Proposal: bridge existing A2A runtimes through Buzz proxy identities

[tmarman]

The problem

Some agents already run somewhere else. That runtime owns their prompts, memory, tools, and execution state. Today Buzz has to be configured as if it owns them too, which blurs who holds the credentials and who controls the process.

What we propose

Let Buzz talk to an agent without taking over its runtime.

• An OASF Agent Record says what the agent is and where to reach it over A2A.
• A small buzz-a2a-acp process sits in between. Buzz starts and stops that process over ACP, the same way it manages any local agent.
• The agent keeps running where it already runs. Buzz never receives its keys.
• Buzz gives the agent a local Nostr identity so it can take part in a channel.
• When the agent replies, Buzz posts that reply once, under the local identity.
• The relay does not change.

What we check before trusting a record

• HTTPS only, except loopback for local development.
• DNS answers are validated and pinned before we connect.
• Artifacts must match their declared digest, media type, and size.
• A bearer token is only ever sent to the one endpoint it was configured for.
• The adapter process never inherits Buzz or Nostr private keys.
• If posting fails and we retry, we resend the same signed event instead of signing a new one.

Code: #3394 (draft).

Not in scope

• AGNTCY Directory lookup
• Keeping the agent's original identity in Buzz
• Cancelling or streaming a remote turn
• The team join UI (Proposal: add Remote Team discovery and join #3390)
• Enforcing project or Space permissions
• MCP Apps rendering

Questions for maintainers

1. Is "Buzz supervises a local adapter, the adapter calls A2A" the right split for an agent that already runs elsewhere?
2. Should the adapter stay a separate crate and a shipped sidecar?
3. Do you need remote cancellation or streaming before this could merge?
4. A source runtime may want to know which organization, project, or channel a turn came from. Is an A2A extension the right way to pass opaque references for that, or does something existing already cover it? These would be forwarded metadata only — they would not authorize anything on their own.

[tmarman]

Draft implementation: #3394. Review chain: #3389 / #3394 (runtime bridge and proxy publication) → #3390 (Remote Team discovery and join) → #3391 (optional Agency Context references). The later code slices remain staged until the runtime boundary is accepted.