Worth adding a nuance the piece skips: the identity claim is solid, checked Buzz's own README and channels, threads, git events and the audit log are all listed as working today, with agents scoped by their own keypair and channel memberships rather than a permission flag bolted onto a shared bot account. That is a sharper distinction than the group-project framing gives it credit for, an audit log that says which specific key produced an event is a different guarantee than one that just labels a bot's actions in a UI. The "release that writes itself" example is closer to today's reality than a lot of similar demos, since reaction-triggered YAML workflows are also listed as working now, so a thumbs-up genuinely can gate a ship step. What the same status table still lists as being wired up, separately, is workflow approval gates, so it is worth checking whether that gate step enforces a specific person's sign-off or just that a reaction landed, before assuming the release story is already safe to point at production.