Dorsey's Buzz Gives AI Agents Keys, Not Bot Tokens

Jack Dorsey spent the last two years releasing oddball communication experiments — Bluetooth mesh messengers, Nostr clients, a sun-exposure tracker. Buzz, which Block open-sourced this week under Apache 2.0, is not one of those. It's a full-blown workspace platform: team chat, project management, Git hosting, CI, and AI agents, all running on a self-hosted relay you own. The pitch on buzz.xyz is "your people, your agents, your project — all in one place," and the repo's own description is blunter: a hive mind communication platform.

It would be easy to file this under "Dorsey launches thing" and move on. That would miss the one genuinely novel idea buried in it — and the very familiar mistake wrapped around it.

Keys, not bot tokens

Architecturally, Buzz is a Nostr relay with a product built on top. Every message, reaction, workflow step, review approval, and Git event is a cryptographically signed event appended to one log, backed by a Rust/Axum service with PostgreSQL, Redis, and S3-compatible storage. Git lands as NIP-34 events — the Nostr spec for patches and repo state — with git-sign-nostr and git-credential-nostr handling signing and auth. Desktop and web clients are React; mobile is Flutter.

The interesting part is what identity looks like. Humans and AI agents get the same primitive: a keypair, channel memberships, and an audit trail. An agent isn't a webhook with a bot token — it's a peer that signs everything it does into the same log as its human teammates. The block/buzz repo ships an agent-first CLI and an ACP harness that plugs in Block's own Goose as well as Claude Code and Codex, using the Agent Client Protocol that Zed introduced for editor-agent interop. Push a patch, CI posts results into the room, an agent runs a first-pass review — all as signed events anyone can verify and search.

That targets a real, growing wound. Today, wiring a coding agent into a team means a personal access token here, a Slack bot user there, a GitHub App with over-broad scopes, and an audit story that amounts to grepping four different admin logs. Everyone can see the endgame — GitHub's Agent HQ push, Slack's agent integrations, every vendor racing to become the "mission control" layer. Buzz's answer is the radical one: stop bolting agents onto tools designed for humans, and rebuild the substrate so both are first-class. Signed-event identity for agents is a better primitive than bot tokens, full stop. Someone was going to build it; it's fitting that it came from the company that gave us Goose.

The Wave-shaped problem

The product wrapper around that primitive, though, is a clean-sheet bundle — and clean-sheet bundles have a brutal track record. Google Wave tried to reinvent mail, chat, and docs in one stroke and died in a year. Google Buzz — Dorsey's name choice is either oblivious or gleefully trolling — lasted barely longer. On the code side, Nostr-native Git has existed for years (ngit, gitworkshop.dev) without denting GitHub, and Radicle's peer-to-peer Git remains a niche of the committed. The lesson from every one of these: incremental migration paths beat superior architecture. Teams don't switch chat and code hosting simultaneously; they barely survive switching one.

Buzz asks you to switch everything at once, and to adopt Nostr key management as your new IT problem besides. When your identity is a keypair, a lost laptop isn't a password reset — it's a revocation-and-reissue ceremony, times every agent in the fleet. And the hard question the early Hacker News discussion zeroed in on is access control: agents that share rooms with humans see what humans see. Scoping what a compromised or merely overeager agent can read and sign, per channel and per capability, is exactly the part that's still hand-waved — and it's the part enterprises will ask about first.

There's also the follow-through question. Block halved its workforce in February, with Dorsey framing AI-driven leverage as the reason and telling everyone else's company it's next. Buzz reads as the org-chart artifact of that bet — infrastructure for teams that are half agents — which makes it strategically sincere but doesn't tell you whether it gets sustained investment or joins Bitchat in the pile of interesting artifacts. Ninety-six releases and an active repo are a good sign; "come test the early stages with us" on the homepage is an honest one.

What to actually do with it

If you run agent fleets today, Buzz is worth a weekend: stand up the relay with Docker (Postgres, Redis, MinIO), generate keys, pair Goose or Claude Code through the ACP harness, and push a signed patch. You'll get a feel for what a unified, verifiable agent audit trail is like — something no Slack-plus-GitHub-plus-token-spaghetti setup currently gives you. Treat it as a reference implementation, not a migration target.

What you should not do is bet a team on it. Slack and GitHub are not losing to a bundle; they're at risk of losing, slowly, to whichever platform nails agent identity and auditability first — and both are incumbent enough to copy this. The most likely happy outcome for Buzz isn't Buzz winning. It's keypair-per-agent and signed-event audit logs becoming table stakes, the way ChatOps ideas from Hubot eventually showed up everywhere long after Hubot itself stopped mattering.

Dorsey has a habit of being directionally right and commercially early — on decentralized social, on payments, on Bitcoin infrastructure. Buzz looks like the same trade: the wrong product shape carrying the right primitives. Steal the primitives.