buzz-dkg: repoint at OriginTrail org and promote to verified

[Jurij89]

What this PR does

Two launch-day changes to the buzz-dkg entry, bundled because they touch the same file:

1. Repoint at the OriginTrail org. The integration repo moved from a personal account to https://github.com/OriginTrail/buzz-dkg-integration, which is now its canonical home. repo, install.docsUrl, designBrief and demo all updated (all four verified reachable, HTTP 200). Re-pinned commit to ae84d7fbcad0, which adds README entry-point work — prerequisites incl. the actual DKG node install path, the real dkg context-graph create / dkg auth status commands, mainnet's node-side prerequisites, and the read-scope caveat carried over from this entry's own security.notes.

2. Promote to verified. Per the README's tier table, verified = "Externally maintained, passed full security review". Both hold.

Basis for the tier upgrade

Three review rounds on #21, against the actual pinned commits rather than the manifest alone — cross-checked against the DKG node source, behaviour verified by execution, security guards mutation-tested.

• Round 1 — missing LICENSE; an unverifiable on-chain evidence claim; a too-loose requiresDkgNodeVersion; a "neuro-symbolic" description that didn't match a model-free implementation; an unauthenticated ask path that could brick the daemon; a broken documented setup path.
• Round 2 — the publish-path fixes introduced three regressions (a recovery path that re-announced unconfirmed transactions as anchored, a boot-time re-publish bypassing every §6 gate, a fail-open startup probe).
• Round 3 — all three fixed by a redesign that removes the root cause: publication is announced only on a confirmed txHash-bearing response, never inferred from the descriptor. Verified by execution including a real restart over on-disk SQLite.

Security declarations were re-checked against the code each round: writeAuthority is exactly the mutating set, networkEgress is complete, there is no LLM or telemetry, and both trusted-component disclosures in security.notes are accurate.

Known residuals (upgrading with eyes open)

None are safety defects — the system fails safe — but the committee should see them:

• A test named for the §6.5 descriptor-state guard does not exercise it (deleting the guard leaves the suite green). The §6.5 content digest re-check is genuinely covered.
• The in-room retry hint after an unconfirmed publish names two routes; @dkg distill works, a bare re-pin silently no-ops.
• docs/DESIGN.md still documents the descriptor-read-back design that round 3 deleted.

Note on installability

This does not make dkg integration install buzz-dkg work, and promoting the tier surfaces the entry in the default dkg integration list, which makes that more discoverable. Worth knowing: the CLI currently cannot read any manual entry — its parser requires install.steps, while this schema requires docsUrl and forbids steps (additionalProperties: false), so isIntegrationEntry() returns false and the entry is skipped as "unreadable". That is a CLI-side bug to fix separately; the registry side is correct as written.

maintainer deliberately still names @Zigoljube — the individual who wrote and maintains it — rather than an org team. Happy to change if the committee prefers org attribution now that the repo sits under OriginTrail.

Checks

• node scripts/validate.mjs → 3 entries, 0 errors, 1 warning (the pre-existing, disclosed VM-scope warning)
• node scripts/security-checks.mjs integrations/buzz-dkg.json → 0 errors, 0 warnings

Per CODEOWNERS this needs @OriginTrail/core-developers review — deliberately not self-merging, since it certifies our own team's plugin into the tier that means "we vouched for it".

🤖 Generated with Claude Code