What ainb should port from block/buzz

┌──────────────┐  ┌──────────────────┐  ┌────────────┐
│ Desktop      │  │ buzz-acp harness │  │ buzz-cli   │
│ (Tauri+React)│  │ ACP stdio ndjson │  │ agent-first│
│ mobile (Flu.)│  │ goose/codex/     │  │ JSON CLI   │
└──────┬───────┘  │ claude pool 1-32 │  └─────┬──────┘
       │ WS+REST  └────────┬─────────┘        │
       ▼                   ▼ WS+REST          ▼
┌─────────────────────────────────────────────────────┐
│ buzz-relay (Axum): NIP-01 signed events, kinds     │
│ channels·threads·DMs·canvas·media·search·audit·git· │
│ workflows·huddles(voice)·presence                   │
└──────┬──────────────┬──────────────┬────────────────┘
   Postgres         Redis         S3/MinIO
   (events+FTS)     (pubsub)      (Blossom media)

// every event, human or agent:
{
  "id":      "<sha256 of canonical serialization>",
  "pubkey":  "<secp256k1 public key>",
  "kind":    40002,          // the only dispatch switch
  "tags":    [["e","…"],["p","…"]],
  "content": "…",
  "sig":     "<Schnorr signature>"
}

// new feature = new kind number = zero breaking changes.
// 81 kinds defined; custom range 40000-49999.

# minimum self-host = 5 containers (deploy/compose/compose.yml)
relay + postgres:17 + redis:7 + minio + minio-init

no feature flags to drop any of them.
buzz-db: no [features]; hard-errors at boot without Postgres
buzz-pubsub: Redis pool built unconditionally
buzz-media: single concrete S3 Bucket, no trait
# → the chat substrate is NOT liftable; the patterns are.

┌─────────┐ send-keys -l --   ┌───────────────┐
│ fleet-  │──── + settle ────▶│ tmux pane     │
│ core    │      + retry ×3   │ claude / codex│
│         │◀──────────────────│               │
└─────────┘  capture-pane +   └───────────────┘
             jsonl tail
# inject: paste heuristics, no ack
# observe: scrollback scraping, re-implemented
#          Claude path-slugging rules
# permissions: detected via '?' + │┌└ chars

┌─────────┐ fleet/* ┌──────────────────────────┐
│ TUI /   │────────▶│ hangar daemon            │
│ Fleet / │         │  chat store (hangar-store)│
│ web     │◀────────│  AgentPool (ACP)          │
└─────────┘ events  └───┬──────────────────┬───┘
                 ACP stdio│                │tmux (kept)
        ┌────────────────▼───┐   ┌────────▼─────────┐
        │ claude-agent-acp / │   │ interactive tmux │
        │ codex-acp / gemini │   │ sessions (watch- │
        │ (headless, pooled) │   │ able, attachable)│
        └────────────────────┘   └──────────────────┘
# chat sessions: structured prompt/stream/permission/cancel
# terminal sessions: unchanged, ainb's core value stays

1. ainb-acp crate on agent-client-protocol v1.x:
   spawn adapter → initialize → session/new
   (pass ainb MCP servers) → session/prompt →
   reduce session/update into fleet events
2. daemon-owned AgentPool (adapt buzz pool/queue/
   circuit-breaker; session per chat channel)
3. AcpProviderAdapter impl of existing trait
   (fleet-core/src/fleet/provider.rs:149-166);
   capability bitset advertises send/observe/
   cancel/steer
4. chat store + fleet/message_* methods (§4)
5. later: structured session/request_permission
   replaces scrape heuristics for ACP sessions
// Provider enum is on the wire → batch the
// growth with one fleet protocol version bump

 machine 1              hub (1 binary)          machine 2
┌──────────┐   wss    ┌──────────────┐   wss   ┌──────────┐
│ ainb     │─────────▶│ event store  │◀────────│ ainb     │
│ + key    │◀─────────│ + sub filter │────────▶│ + key    │
└──────────┘  signed  │  (sqlite)    │         └──────────┘
              events  └──────────────┘
  auth: NIP-42 challenge (50 lines, buzz-auth/nip42.rs)
  identity: NIP-OA owner→agent tags
# the buzz-shaped answer. cost: you now own a hub,
# a key format, and a migration story.

┌──────────┐                            ┌──────────┐
│ ainb A   │═════ iroh QUIC direct ═════│ ainb B   │
│ ed25519  │      (ALPN "ainb/1")       │ ed25519  │
└────┬─────┘                            └────┬─────┘
     │      ┌────────────────────┐           │
     └─────▶│ rendezvous blob:   │◀──────────┘
            │ signed peer records│
            └────────────────────┘
  admission: peer ∈ allowlist, else drop (fail closed)
# copy endpoint.rs + wire.rs framing (~140 lines) from
# buzz-relay-mesh. no server, NAT handled by iroh.
# cost: rendezvous is still a distributed-systems pick.

┌──────────┐  tailnet (WireGuard, MagicDNS)  ┌──────────┐
│ ainb TUI │────────────────────────────────▶│ hangar   │
│ laptop   │  existing fleet protocol,       │ daemon   │
└──────────┘  unchanged, over 100.x.y.z      │ devbox   │
                                             └──────────┘
  authn: tailnet ACL + device auth (already solved)
  already in-tree: ainb-web binds non-loopback behind a
  bearer token (config.rs:97-136); docs describe tailnet
  usage; FleetTransport seam fits a remote-peer impl
# zero new protocol, zero new crypto, zero new binary