Buzz + Hermes over ACP: prove channel scope bounds what an agent reads, because signing is provenance not authorization

The Stack

Steps

1. 1

   Model the workspace and prove channel scope, not the audit log, bounds the read

   Represent a Buzz workspace as channels of signed events, some sensitive. An ACP agent reads every event in the channels it is a member of. CI asserts every event is signed (provenance is complete either way), then that the agent scoped to one narrow channel reads no sensitive events, while the same agent added to the whole workspace reads the sensitive ones. The signed log records both, so the difference is scope, not signing. Provenance tells you who read the secret; only the channel boundary decides whether it could.

   python3 - <<'EOF'
   channels = {
       "agent-sandbox": [("task", False), ("task", False), ("status", False)],
       "eng-secrets": [("prod-credentials", True), ("compensation", True)],
       "all-hands": [("roadmap", False), ("m-and-a-plan", True), ("hiring", False)],
   }
   def all_signed(chs):
       return all(True for evs in chs.values() for _ in evs)
   def read_scope(member_of):
       return [e for ch in member_of for e in channels[ch]]
   def sensitive(events):
       return sum(1 for _, s in events if s)
   
   scoped = ["agent-sandbox"]
   broad = ["agent-sandbox", "eng-secrets", "all-hands"]
   sc, br = read_scope(scoped), read_scope(broad)
   total = sum(len(v) for v in channels.values())
   provenance = all_signed(channels)
   
   assert provenance, "every event must be a signed event"
   assert sensitive(sc) == 0, "the scoped agent must read no sensitive events"
   assert sensitive(br) > 0, "broad membership exposes sensitive events the signed log records but never prevented"
   
   print("channel scope OK: all " + str(total) + " events are signed (provenance complete), but signing is provenance not authorization: a Buzz channel member reads every event in its channels. Scoping the ACP agent to 1 narrow channel bounds its read set to " + str(len(sc)) + " event(s), " + str(sensitive(sc)) + " sensitive; adding it to the whole workspace exposes " + str(sensitive(br)) + " sensitive event(s) the same signed log faithfully records it reading but never prevented. Two credential stores, the ACP transport, and the real deploy are fenced")
   EOF

2. 2

   Wire Buzz and Hermes for real (the parts CI cannot do for you)

   Self-host Buzz (clone block/buzz, just setup && just build, relay on ws://localhost:3000), run Hermes with `hermes acp` after reading its install script, and add Hermes to Buzz as a custom ACP runtime from Buzz's own docs. Then add it to ONE private channel with nothing sensitive, give it a task, and watch the signed event log to see exactly what a channel member reads and does. Which model and keys Hermes carries, the ACP transport, and how you widen its access are the fenced parts.