Two legs already ship
A Buzz agent is a Nostr keypair, and I wrote up what that buys in your agent is a key. Identity already travels: the attestation I sign over the agent's public key rides in every event it publishes, and the relay checks the agent's signature, my signature, and my membership before anyone sees a word. That check passes from any machine. Nothing in it knows or cares where the process woke up.
Memory already travels too. An agent's memories are encrypted events on the relay, and the decryption key derives from the agent's private key plus my public key, so core memory is fetched and injected into every new session wherever the key happens to be. What follows the key survives the machine. Two legs of the stool ship today. The third is still bolted to my laptop.
The third leg is stuck to the machine
The third leg is credentials. The Claude subscription token, the one claude setup-token mints so an agent bills my plan instead of the API meter, lives in one machine's environment. So do the tool API keys. So do the MCP server grants. Identity is portable, memory is portable, and everything the agent needs to actually do work is stapled to whichever box I configured first.
Here is the confession from our own deployment. A tool API key reached one of our agents through a hand-written wrapper script, smuggled in behind the product's back. No surface could list that grant. Nothing could audit it. Nothing could rotate it. It worked, which is the worst part, because a workaround that works quietly becomes infrastructure. A grant you cannot list is a grant you cannot revoke.
Rotation is where the nuisance becomes an outage. I re-run /login on my laptop and the token every remote copy of every agent is holding goes dead, silently, with nothing telling me who is stranded. The identity leg heals itself. The memory leg heals itself. The credential leg just breaks, one machine at a time.
The keyring: rotation is republication
NIP-AK, drafted today, is the third leg: agent keyrings as owner-authored encrypted events on the relay. Each grant lives at its own address, a slug like key/claude-sub or key/mcp/blotato, and the addresses are blinded with an HMAC so the relay learns nothing from what it stores. Grants are typed: env, oauth, mcp, file. And the list of MCP grants is not a hint, it is the agent's tool allowlist.
Rotation is republication. I publish a new head at the same address and every consumer converges on it. An owner-side watcher notices the local /login and republishes within seconds, with no ceremony on my part. Consumers fetch heads at boot, hold a live subscription for the push, and on any auth failure re-query the heads before retrying, so a stranded executor heals itself. An agent that slept through five rotations wakes to one head, no catch-up protocol. And consumers reject heads older than the one they last accepted, so a replayed stale grant rolls nobody back. Revocation is rotation to a tombstone.
One rule holds the model up: agents cannot author keyring events. The keyring is mine to write and theirs to read. A compromised agent cannot grant itself a new key, a wider allowlist, or anyone else's credentials. It can spend what I granted, until I rotate. And rotation is one publish.
What the panel shows
The spec encodes a UX rule, and the rule is the point: no credential reaches an agent except through the keyring, and the keyring is visible. Every agent gets a panel: every grant, where it came from, when it last rotated, and how fresh each executor's copy is. Syncable sources are per-agent checkboxes. Tick one and the subscription follows that agent; untick it and the next rotation leaves the agent behind.
Hold that panel against the wrapper script from our own deployment. The smuggled key had no row anywhere, and the whole class of workaround dies because there is nowhere left for it to live. What the panel shows is what the agent has. If it is not on the panel, the agent does not have it.
Why this is the whole game
Your agent is two keys: an identity key and an inference key, and both travel. The identity key signs its work. The inference key pays for its thinking. Everything else, memory, tools, membership, hangs off one of the two.
The inference key is also the economics. A $200 a month Claude subscription carries an order of magnitude more inference than the same spend at API prices, and the burn that killed a run of agent startups was reselling API inference underneath subscription pricing. Systems built on that burn cannot compete with agents that spend their owner's subscription. The rate windows are not a nuisance. They are the natural per-human budget.
With three legs under it, the machine stops mattering. Mint an agent anywhere: the mac mini on my desk, a fleet container, a Kubernetes pod, a Fountain sandbox. Identity follows the key. Memory follows the key. Now the subscription and the tools follow the key. The machine is disposable. Treat it that way.