Written with AI assistance from the source video. The video is the authority.
Log in to leave a comment
No posts yet
There comes a point when pushing code to a centralized repository starts to feel uncomfortable. Policies change frequently, and you never really know where your code is being used. For solo freelancers and small teams, data sovereignty is a matter of survival. Buzz and the Nostr NIP-34 protocol offer a realistic alternative that doesn't rely on a single corporation. However, actually making the move can feel daunting, as you have to handle procedures, costs, and security issues on your own.
If you simply run git push --mirror, the server will reject it. This is due to GitHub-internal references like refs/pull/*. Target servers will not accept these hidden references. To transfer your code without conflicts, you need to strip out unnecessary references and explicitly push it.
Create a bare repository in a temporary directory, delete the GitHub-specific references, and then push it to the Buzz endpoint. If there are large files, you must also handle LFS objects separately.
`bash
#!/usr/bin/env bash
set -euo pipefail
GITHUB_REPO_URL="2"
TEMP_DIR=$(mktemp -d -t buzz-migration-XXXXXX)
trap 'rm -rf "$TEMP_DIR"' EXIT
git clone --mirror "TEMP_DIR/bare_repo.git"
cd "$TEMP_DIR/bare_repo.git"
git for-each-ref --format='%(refname)' refs/pull/ | while read -r ref; do
git update-ref -d "$ref"
done
git remote add buzz "$BUZZ_REMOTE_URL"
git push --force --prune buzz "+refs/heads/:refs/heads/" "+refs/tags/:refs/tags/"
ROOT_COMMIT=ROOT_COMMIT)"
`
Running this script preserves 100% of your commit history. The initial commit hash becomes the unique identifier of your project.
| Comparison Item | GitHub | Buzz / Nostr NIP-34 |
|---|---|---|
| Repository Identification | Central server DB record (org/repo) |
Initial commit ID and Nostr event ID |
| Authentication Method | OAuth, PAT, SSH Key | secp256k1 elliptic curve asymmetric signatures |
| Patch Exchange | GitHub-specific API | NIP-34 patch events (kind: 1617) |
In the Nostr ecosystem, humans and AI agents are treated as identical cryptographic entities. They authenticate each other using 32-bit public keys and Schnorr signatures. Hardcoding private keys into your code will inevitably lead to a security incident. You should either keep them strictly in memory via environment variables or use a remote signer.
to verify that patches sent by agents have not been tampered with in transit, you must check the NIP-01 serialization hash.
`python
import json
import hashlib
from coincurve import PrivateKey
def create_signed_agent_event(secret_key_hex: str, kind: int, content: str, tags: list) -> dict:
sk = PrivateKey.from_hex(secret_key_hex)
pubkey_hex = sk.public_key.format(compressed=True)[1:].hex()
created_at = 1710000000
serialized_data = json.dumps(
[0, pubkey_hex, created_at, kind, tags, content],
separators=(',', ':'),
ensure_ascii=False
)
event_id = hashlib.sha256(serialized_data.encode('utf-8')).hexdigest()
sig_hex = sk.schnorr_sign(bytes.fromhex(event_id), None, raw=True).hex()
return {
"id": event_id,
"pubkey": pubkey_hex,
"created_at": created_at,
"kind": kind,
"tags": tags,
"content": content,
"sig": sig_hex
}
def verify_agent_event(event: dict) -> bool:
preimage = [0, event["pubkey"], event["created_at"], event["kind"], event["tags"], event["content"]]
serialized = json.dumps(preimage, separators=(',', ':'), ensure_ascii=False)
computed_id = hashlib.sha256(serialized.encode('utf-8')).hexdigest()
return computed_id == event["id"]
`
When you need to exchange code confidentially, encrypt it using ChaCha20 according to the NIP-44 v2 specification.
If you leave coding up to agents, they can get caught in autonomous fix loops and burn through tokens in no time. As failed records accumulate, your context becomes polluted and costs skyrocket. To prevent this, you need to enforce limits at the proxy level.
Place a LiteLLM proxy in front and restrict daily budgets and speed using virtual keys.
`bash
curl -X POST 'http://localhost:4000/key/generate'
-H 'Authorization: Bearer sk-master-key-1234'
-H 'Content-Type: application/json'
-d '{
"key_alias": "auto-coder-agent-01",
"max_budget": 5.0,
"budget_duration": "1d",
"tpm_limit": 50000,
"rpm_limit": 30,
"models": ["agent-code-model"]
}'
`
If the daily budget exceeds $5, it will immediately throw an error and halt. You can also tighten the entire team's budget using a configuration file.
`yaml
model_list:
litellm_settings:
max_budget: 100.0
budget_duration: "30d"
default_team_settings:
`
You should also stop dumping entire codebases into the context. Use Tree-Sitter to extract only the necessary function signatures and the immediate surroundings of modified hunks to minimize token waste. Adopting this approach cuts unnecessary tool calls by more than half.