feat(desktop): join Remote Agencies via OASF and A2A

[tmarman]

Why

Buzz can supervise local agents through ACP, but an existing remote runtime already owns its agents, prompts, memory, tools, and execution state. Configuring each of those agents separately in Buzz duplicates the source runtime's roster and loses the organization and Space context that it already exposes.

This draft adds a reviewable Remote Agency join flow. A community owner can inspect public agent records, select agents, optionally associate an advertised Space with a Buzz channel, and join the selected agents through Buzz-local proxy identities.

I am opening this as a draft to validate the boundaries and preferred split before asking maintainers to accept the full implementation.

What

• Use OASF-compatible records to describe agents, capabilities, and reviewed locators.
• Invoke the source runtime through A2A JSON-RPC.
• Supervise the local A2A bridge through Buzz's existing ACP managed-agent lifecycle.
• Create Buzz-local Nostr proxy identities for channel participation.
• Preserve source-defined display names without claiming source-identity continuity.
• Project Agency, agent, selected Space, and Buzz channel references into A2A request metadata.
• Store endpoint-scoped bearer tokens in the operating-system credential store.
• Package the buzz-a2a-acp adapter in desktop, canary, and release builds.

The source runtime remains authoritative for prompts, memory, tools, execution, runtime state, and signing authority. Buzz does not import the source runtime's private keys.

Security boundary

• Non-loopback endpoints require HTTPS. Explicit loopback HTTP remains available for local development.
• Discovery rejects private or mixed DNS results, cross-origin references, and IPv4-in-IPv6 transitional ranges.
• Reviewed endpoints are pinned to addresses that passed policy. Invocation does not perform a second unvalidated DNS lookup.
• Bearer tokens are bound to the canonical reviewed endpoint. They are not written to agent metadata, command-line arguments, persisted bindings, logs, or prompt text.
• OASF artifact descriptors require a digest, media type, and byte size before fetch.
• Remote runtimes do not receive BUZZ_PRIVATE_KEY or unrestricted Buzz signing authority.

Risk assessment

High. This adds a new remote execution path, local proxy identities, credential storage, and packaged sidecar code. The implementation keeps discovery, invocation, process supervision, and Buzz identity as separate boundaries so each can be reviewed independently.

The draft intentionally does not consume AGNTCY Directory. A separate stacked draft explores verified Directory resolution without coupling that trust surface to this base change.

Deliberate limitations

• A joined agent uses a Buzz-local proxy identity. Source identity continuity is not claimed.
• Space selection and metadata projection are implemented. Source-runtime Space authorization and enforcement are not yet proven end to end.
• Buzz cancellation stops the local turn, but does not yet issue an A2A remote-cancel request.
• A binding can be created but not removed through the UI. Stored credentials can be revoked.
• Invocation supports message/send and terminal task polling. Streaming and richer A2A interaction are follow-up work.
• Advertised surface fields are reviewed metadata only. Portable rendering and action routing are outside this draft.

Tests

Validated on the reviewed source tree, which is byte-for-byte identical to this clean contribution commit:

• pnpm test from desktop/: 3,726 passed
• pnpm typecheck from desktop/
• pnpm lint and pnpm check from desktop/
• cargo test -p buzz-a2a-acp: 24 passed
• cargo clippy -p buzz-a2a-acp --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo test remote_agencies from desktop/src-tauri/: 15 passed
• cargo test --manifest-path desktop/src-tauri/Cargo.toml agent_models: 25 passed
• cargo clippy --manifest-path desktop/src-tauri/Cargo.toml --all-targets -- -D warnings

The personal-fork CI passed Rust lint, unit tests, Desktop Core, all desktop smoke and integration shards, Windows Rust, mobile, security, and both server cross-compiles. Fork Docker jobs compile and then fail when they try to write cache layers to ghcr.io/block/.... The fork macOS packaging job fails in the existing cold-cache mesh-llm checkout lookup.

Manual proof

The feature was exercised end to end against a private A2A-compatible runtime:

• Buzz discovered a projected roster through OASF-compatible records.
• Buzz stored and applied the reviewed endpoint credential.
• The adapter invoked a remote agent over A2A.
• The agent completed a long-running turn with the expected Buzz channel and agent references.
• That run exposed the remaining Space-authorization limitation above.

Review focus

1. Is the split between OASF discovery, A2A invocation, ACP bridge supervision, and Buzz-local identity correct?
2. Is the endpoint, DNS-pinning, and credential boundary sufficiently constrained?
3. Should Space enforcement, remote cancellation, or leave/remove UI block this from leaving draft?
4. Should the adapter and Desktop join flow remain one PR, or should maintainers review them separately?