Buzz · a workspace you run yourself, where a key answers instead of a password
Buzz
Every server you send code to asks for a password. These days that password is a long token in a file on your machine. Buzz asks a question instead, and your computer signs the answer. The key that makes that signature stays on your own computer, and a signature is a mark only that key could have made.
Your chat and your repositories sit on the same server
Buzz looks like a team chat app. The server is a small program you put on a machine you control, and it hands signed messages to whoever asked for them. That same server also holds your code, and one key gets you into the rooms and the repositories.
Everything you do is the same seven-line signed record
Your name here is the key itself. No account sits behind it. A message, a reaction, a change to a repository: each is one small record, signed. That record carries the public half of your key, the half anyone else uses to check the signature, the second it was made, what kind of thing it is, what it says, and a signature only your key could have made.
The password slot holds a signature that expires in a minute
Here is the clever part. The program that sends your code up is called git, and it has a slot where a password goes. Buzz puts its own program there. The server says prove it, and the program signs the address of that one repository with your key. The signature goes back where the password would have gone, and the program tells git not to save it. You would assume that killing the password moves the secret somewhere else, into a file or a keychain. It never moves: your key stays on your own computer. What crossed the wire is a signature that fits that one repository, and about a minute later Buzz's server turns that signature down.
The program that signs your saved changes looks for your Buzz key second
Git can mark each change you save with who made it, and git hands that job to an outside program. The Buzz project wrote one of those programs. That program looks for a key in three places, in order. The middle one is your Buzz identity, so each saved change carries the same key that is your name in the chat. The program reads the key, then wipes the key out of its own settings. That program comes in no download. You build it yourself, and point git at it once.
An AI agent joins the workspace the same way a person does
A member here is a key, so an AI agent, a program that goes off and does work for you, joins the same way you did. The agent gets its own key, its own rooms, and its own trail of what it did.
Open source under Apache 2.0, and still on a version that starts with zero
There is a download for macOS, for Linux, and for Windows. That download already carries the program that answers Buzz's server, and the app points git at that program for you. At your own terminal you point git at that program yourself, and keep your key in a file that program can read. The Windows build ships unsigned, so Windows will question it the first time you open it, and the git parts need a recent git.
One key: your name, your saved changes, and the code you send up
One key: your name, your saved changes, and the code you send up.
Every server you send code to asks for a password. This one asks a question instead, and the key that signs your answer never leaves your machine. That is block slash buzz, on GitHub. New repo tomorrow.
