deploy(arch-box): CI-built buzz-acp binary + systemd user unit

Upstream ships desktop installers but no standalone buzz-acp binary, and
buzz-acp is the only shipped path to an agent that is not tied to a desktop
app staying open (managed agents are child processes of the Tauri app;
remote agents are still design-stage, no provider crate exists).

Building in CI instead of on the agent host keeps that box free of a Rust
toolchain, makes the binary traceable to a commit, and lets anyone on the
team cut a new build instead of it depending on one laptop.

- workflow: builds x86_64-linux, smoke-checks it, publishes a release asset
- install script: pulls newest (or a pinned) build, verifies sha256
- systemd user unit + env template, matching the hermes-gateway-* pattern

Author: A-PachecoT

.github/workflows/buzz-acp-linux.yml

@@ -0,0 +1,81 @@
+# Build the buzz-acp harness for x86_64 Linux and publish it as a release asset.
+#
+# Why this exists: upstream publishes desktop installers but no standalone
+# buzz-acp binary, and buzz-acp is what runs a 24/7 agent that is NOT tied to a
+# desktop app being open (see VISION_REMOTE_AGENTS.md — remote agents are still
+# design-stage, so the harness is the only shipped path to an always-on agent).
+#
+# Building here rather than on the target host keeps the agent box free of a
+# Rust toolchain and makes the update path reproducible and reviewable by anyone
+# on the team, instead of depending on one person's laptop.
+#
+# Update path: rebase this branch onto a newer upstream ref, run this workflow,
+# then re-run deploy/arch-box/install-buzz-acp.sh on the host.
+name: buzz-acp (linux x86_64)
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [railway-deploy]
+    paths:
+      - "crates/buzz-acp/**"
+      - "crates/buzz-sdk/**"
+      - "crates/buzz-ws-client/**"
+      - "rust-toolchain.toml"
+      - ".github/workflows/buzz-acp-linux.yml"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # rust-toolchain.toml pins the version, so `rustup show` installs exactly
+      # what the workspace expects instead of whatever the runner ships.
+      - name: Install pinned Rust toolchain
+        run: rustup show
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: buzz-acp-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: buzz-acp-${{ runner.os }}-
+
+      - name: Build
+        run: cargo build --release -p buzz-acp
+
+      # Fail loudly here rather than shipping a binary that cannot start.
+      - name: Smoke check
+        run: |
+          ./target/release/buzz-acp --help > /dev/null
+          echo "binary ok: $(./target/release/buzz-acp --help | head -1)"
+
+      - name: Publish release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          SHORT_SHA="$(git rev-parse --short HEAD)"
+          TAG="buzz-acp-linux-${SHORT_SHA}"
+          cp target/release/buzz-acp "buzz-acp-x86_64-linux"
+          sha256sum "buzz-acp-x86_64-linux" > "buzz-acp-x86_64-linux.sha256"
+          # Idempotent: re-running the workflow on the same commit replaces the
+          # assets instead of erroring on an existing tag.
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$TAG" \
+              "buzz-acp-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \
+              --repo "$GITHUB_REPOSITORY" --clobber
+          else
+            gh release create "$TAG" \
+              "buzz-acp-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "buzz-acp linux x86_64 @ ${SHORT_SHA}" \
+              --notes "Built from ${GITHUB_SHA} by ${GITHUB_WORKFLOW}. Consumed by deploy/arch-box/install-buzz-acp.sh."
+          fi

deploy/arch-box/buzz-acp.env.example

@@ -0,0 +1,28 @@
+# Copy to ~/.config/buzz-acp/buzz-acp.env and chmod 600. Never commit the real file.
+#
+# The agent's Nostr identity. Its pubkey must already be a relay member
+# (buzz-admin add-member) or the harness authenticates and then sees nothing.
+# Stored in Vaultwarden: Founders Keys / buzz-relay-cofoundy
+BUZZ_PRIVATE_KEY=
+
+BUZZ_RELAY_URL=wss://buzz.cofoundy.dev
+
+# Claude Code over ACP. Requires `npm install -g @agentclientprotocol/claude-agent-acp`
+# and an authenticated `claude` session on this host (~/.claude/.credentials.json) —
+# that session is what lets the agent bill against the Max subscription instead of
+# a per-token ANTHROPIC_API_KEY.
+BUZZ_ACP_AGENT_COMMAND=claude-agent-acp
+
+# Author gate. `owner-only` is the safe default but drops every event until an
+# owner is resolved, so set the owner explicitly rather than widening the gate.
+# Andre's pubkey:
+BUZZ_ACP_AGENT_OWNER=4cb243bbc2efb7f0871b84e8ff641d7d8329951d900d19ee98018a01f18fba40
+BUZZ_ACP_RESPOND_TO=owner-only
+
+# Parallel agent subprocesses (1-32). Each spawns its own MCP server, so memory
+# scales roughly linearly. Start at 1 and raise only if queue depth grows.
+BUZZ_ACP_AGENTS=1
+
+# Self-prompting on idle. 0 = disabled; enable (>=10s) only once you actually
+# want an autonomous agent, since it burns tokens with nobody asking.
+BUZZ_ACP_HEARTBEAT_INTERVAL=0

deploy/arch-box/buzz-acp.service

@@ -0,0 +1,44 @@
+# systemd USER unit for the buzz-acp harness on the Cofoundy agent box.
+#
+# Install:
+#   mkdir -p ~/.config/systemd/user ~/.config/buzz-acp
+#   cp buzz-acp.service ~/.config/systemd/user/
+#   cp buzz-acp.env.example ~/.config/buzz-acp/buzz-acp.env
+#   chmod 600 ~/.config/buzz-acp/buzz-acp.env   # then fill it in
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now buzz-acp
+#   loginctl enable-linger "$USER"              # survive logout / reboot
+#
+# Deliberately a *user* unit, matching the hermes-gateway-* agents already on
+# this box: same lifecycle, same journal, no root.
+[Unit]
+Description=Buzz ACP harness (Cofoundy agent on buzz.cofoundy.dev)
+Documentation=https://github.com/block/buzz/tree/main/crates/buzz-acp
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Secrets live in a chmod-600 env file, never in the unit — the unit is
+# committed to git, the env file never is.
+EnvironmentFile=%h/.config/buzz-acp/buzz-acp.env
+ExecStart=%h/.local/bin/buzz-acp
+Restart=on-failure
+RestartSec=10s
+# The relay is the source of truth for agent state, so a restart is cheap; cap
+# the churn so a misconfigured harness cannot hot-loop against the relay.
+StartLimitIntervalSec=300
+StartLimitBurst=5
+
+# The agent shells out through its MCP tools, so this is not a sandbox — it
+# runs at the operator's trust level by design (VISION_AGENT.md). These are
+# blast-radius reducers, not a containment boundary.
+NoNewPrivileges=true
+PrivateTmp=true
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=buzz-acp
+
+[Install]
+WantedBy=default.target

deploy/arch-box/install-buzz-acp.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+#
+# Install/update the buzz-acp harness on the Cofoundy agent box.
+#
+# Pulls the newest binary published by .github/workflows/buzz-acp-linux.yml
+# rather than building locally, so the host needs no Rust toolchain and the
+# running binary is always traceable to a commit.
+#
+# Usage:
+#   ./install-buzz-acp.sh              # newest published build
+#   ./install-buzz-acp.sh <short-sha>  # pin a specific build
+#
+set -euo pipefail
+
+REPO="${BUZZ_ACP_REPO:-cofoundy/buzz}"
+DEST="${BUZZ_ACP_DEST:-$HOME/.local/bin}"
+ASSET="buzz-acp-x86_64-linux"
+
+pinned="${1:-}"
+if [ -n "$pinned" ]; then
+    tag="buzz-acp-linux-${pinned#buzz-acp-linux-}"
+else
+    # Releases are listed newest-first; filter to this workflow's tag namespace
+    # so unrelated upstream releases (desktop builds, etc.) never match.
+    tag="$(gh release list --repo "$REPO" --limit 50 \
+        | awk '{print $1}' | grep '^buzz-acp-linux-' | head -1)"
+    [ -n "$tag" ] || { echo "no buzz-acp release found in $REPO — run the workflow first" >&2; exit 1; }
+fi
+
+echo "installing $tag from $REPO"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+gh release download "$tag" --repo "$REPO" --pattern "$ASSET*" --dir "$tmp" --clobber
+
+# Verify before installing: a truncated download would otherwise land as a
+# broken binary that only fails at agent start time.
+( cd "$tmp" && sha256sum -c "${ASSET}.sha256" )
+
+mkdir -p "$DEST"
+install -m 0755 "$tmp/$ASSET" "$DEST/buzz-acp"
+
+echo "installed: $DEST/buzz-acp ($tag)"
+"$DEST/buzz-acp" --help | head -1
+
+cat <<EOF
+
+Next:
+  systemctl --user restart buzz-acp   # if the unit is already installed
+  systemctl --user status buzz-acp
+EOF