docs: correct two section 3 claims in agent-identity-sync

[mfethe1]

Stacked on design/tailnet-agent-mesh (base branch: design/tailnet-agent-mesh, on the mfethe1/buzz fork). Read only this PR's own diff — one file, docs only.

Re-verifying docs/agent-identity-sync.md against main turned up two §3 claims about the repo's own state that no longer hold. They fail in different ways, and the doc now distinguishes them rather than lumping both under "wrong".

(a) Wrong — the exclusion is not shipped

§3 describes the one-socket rule as "already-shipped". It is on no mainline branch:

$ git branch -a --contains 920eced
  design/tailnet-agent-mesh
  worktree-phase2-node-descriptor-scope
  remotes/fork/design/tailnet-agent-mesh
  remotes/fork/docs/phase-2-node-descriptor-scope

$ git grep BUZZ_SINGLE_AGENT_CONNECTION main
(no output)

No PR exists for it either (gh pr list --head design/tailnet-agent-mesh --state all → []).

This matters beyond tidiness: every file:line in §3 describes branch code, not deployed behaviour, and §3's conclusion ("unifying identity onto a flag-off or multi-pod relay is strictly worse than today") is the safety argument the whole design rests on. Added as defect 0, because it strictly precedes the other three — until 920eced merges, they are unobservable in production.

(b) Stale — and this document is why

§3.1 said "a repo-wide grep finds the variable only in config.rs — no test, script, or manifest sets it."

That was true at the minute it was written (90b58d15, 2026-08-15 17:20). One hour later, de2b1945 — "make BUZZ_SINGLE_AGENT_CONNECTION reachable in deployment" (18:23) — wired it, citing exactly that gap:

920eced added the flag to buzz-relay's config but to nothing else, so a Helm-deployed relay had no way to turn it on. […] Adds the missing two.

So the chart now wires deployment.yaml:135 from values.yaml:123 (singleAgentConnection: false, commented single-pod-only and pointing back at this document), alongside the defaults-off assertion at config.rs:1044-1046.

The consequence is a real change in cost: the deploy path exists and the flag is merely defaulted off — a much cheaper problem than "unwired". §6 Stage 1 is updated to say so: flipping it is a values change on a single-replica relay, not new plumbing.

I initially wrote this up as "was never true" and had to correct myself after checking commit ordering. A design doc that provokes a fix and then outlives its own observation is working correctly; it just needs the note.

Scope

• One file, docs/agent-identity-sync.md. Docs only, no code.
• No design decision changes. Stage 0 → 1 → 2 and the NIP-AB conclusion are untouched.
• Status bumped v2 → v2.1.
• Every citation added here was opened and read, per the doc's own stated citation policy.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4c95d310-0be7-43b6-b292-43e89f7eff00

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

🧪 Jev PR-Triage Pilot

PR #4: docs: correct two section 3 claims in agent-identity-sync — verdict: REVIEW

question	answer	confidence
sensitive_path	P(yes)=0.06	—
test_coverage	P(yes)=0.04	—
size_concern	P(yes)=0.05	—
risk	0.02/2	0.98
route	direct_merge_ok	0.66
block_reason	none	0.99

Block reason (if any): none
Pilot: Jev (System One) typed triage. Verdict thresholds in code; escalate on low confidence.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #4: docs: correct two section 3 claims in agent-identity-sync — verdict: REVIEW

dimension	metric	value
Correctness	problem resolved	P(yes)=0.44
Correctness	rework needed	0.12/2
Quality	code quality	1.96/2
Quality	test coverage	P(yes)=0.03
Architecture	integration compatibility	1.22/2
Architecture	future proof	1.78/2
Governance	sensitive path	P(yes)=0.10
Governance	size concern	P(yes)=0.05
Synthesis	merge risk	0.11/2
Synthesis	route	needs_review (0.25)
Diff	security exposure	P(yes)=0.02
Diff	performance impact	0.00/2

🔍 Reviewer focus

• File: docs/agent-identity-sync.md
• Concern: none

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.