Buzz gives agents the same rooms and identities as people
Buzz treats a person, an agent, a workflow, and a source-control action as participants in one event system. Messages, reactions, approvals, patches, and audit entries are signed Nostr events stored by a relay. An agent can join a channel with its own key, search history, post a patch, run a workflow, or ask for permission.
The ambition is enormous. Our checkout contained 4,389 files, about 1,016,104 source lines, and 78.6 MB. The repository spans a Rust relay and services, a Tauri and React desktop app, a CLI, ACP and MCP bridges, agent tools, workflow execution, git hosting, media, audit logs, search, authentication, and test clients. This is closer to building a collaboration suite than adding an agent to chat.
One community maps to one relay URL in the default deployment, while a hosted operator can map several domains to shared infrastructure without exposing cross-community state. The relay remains the source of truth. Postgres stores events and full-text search, Redis handles pub/sub and presence, and S3-compatible storage holds media. A hash-chain audit log and signed identities give Buzz a coherent security model, provided key custody and access policies are handled well.
The working column is useful, and the pending column matters more
The README separates shipped features from work in progress and ideas. Channels, threads, direct messages, canvases, media, search, the desktop client, CLI, YAML workflows, git events, and git hosting are listed as working. Mobile clients, workflow approval connections, and huddle lifecycle events are still being connected. Push notifications and cross-relay reputation appear in the ideas column. That candor is valuable because the vision sections describe a wider destination than today's product.
Our pnpm install added 611 packages and consumed 445 MB, but it did not verify any of those features. Open issue 5965 gives a concrete example of the remaining seams: mentions from a CLI-created identity reportedly appear in an agent's feed yet do not dispatch a turn, even after the sender is placed on the instruction allowlist. Human desktop mentions work in the same channel. Agent-to-agent delegation is central to Buzz's pitch, so this edge deserves a release-level regression test.
Another open report, issue 6843, describes version 0.5.19 against one hosted community relay. Identity publishing and channel membership worked, while message sending and opening direct messages returned HTTP 405. That may be a deployment routing gap rather than a protocol defect, as the reporter suggests. Either way, it shows how the desktop, CLI, relay, and hosted backend can disagree while only part of the workspace appears broken.
What happened when we ran it
Our pnpm dependency installation succeeded in 40 seconds. It installed 611 packages and occupied 445 MB on disk in a fresh Node 22 Debian container with 3 CPUs and 8 GB of RAM. The repository is a monorepo with workspaces, 18 CI workflow files, a Dockerfile, and a compose file.
The lab harness found no build script or build target at the package root, so it skipped compilation. It also found no root test script or test target and skipped tests. Those are missing verification entry points for a standard Node harness, not evidence that Buzz has no build or test system. The README directs contributors to just build, just test-unit, just test, and just ci, which also require the pinned Rust and service toolchain.
We therefore cannot claim a passing build, a passing test suite, or a vulnerability count from this run. The only measured execution result beyond repository size is the successful 40-second pnpm install. Buzz's own CI is extensive, and issue 6835 documents a desktop smoke test that sometimes fails all 3 retries within one run and then passes on the same commit rerun. That issue gives useful evidence about test flakiness; it does not convert our skipped test step into a pass.
Self-hosting means running a small platform
Local source setup uses Hermit to pin tools, just to coordinate tasks, and Docker for dependencies and migrations. Without Hermit, the README calls for Rust 1.88 or newer, Node 24 or newer, pnpm 10 or newer, and just. The production Compose bundle adds Postgres, Redis, MinIO, and a persistent git volume. Caddy can handle TLS on a public VPS.
The 445 MB JavaScript dependency tree is only one part of that footprint. Operators must keep the relay private key, git-hook secret, database credentials, Redis credentials, and object-store credentials stable across restarts. Automatic migration is opt-in, and the deployment guide recommends pinning the container by commit or release instead of tracking main. External S3 providers that require virtual-host addressing need Helm or custom Compose because the bundled stack fixes a path-style MinIO endpoint.
Desktop distribution has its own rough edge. macOS and Linux packages are available, while the Windows x64 installer is labeled alpha and unsigned, which can trigger SmartScreen. By default the client connects to a local relay and must be pointed elsewhere through configuration. Block employees are explicitly directed to a separate internal build, a reminder that public OSS behavior and the company's own deployment are not identical products.
Activity is exceptional, stability is still catching up
GitHub showed 30,699 stars, 3,155 open issues and pull requests combined, a push on 2026-08-26, and desktop v0.5.20 released the same day. That count includes a very large volume of pull requests and automation, so it is not 3,155 confirmed bugs. Current work touches mobile notifications, agent policies, project homes, desktop behavior, security review, performance, and storage configuration. The project is moving at a pace that increases both confidence in attention and upgrade risk.
Buzz should be tested as a parallel workspace for one engineering project, with a conventional chat and forge kept as the fallback. Its signed event model gives agent activity a better identity and audit story than ordinary chat bots. The missing root build and test targets, multi-service deployment, unsigned Windows client, and open agent-dispatch reports keep it out of the default-production recommendation today.