agent-mail — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-mail (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- TOC: Boundary | Disciplines | When to Use What | Bootstrap | Reservations | Beads | Troubleshooting | References -->
Core Insight: Agent Mail is the side channel for leases, notifications, acknowledgements, and handoffs. BR/beads is the durable coordination bus and source of truth for work state, evidence, and decisions.
⚠️ TWO SURFACES — read this first. Every operation has BOTH an MCP-tool form (send_message,fetch_inbox, …) AND a CLI form (am mail send,am mail inbox, …). The MCP tools are only present when the agent-mail MCP server is wired into your session's tool surface — a plain CLI/shell agent (or a session where the MCP server didn't load) will NOT have them. In that case use theamCLI, which works from any shell. Discoverability trap (br cp-jgcl): the send/reply verbs live under theam mailgroup, whicham --helpdoes NOT list, and the read commands have flat aliases (am inbox,am status) but `am send` does not exist — it is `am mail send`. When in doubt:am mail --help,am macros --help,am file_reservations --help.
Don't re-learn the command surface from this skill. The MCP server self-describes its tools and resources in your tool list; the CLI self-describes via am --help and the group helps above. This skill carries only the operating doctrine: when to use mail, the reservation discipline, and the coordination boundaries. Full tool/parameter catalog: TOOLS.md.
| Need | Source of truth |
|---|---|
| Work queue, status, dependencies, priority, closure evidence | BR/beads (br/bv) |
| File ownership, active edit leases, lane notifications, acks | Agent Mail |
| Final proof that work is done | Bead notes/closure plus git/CI evidence |
| "Who may write this hot path right now?" | Agent Mail file reservation |
Use Agent Mail to prevent collisions and notify active agents. Do not use it as the durable task queue, audit log, or final evidence store. If a mail thread and BR disagree, reconcile the bead first and link the mail thread from the bead note if the conversation matters.
One-writer-per-hot-dir rule: reserve the path before editing it. If the reservation conflicts, do not write into that path; coordinate with the holder, narrow scope, or wait for the lease to clear.
Register a durable adjective+noun identity at session start. Pane text and human relay are unauditable and load the operator. The ledger is the bus — both lanes must be registered to exchange auditable messages. Do not coordinate via informal pane text when send_message + fetch_inbox is available.
When sending a lane a message, push the content — include the actual text, diff, or decision. A pointer to a message-id the recipient cannot discover by inbox is still a relay. If the recipient's inbox is broken and they cannot read by-id, a pointer is a dead end. Short content fits in the body; long content goes to a committed artifact with an absolute path, not an AM-internal id.
Before any actor acts on a bead (intake, admit, implement, validate, mutate), update the bead status and set the actor on the graph first, then check for an existing actor. Parallel pipelines are blind to each other at every tier — dedup via the ledger, not behavioral coordination. Five exhibits of same-bead parallel work hit the fleet in one day (impl/validation/admission/mutation/intake, cp-hhtu). The fix is structural: intent on the graph is the lock.
When routing a write through a single writer (e.g. a beads-intake lane), require ACK-with-id back to the requester — the AM message id of the filed bead or the br show <id> output confirming the record exists. An unacknowledged routed write is invisible work. "Are these filed?" must not be a question — the ACK closes it.
| Situation | Action |
|---|---|
| Starting any agent session | macro_start_session (CLI: am macros start-session) |
| About to edit files | reserve paths → edit → release reservations |
| Need to tell another agent something | send_message with thread_id (CLI: am mail send) |
| Picking up someone else's work | macro_prepare_thread |
| Need durable work state or evidence | Update BR/beads, then link the mail thread if useful |
| Can't message an agent | request_contact → wait for approval |
| Server seems broken | health_check() first; CLI-only: doctor check --verbose → doctor repair --yes |
Call `macro_start_session` (or `am macros start-session --project <abs> --program <p> --model <m> --task "<desc>"`) at the start of every agent session. One call: ensures project exists → registers your identity → fetches inbox. Returns {project, agent, file_reservations, inbox}.
Identity notes:
name/--name to auto-generate a valid one.am macros start-session auto-generates a fresh identity per project; you will have a different name in each project. Confirm yours via am agent start.macro_prepare_thread, macro_file_reservation_cycle, macro_contact_handshake) and the fast resource:// reads are self-described by the server; catalog in TOOLS.md and RESOURCES.md.The discipline, not the syntax (syntax: am file_reservations --help or the file_reservation_paths tool):
src/auth/**/*.ts). Set a real ttl_seconds and put the bead id in reason.exclusive=false. Never write into a conflicted path.release_file_reservations / am file_reservations release <abs> <me>). Don't squat on leases across unrelated work.Use bead IDs as your threading anchor. BR remains authoritative; mail carries the lease, notification, and discussion side channel.
1. Pick work: br ready --json → choose bd-123
2. Reserve files: file_reservation_paths(..., reason="bd-123")
3. Announce: send_message(..., thread_id="bd-123", subject="[bd-123] Starting...")
4. Work: Reply in thread with progress
5. Record evidence: br update bd-123 --notes "Validation: tests, commit, CI, or handoff proof"
6. Complete: br close bd-123, release_file_reservations(...), final messageBead ID (often bd-###) goes in: thread_id, subject prefix, reservation reason, commit message
Do not infer durable state from mail silence. A missing reply is not proof that a bead is abandoned, blocked, or complete. Check br show <id> --json, bv --robot-insights, git state, and CI evidence before changing work state.
| Error | Fix |
|---|---|
| "sender_name not registered" | Call macro_start_session first |
| "FILE_RESERVATION_CONFLICT" | Wait, coordinate, or use exclusive=false |
| "CONTACT_BLOCKED" | Use request_contact, wait for approval |
| Server unreachable | health_check() / curl http://127.0.0.1:8765/health; start with am |
| Guard blocks commit | Set AGENT_NAME env var; emergency bypass: AGENT_MAIL_BYPASS=1 git commit |
Deeper diagnostics (doctor check/repair), the pre-commit guard (install_precommit_guard), the human-overseer web UI, and FTS5 search syntax are all self-described by the server/CLI — see RECOVERY.md and ADVANCED.md.
| Topic | Reference |
|---|---|
| All MCP tools | TOOLS.md |
| Workflow patterns | WORKFLOWS.md |
| MCP resources | RESOURCES.md |
| Cross-project setup | CROSS-PROJECT.md |
| Doctor & recovery | RECOVERY.md |
| Installation | INSTALL.md |
| Fix MCP config | FIX-MCP-CONFIG.md |
| Product bus, build slots, internals | ADVANCED.md |
curl http://127.0.0.1:8765/health # → {"status": "healthy"}
am # start server if needed~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.