Skip to content

feat(holon): entity DNA, place-safe multi-host agents (draft handoff) - #5419

Draft
Trevongit wants to merge 14 commits into
block:mainfrom
Trevongit:feat/remote-agents-desktop
Draft

feat(holon): entity DNA, place-safe multi-host agents (draft handoff)#5419
Trevongit wants to merge 14 commits into
block:mainfrom
Trevongit:feat/remote-agents-desktop

Conversation

@Trevongit

@Trevongit Trevongit commented Aug 9, 2026

Copy link
Copy Markdown

Draft for core review

Upstream-facing handoff of multi-host entity holon work dogfooded on Trevongit/buzz.

Full PR (with CI on fork): Trevongit#1

Design handoff: docs/metabolic/host-agents/CORE_HANDOFF_ENTITY_HOLON.md

Operator doctrine (Readable Doctrine + contracts): docs/operators/ on the fork
https://github.com/Trevongit/buzz/blob/feat/remote-agents-desktop/docs/operators/README.md

One-liner

Treat agent identity as DNA (pubkey), bodies as place-bound instances with leases, presence as status (and place when known), and refuse silent dual-spawn — with public proofs that never leak home paths.

Why

Silent dual-spawn of the same agent face across laptop + 24h home breaks presence, tooling, and scale. Aligns with VISION_REMOTE_AGENTS (same agent, new body) and remote-agents.md I3/I4.

Production-shaped pain already open upstream: #5583 (edit on second machine mints a new identity). Presence-as-liveness: #5138 / #4730. Long-lived hosts: #5282. Hosted L2 without a local binary: #5614.

Suggested review order (phased)

  1. Docs / vocabulary + place_proof.v1
  2. Host dual_body 409 + public proof
  3. Desktop Remote Agents place cards
  4. Local Start/Respawn dual refuse (spirit of fix(desktop): avoid duplicate remote agent starts #2857)
  5. Self-location inject
  6. Mobile presence snapshot (spirit of fix(mobile): bootstrap presence snapshots reliably #4417)
  7. Operator doctrine pointer (docs/operators/) — metabolism contracts, not a second protocol

Related open work: #2857 #4417 #5138 #4666 #5583 #5282 #5614 #3996

Also on the fork branch (supporting)

  • buzz messages watch — JSONL soft-wake transport for operator seats
  • cargo-deny: warn on yanked spin 0.9.8 (flume 0.11 / mesh-llm) so Rust Lint is not blocked by a transitive yank

This draft may need rebase onto current block/buzz main before merge-ready review.

Agent co-lab was blocked on skill packs because buzz-cli only allowed
image/* and video/mp4. The relay already accepts generic Blossom uploads
via a danger denylist (HTML/JS/SVG/executables). Align the CLI with that
policy so zip/pdf/text and similar types work while unsafe types stay
blocked.

Add unit coverage for allow/block and size tiers (100MB generic).

Signed-off-by: Trevor P <trev2005@gmail.com>
Codex P2 on block#4880: after widening upload MIME types, `messages send --file`
still emitted `![image](url)` for every non-video blob. Desktop FileCard
expects plain `[filename](url)` plus imeta `filename` for zip/pdf/txt.

Match Desktop formatImetaMediaLine: images/video stay inline; generic files
and agent/team snapshot PNGs use markdown links; escape label metacharacters;
include basename on imeta tags.

Signed-off-by: Trevor P <trev2005@gmail.com>
Add host-pinned Remote Agents under Desktop Agents (layer-3 seat
location), HTTP host-agentd wrapping buzz-host-agents, arm presets
including push-nerve, and dogfood docs for laptop tunnel to headless home.

Signed-off-by: Trevor P <trev2005@gmail.com>
Expose /v1/location-proof from host-agentd, merge surface/project into
Desktop Remote Agent cards, and document hybrid proof dogfood.

Signed-off-by: Trevor P <trev2005@gmail.com>
Signed-off-by: Trevor P <trev2005@gmail.com>
Birth cert (pubkey) ≠ face ≠ body ≠ place. Refuse silent dual-spawn;
privacy-shaped place_proof.v1; self-location on Desktop + host-agentd;
mobile presence snapshot on track; core handoff for block/buzz.

Co-lab SoT: #agent-entity-holon · dogfood GREEN on home host-agentd.

Signed-off-by: Trevor P <trev2005@gmail.com>
Comment on lines +64 to +72
result = subprocess.run(
cmd,
shell=True,
input=json.dumps(payload),
text=True,
capture_output=True,
timeout=float(os.environ.get("BUZZ_DRIVER_ANTIGRAVITY_TIMEOUT", "90")),
check=False,
)
Comment on lines +106 to +114
result = subprocess.run(
cmd,
shell=True,
input=prompt,
text=True,
capture_output=True,
timeout=timeout,
check=False,
)
Fetch presence inside start/respawn rules so Agents view and sidebar
cannot bypass dual-body refuse. Mobile concurrent track snapshots apply
independently; re-snapshot tracked pubkeys on reconnect. Reset terminal
panel state on community switch.

Signed-off-by: Trevor P <trev2005@gmail.com>
Add Readable Doctrine, locked contracts (C1–C8), architecture and skills
roadmap under docs/operators so the fork shows operator DNA beside the
holon/remote-agents code. Public-safe wording; skill packs stay private.

Signed-off-by: Trevor P <trev2005@gmail.com>
Add WebSocket JSONL watch for one or more channels (NIP-42 + REQ) so
operator soft-wake pipelines can consume live events without HTTP poll
storms. Diagnostics stay on stderr; unit tests cover dedupe, reconnect
overlap, and multi-channel fan-in.

Signed-off-by: Trevor P <trev2005@gmail.com>
spin 0.9.8 is yanked but still required by flume 0.11.x (mesh-llm path).
spin 0.10.0 already coexists in the lockfile. Set advisories.yanked=warn
until flume consumers can move off 0.9.8 so Rust Lint is not blocked.

Signed-off-by: Trevor P <trev2005@gmail.com>
Bump messages subcommand count and names list after adding `watch`.

Signed-off-by: Trevor P <trev2005@gmail.com>
Use build_imeta_tag when upload basename is absent so the helper is live
under -D warnings. Ignore RUSTSEC-2026-0243 (nostr-relay-pool unmaintained)
as a mesh-llm → nostr-sdk 0.44 transitive until mesh upgrades.

Signed-off-by: Trevor P <trev2005@gmail.com>
Docker builds on the fork were failing after a successful compile when
exporting registry cache to ghcr.io/block/* (permission_denied). Default
IMAGE_NAME and GATEWAY_IMAGE to ghcr.io/<owner>/… so block/buzz is
unchanged and forks write packages under their own namespace.

Signed-off-by: Trevor P <trev2005@gmail.com>
GHCR rejects mixed-case repository names. Personal forks with
repository_owner like Trevongit failed cache export with invalid
reference format. Resolve IMAGE_NAME/GATEWAY_IMAGE per job via
tr [:upper:] [:lower:].

Signed-off-by: Trevor P <trev2005@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants