Internal research report dated **August 12, 2026** consolidating, for presentation purposes, everything publicly documented about **Buzz** — **Block**'s humans + agents workspace, launched on **July 21, 2026** under the **Apache 2.0** license. It aggregates the two engineering posts already filed alongside the corporate announcement, the GitHub repository, press coverage, X, and **three independent hands-on accounts** that constitute the dossier's only non-self-reported data. **(A) A vocabulary gap documented by quotation**: **Jack Dorsey**'s launch tweet announces *"model-agnostic, decentralized, self-sovereign, and open source"*; Block's `ARCHITECTURE.md` states *"The relay is the single source of truth. All reads and writes flow through it. There is no peer-to-peer event exchange, no gossip, no replication."* The relay is therefore single and authoritative per community: Buzz's "decentralization" is an **organizational sovereignty** — self-hosting and portable identity — not network redundancy. **TFTC**'s formulation: *"Two of those three hold cleanly. The third needs a qualifier."* **(B) An asymmetry between demonstrated rigor and exploitation risk.** On one side, a rare degree of formalism for a v0.4.x/0.5.x: multi-tenant isolation specification **mechanized in TLA+**, authorization properties verified in **Tamarin**, a model-checked Git storage protocol, a hash-chained append-only audit log, 127 *event kinds*, NIP-01/42/98/34. On the other, channel membership is the unit of permission — *"channel membership is not fine-grained tool authorization"* (João Queirós) —, agents run in `--dangerously-skip-permissions` outside any sandbox on a human's machine, and observability is lacking: *"Buzz tells me an agent got a message. It doesn't tell me what happens next"* (DevTools Daily, which reports silent OOM kills). Block acknowledges it: *"the agent can do anything, and security rests entirely on restricting who can tell it what to do"*. **(C) The technical stack**, absent from the filed posts: **Rust** relay (Axum WS + REST), **Postgres**, **Redis**, **S3/MinIO** via Blossom, **Tauri + React** desktop client. Agent integration goes through **`buzz-acp`**, an **ACP** harness that plugs in goose, Codex and Claude Code and translates **ACP ↔ MCP**, plus **`buzz-agent`**, an in-house agent. The report corrects itself on one point: the *"+33% more work"* in Block's TL;DR is the **ratio of completed tasks (20 versus 15 out of 44)**, not a score gain — the score itself rises from 59.1% to 71.5%, i.e. **+12.4 points**.
#Buzz#buzz.xyz#Block
**Deep Research Veille Interne** — rapport non signé · produit le **12 août 2026** en préparation d'une présentation. Aucune URL publique ; source archivée dans `raw-data/`.
A watch note by **Didier Girard** published on **X** on **August 7, 2026**, which reads the launch of **Shieldstral 1.0 3B** (Mistral AI, August 4, 2026) not as a product release but as **the production deployment of a doctrine**. Starting point: on **May 13, 2026**, before the National Assembly's commission of inquiry into digital vulnerabilities, **Arthur Mensch** refused any oversight role for Mistral over the end use of its models — *"we do not have democratic legitimacy"* — explicitly rejecting **Anthropic**'s stance. Less than three months later, Mistral releases a **moderation model**. The author dismisses the apparent contradiction: **Shieldstral carries no taxonomy of the licit and the illicit**, it answers a **question the user writes**. **The mechanism is the heart of the note**: a three-part prompt (context + severity / a single closed question / the content to be judged), a `yes` or `no` response, and the **softmax over these two tokens** produces a continuous score between 0 and 1. **The moderation policy is not in the weights, it is read at inference time** — whereas **Llama Guard 4** embeds the MLCommons taxonomy fixed at training time, Shieldstral reads yours in natural language, modifiable **without retraining**. The technical report (**arXiv:2607.25857**, July 28, 2026) quantifies the cost of this choice: fine-tuning on public data alone = **61.1% F1** on policy adaptability; **4.4 million contrastive pairs** generated by an LLM (the same content rewritten to violate a policy but not its sibling policy) = **+23.3 points**; **91.3%** after merging three checkpoints. Characteristics: **3.8B actual parameters** (the "3B" in the name rounds down), **Ministral 3** base + **Pixtral** vision encoder, **12 languages**, **16 GB of VRAM in BF16**, **Apache 2.0**. Text performance: **84.9% average F1**, on par with **GPT-OSS-Safeguard-20B** (seven times larger), ahead of **Qwen3Guard-8B** (84.0) and far ahead of **LlamaGuard-4-12B** (69.1). **A caveat raised by the author himself**: *all these figures come from Mistral, on test sets selected by Mistral, and no third-party evaluation existed as of August 6*. The note's structuring thesis is an **opposition of topologies**: at **Anthropic**, the guardrail lives **in the weights** and the publisher arbitrates who is exempt from it (**Claude Fable 5** public with safety measures / **Claude Mythos 5** without, reserved for approved cyberdefenders of **Project Glasswing**, June 9, 2026); at **Mistral**, the guardrail **sits outside the model** — a separate, open, self-hostable component, whose policy belongs to the deployer. Explicit customer alignment (ministry of the Armed Forces, BNP Paribas, French and Luxembourg government administrations). The note closes on a **setback documented in three points**: **auditability** (binary output, no reasoning trace, while the deployer inherits the burden of justification under an AI Act audit), **robustness** (the first chapter of Voltaire's *Treatise on Tolerance* classified as "calls for violence" by a tester on the Hacker News thread — a mention/endorsement confusion), **availability** (as of August 6: no billed endpoint on La Plateforme, no official Ollama). Three deployment rules to close.
#Shieldstral#Shieldstral 1.0 3B#Mistral AI
**Didier Girard** — auteur de la note · publiée sur son compte X. Écrit ici en **analyste de doctrine industrielle** plutôt qu'en testeur : il n'a pas déployé le modèle · il croise une **audition parlementaire** (Mensch, 13 mai) · un **lancement produit** (Shieldstral, 4 août) · un **rapport technique** (arXiv, 28 juillet) et un **contre-exemple concurrent** (Anthropic, 9 juin) pour montrer qu'ils forment une position cohérente. Deux marqueurs de posture : il **borne explicitement la valeur des chiffres** qu'il cite (aucune évaluation tierce) et il **termine par des règles opérationnelles** — l'analyse doit sortir avec sa traduction en décisions de déploiement.
Tech-watch note by **Didier Girard** dated **August 2, 2026**, prompted by a colleague's question ("what is ACP?") to address a problem that is not terminological but **documentary**. **Three protocols compete for the acronym**, with no technical overlap whatsoever: **Agent Client Protocol** (client ↔ agent — Zed, August 2025, JSON-RPC 2.0 over stdio, Apache-2.0, "what LSP did for languages"), **Agentic Commerce Protocol** (agent ↔ merchant — OpenAI + Stripe, Sept. 29, 2025, competing with Google's **UCP** of Jan. 11, 2026 backed by **AP2**), and **Agent Communication Protocol** (agent ↔ agent — IBM Research / BeeAI, marginal but polluting searches). **The core of the note is not the disentangling but its observed failure**: the author searches "ACP" in their tech-watch knowledge base and gets **twelve results, all about the commerce protocol, zero about Zed's** — *"our watch agents had indexed the acronym without disambiguating it"*. Hence a knowledge-engineering rule: ***"a bare acronym is never indexed"*** — the entity is "Agent Client Protocol", "ACP" is **only an alias**, carried by three distinct entities. A structuring clarification follows (**MCP connects an agent to its tools, ACP connects a client to an agent; the two stack**), then the textbook case: **Buzz**, published by **Block** on July 21, 2026 under Apache-2.0 — a self-hostable workspace built on **Nostr**, where every human or agent participant is a **key pair** and every message, workflow step, or git push is a **signed event** in an append-only log. An entirely protocol-based architecture (`buzz-acp` an ACP harness over stdio, `buzz-agent` an ACP agent calling an LLM, `buzz-dev-mcp` an MCP shell + editing server), hence agent agnosticism: **Goose, Claude Code, and Codex** plug in through the same harness, and **Hermes** (Nous Research) connected to it without Block writing a single line — *"N+M instead of N×M, running in production"*. The note closes on the question of the **Claude subscription** versus third-party agents, with a five-stage 2026 timeline and a **design rule** that holds beyond this case: the line is not legal but **architectural** — ***"who is consuming, and on whose behalf"*** (an `owner-only` agent consumes your subscription on your behalf; an `anyone` agent in a shared channel routes your colleagues' requests through your account). **Verification carried out on this corpus**: the thesis holds, and more starkly than the note claims — not only is "Agent Client Protocol" **completely absent**, but the bare acronym `ACP` **is already typed as an entity** in two fiches, and the KB page `Agentic-Commerce-Protocol` **already attributes the protocol to Google** when it belongs to OpenAI + Stripe. The collision described is not a future risk: it has **already produced an attribution error** in the graph.
**Didier Girard** — auteur de la note. Écrit ici depuis la position de **praticien de la veille outillée** : le déclencheur est une question de collègue · le matériau principal est le comportement observé de sa propre base de connaissances · et la conclusion est une **règle de curation** adoptée en interne. Le texte alterne donc deux voix — l'explicateur de protocoles et l'ingénieur de la connaissance qui constate un défaut chez lui et en tire une norme.