wins by being a prettier chat app — that market is a graveyard. I think the interesting bet is that identity and provenance are about to become the hard problem in agent engineering, and the team that treats “every actor signs, every action logs” as the substrate instead of a feature will have built the thing the rest of us are going to be reverse-engineering in two years. Block might be that team or not. But they named the right problem, and shipped a working, adoptable answer under Apache 2.0. That’s more than most do.
The question I’d sit with: once your agents can open repos, merge code, and cut releases, is a shared service account and a trust-us dashboard something you’d really defend in a postmortem — or is a signed, per-agent audit trail the floor you should’ve been demanding all along?
Would you let an agent merge to production without a cryptographic signature per action? Or is that the minimum floor we should’ve been demanding a long time ago?