Product announcement post from **Block Engineering** signed by **Thomas Petersen** (*Principal Designer & Builder*), published on **August 18, 2026**, ~1,800 words across thirteen short sections, introducing **Buzz Projects** — a **software forge hosted on its own relay**: Git repositories, branches, pull requests, issues, review and merge, multi-repo projects, an activity feed, all linked to conversation channels. The post's standfirst and thesis: *« Coding agents are the terminal for your computer. Buzz is the terminal for your network. »* Three contributions. **(A) A trust doctrine grounded in *ex post* proof rather than *ex ante* authorization**: on one side *« No forced guardrails, no limitations on what your agents are allowed to help you with »*, on the other *« Every push, review, approval, and merge is a signed Nostr event. If an agent authors a patch, you can see which agent produced it and which human authorized that agent to act »*; the section closes on a stated direction — *« we are already exploring ideas around agent trust protocols informed by past behavior »*. **(B) Git interoperability without proprietary tooling**: *« These are standard git repositories… You can fetch, clone, pull, and push over plain Smart HTTP, with no custom tooling or wrapper CLI required »*, with the clé Nostr serving as a single identity — *« The same npub that signs your messages signs your pushes. »* **(C) A distinction between execution surface and network presence**: *« A terminal gives an agent somewhere to execute commands and change files, but it does not give it a persistent place in the network. Buzz does. »* The post produces no figures and contains no outbound links; it qualifies itself as preliminary six times (*« still very basic »*, *« fairly elementary »*, *« still under experiments »*), and Projects lives under the **Experiments** tab of Buzz Desktop.
#Buzz#Buzz Projects#Block
**Thomas Petersen** — *« Principal Designer & Builder »* chez **Block** · auteur unique et signataire du billet ; première apparition dans le corpus. Publié le **18 août 2026** sur le blog **Block Engineering**. Troisième signature Block sur Buzz en un mois · après Tyler Longwell (21 juillet) et Atish Patel (6 août) · et la première non-ingénieur.
SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)