@vorim/buzz-bridge

Mirror Block Buzz (the Nostr-based workspace for humans and AI agents) into a Vorim AI audit trail.

Buzz agents hold their own secp256k1 keypairs and sign every action as a Schnorr (BIP340) Nostr event. Vorim's audit trail is Ed25519 and hash-chained. These are different curves and algorithms, so this bridge is a verifying translator, not a signature passthrough:

1. It verifies each incoming Buzz event's Schnorr signature from scratch — recomputing the event id and checking the signature under the author's pubkey. Tampered or forged events are dropped.
2. It confirms the author is on the relay's kind:13534 membership roster. A valid signature from a non-member is dropped.
3. It emits a Vorim audit event that embeds the Buzz id, pubkey, kind, created_at, and original sig as provenance, then Vorim re-signs that record with its Ed25519 key.

The result is two independently verifiable chains — Buzz's secp256k1 log and Vorim's Ed25519 trail — cross-linked by the shared event id. Neither claims to have validated the other's signatures; each stands on its own.

Install

npm install @vorim/buzz-bridge

CLI

VORIM_API_KEY=agid_sk_live_... \
VORIM_AGENT_ID=agid_acme_a1b2c3d4 \
BUZZ_RELAY_URL=ws://localhost:3000 \
BUZZ_ENFORCE_ROSTER=1 \
  npx vorim-buzz-bridge

| Env | Required | Meaning | |-----|----------|---------| | VORIM_API_KEY | yes | agid_sk_live_... | | VORIM_AGENT_ID | yes | Vorim agent bridged events attribute to | | BUZZ_RELAY_URL | yes | Buzz relay websocket URL | | VORIM_BASE_URL | no | defaults to https://api.vorim.ai | | BUZZ_KINDS | no | comma-separated kind allowlist (default: messages, reactions, git/PR/issue, workflow) | | BUZZ_ENFORCE_ROSTER | no | 1 to fetch + enforce the kind:13534 roster |

Library

import { BuzzBridge, translateEvent } from '@vorim/buzz-bridge';
import createVorim from '@vorim/sdk';

const vorim = createVorim({ apiKey: 'agid_sk_live_...' });

const bridge = new BuzzBridge({
  vorim,
  // map a Buzz pubkey to a Vorim agent, or pass a single agentId
  resolveAgentId: (pubkey) => lookupAgent(pubkey),
  roster: new Set(memberPubkeys),      // from fetchRoster()
  kindAllowlist: new Set([9, 1618, 1631]),
});

// Feed it events from your relay subscription:
await bridge.process(nostrEvent);   // verifies, checks roster, dedups, emits
console.log(bridge.stats);          // { bridged, dropped, seen }

translateEvent(evt, config) is the pure, synchronous core if you want to plug verification into your own pipeline — it returns either a ready Vorim audit event or a drop reason.

Bridged kinds

Messages (9, 40002/40003), reactions (7), NIP-34 git (1617 patch, 1618 PR, 1619 PR update, 1621 issue, 1630–1633 status), and workflow events (46001–46012). Ephemeral kinds (20000–29999) and NIP-42 auth (22242) are never bridged — Buzz doesn't audit them either.

Security notes

• Verification is done independently every event (recompute id + Schnorr verify), not via a cached flag, so a reused/cloned event object can't smuggle a stale "verified" state past the gate.
• Dedup is by Buzz event id; a relay redelivery never double-writes.
• An emit failure un-marks the id so the event can be retried, rather than being silently lost.