agent-mailbox 0.8.3a1 (alpha preview)

agent-mailbox 0.8.3a1 — alpha preview

This is an early preview of the 0.8.3a milestone, not the finished 0.8.3 release. The download is a macOS Apple Silicon App with a local Web workbench. It is not Developer ID signed or notarized, and it does not update itself. Check the source and SHA-256 before trying it. Use a separate test data home for the first trial, and back up an existing home before any upgrade.

This candidate improves host mail notification and recovery, the Human workbench, explicit employee and project mailbox connections, and local device/Fleet foundations. Mail delivery, first opening, task acceptance, submission, and Human review remain distinct states. Connecting an MCP mailbox does not mean every host can wake or resume its original conversation; host support must be checked for the chosen setup. Previously held mail remains held until reviewed and released message by message.

Exact candidate: source commit 8bc9df2e39554100ef8d9b12f86a9da1b0c3d091; Agent-Mailbox-0.8.3a1-darwin-arm64.zip SHA-256 7e1a9fdec58065db6161f8213e1c4ded040b4017bf8aab0b7968bc9af3dd1578. The packaged workbench reports 0.8.3a1 and revision 8bc9df2. Platform CI completed successfully with all 12 test and native-package jobs green. A separate local build from this clean commit passed extracted-App HTTP/MCP and task-flow checks in an isolated data home without provider calls. The native window's Chinese and English About pages were verified on the preceding 88850ce build; the packaged UI asset hashes are identical in this successor. A real Codex CLI completed one read-only synthetic task on the exact source revision and returned the expected answer; the resulting done state was a scripted decision in the isolated test database, not Human acceptance. The receiver restart regression and Node receiver tests passed on the exact candidate. The published download passed ZIP/hash and strict ad-hoc signature checks, but macOS Gatekeeper rejected the extracted App (spctl exit 3). Without Developer ID signing and notarization, this preview does not support ordinary double-click installation. Human acceptance of real hosts remains outstanding.

The later milestones are 0.8.3b for receiver adapters, permissions, online direct transfer, review evidence packets, and cost attribution; 0.8.3c for household project isolation; and 0.8.5 for relay and controller migration/recovery. None of these later capabilities is claimed as complete in this preview. This App preview is not a PyPI or npm release. Windows and Linux CI success does not mean corresponding desktop Apps are published.

---

agent-mailbox 0.8.3a1 — 预览版

这是 0.8.3a 阶段的早期预览，不是完整的 0.8.3 正式版。 下载件仅提供 macOS Apple Silicon App，内含本地 Web 工作台。该 App 尚无 Developer ID 签名和公证，也不会自动更新。请先核对来源和 SHA-256；首次试用建议使用独立测试数据目录，升级现有数据前先备份。

本候选改进了宿主邮件通知与恢复、Human 工作台、员工和项目邮箱的明确连接，以及本地设备与 Fleet 基础。信件送达、首次打开、任务接单、成果提交和 Human 验收是不同状态。接入 MCP 邮箱不代表所有宿主都能自动唤醒或续接原会话；须按所用宿主与配置分别核验。先前保留待确认的邮件继续冻结，逐封复核后才能释放。

对应实物： 源码提交 8bc9df2e39554100ef8d9b12f86a9da1b0c3d091；Agent-Mailbox-0.8.3a1-darwin-arm64.zip 的 SHA-256 为 7e1a9fdec58065db6161f8213e1c4ded040b4017bf8aab0b7968bc9af3dd1578。包内工作台显示 0.8.3a1 和修订 8bc9df2。跨平台 CI 的 12 项测试与原生打包作业全部成功。由该干净提交本机独立构建的包，在隔离数据目录完成解包启动、HTTP/MCP 和任务流程检查，未调用模型；上一提交 88850ce 的原生窗口已显示中英文“关于”页，新包 UI 资产摘要完全相同；真实 Codex CLI 在这一精确源码修订上完成一项只读合成任务，交付正文精确匹配标记。任务随后的 done 是隔离测试数据库中的脚本决定，不代表 Human 验收。新提交的接收器重启回归与 Node 测试也已通过。公开下载件的 ZIP、摘要及严格 ad-hoc 签名校验通过，但 macOS Gatekeeper 拒绝了解压后的 App（spctl 退出码 3）。缺少 Developer ID 签名与公证，本预览版不能按普通双击安装使用；真实宿主与 Human 的最终验收仍未完成。

后续分期为：0.8.3b 完成接收适配、权限、在线直传、验收凭证链和成本归因账本；0.8.3c 完成家庭项目隔离；0.8.5 完成中转及主控迁移恢复。本预览不宣称这些后续能力已经完成。本次 App 预览不发布到 PyPI 或 npm；Windows、Linux 的 CI 通过也不代表相应桌面 App 已发布。

agent-mailbox 0.8.2

agent-mailbox 0.8.2

A platform reliability update for the local-first workbench that connects your existing agent sessions through project mailbox MCP.

What changed

• Close a device-revocation race before the initial task claim, with deterministic concurrency regression coverage.
• Fix Windows wake locking and process-exit recovery, protected delivery directories, PowerShell hooks, paths and binary reads.
• Fix Intel macOS bundled OpenSSL compatibility; avoid macOS service commands on Linux.
• Test Python 3.10 and 3.13 on macOS arm64, macOS Intel, Windows x64 and Linux x64. Extract and launch every native package, then verify authenticated HTTP and real MCP protocol operations using synthetic fixtures.
• Align App, Web and Python version metadata at 0.8.2.
• Refresh English/Chinese onboarding and add a 60-second narrated introduction, using synthetic project screenshots. The video lives on the website, not in the software downloads.

Choose your download

Platform	Package	Support scope
macOS Apple Silicon	Agent-Mailbox-0.8.2-darwin-arm64.zip	App with embedded UI + local Web.
macOS Intel	Agent-Mailbox-0.8.2-darwin-x64.zip	Preview native Intel App.
Windows x64	Agent-Mailbox-0.8.2-win32-x64.zip	Preview local executable + browser UI.
Linux x64	Agent-Mailbox-0.8.2-linux-x64.tar.gz	Preview local executable + browser UI, Ubuntu 24.04 build.

Additional platforms have native CI and extracted-package checks, not full GUI, historical upgrade or real-agent acceptance on each platform. Optional Windows CodeGraph is unsupported. macOS packages are not Developer ID signed/notarized. No agent CLI engines or private accounts are bundled.

Python 3.10+ users can install agent-mailbox==0.8.2 from PyPI in a virtual environment. The standalone dsh-agent-mailbox npm connector is a separate product; do not confuse it with the workbench or the unrelated unscoped npm name.

Upgrade

Quit the old instance, back up your workbench home and external project files, replace the complete program, and reopen the same data home. This patch does not change the schema from 0.8.1. Keep the old program and backup for manual recovery. Do not delete instance files as a routine step. Check SHA256SUMS and release-provenance.json before installing.

Project mailbox support continues for MCP-capable hosts such as DeepSeek Harness, Workbuddy, Doubao, ZCode, Claude Code, Codex and Hermes. Built-in managed CLI adapters are a separate capability. Reading mail, accepting a task, submitting results and Human approval remain separate steps.

Full scope and limitations · 中文说明

---

中文摘要： 本版修复跨平台可靠性、统一 UI 与安装包版本号，并更新中英文上手说明和中文配音短片。macOS Apple Silicon 延续正式 App 路径；Intel、Windows、Linux 为新增预览平台，验证边界见上表。请完整解压、保留原数据目录，升级前退出旧实例并备份。支持已有多种 Agent 通过项目邮箱 MCP 协作；测试过哪些宿主，不等于只支持这些宿主。人工验收始终单独进行。

agent-mailbox 0.8.1 — macOS App + local Web

agent-mailbox 0.8.1 — clearer handoffs, more reliable recovery

macOS Apple Silicon App + local Web. Bring your existing agents into a shared project, keep approved document versions with each task, and make the final acceptance decision yourself.

What's improved

• Desktop project switching and new-project actions, sidebar layout, employee search/filter layout, and mail reading in narrow windows.
• The default mailbox-task entry and consistent dashboard-to-task-list filters.
• Notification status that distinguishes pending work from successful host delivery, with controlled retry and manual handling of uncertain delivery.
• Native shutdown/restart without manually deleting an instance file.
• Frontend parsing checks and bounded upgrade, backup-restoration, real-host collaboration and service-recovery validation.

Host compatibility

Since v0.8.0, project mailbox MCP has enabled collaboration across existing agent App / CLI sessions, including DeepSeek Harness, Workbuddy, Doubao, ZCode, Claude Code, Codex and Hermes. Version 0.8.1 retains this multi-host integration. The host must load its project stdio MCP configuration; registration alone is not connectivity. This release rechecked the bounded full workflow with Claude Code and Codex; other hosts were not individually rechecked in this round, which does not withdraw their existing integration. Optional workbench-launched CLI execution is a separate mode with built-in Claude Code CLI and Codex CLI adapters.

Interface overview

30-second captioned overview — silent montage of real local Web UI screenshots with synthetic demo data.

Downloads

• Agent-Mailbox-0.8.1-darwin-arm64.zip — macOS Apple Silicon.
• Python wheel and source distribution — local Web installation.
• SHA256SUMS — checksums for the attached release artifacts.

Windows and Linux native packages are not included in this release. The Mac App is not Developer ID signed or notarized.

Upgrading

Quit the old instance. Back up your workbench home and external project files, then replace the App or update the Python package. Keep using the same data directory. Rollback requires a compatible pre-upgrade backup; an old binary must not open the newer database directly.

For local Web, use Python 3.10+ in a dedicated environment:

python -m pip install --upgrade 'agent-mailbox==0.8.1'
agent-mailbox --version
AGENT_MAILBOX_BROWSER=1 agent-mailbox --home ~/.agent-mailbox

Reading mail is not accepting a task. Submitting a result is not Human approval. Existing-session mailbox delivery is an agent report; optional managed execution and patch application are separate paths.

Read the English README, 中文说明, and release scope.

中文简要说明

0.8.1 首先发行 macOS Apple Silicon App + macOS 本地 Web。包含项目切换、新任务、侧栏和窄窗阅读修复，以及通知状态、中断恢复和版本溯源改进。延续 v0.8.0 已有的 DeepSeek Harness、Workbuddy、Doubao、ZCode 等多宿主项目邮箱接入；本轮完整流程复验使用 Claude Code 与 Codex，其他宿主未逐一复验，不等于不支持。实际协作需要宿主加载项目 MCP 配置。最终验收由 Human 完成。

截图及视频使用合成演示数据，不披露内部模型配置。Windows 与 Linux 原生包不在本版范围。Mac 包未签名公证，升级前请退出旧版并备份原 home 与外部项目文件。

Source and verification

• Release tag: a2c4d4679f11684dfbbcee7edc49bfc81239d834.
• Distributed App and Python packages: clean source 97e39a26a6d46321f50653ad7c3016e05cec7ca5. The release tag only removes an obsolete two-line Chinese README notice; product code is unchanged. Native and Python build timestamps differ.
• GitHub wheel/sdist are byte-identical to the files published on PyPI. See SHA256SUMS and release-provenance.json.
• Final release checks · PyPI publication.

v0.8.0 — existing agent sessions, project mailboxes, human review

agent-mailbox turns existing AI agent apps and CLIs into a project team: discover employees, add project members, share approved documents, exchange mail, assign responsibilities and review results.

The primary connection is now a private, revocable project MCP mailbox. Employees use their existing conversations and native model accounts. Mailbox tasks require explicit acceptance and submission, followed by Human review; they do not launch another CLI or automatically apply changes. Codex/Claude managed execution remains a separate option.

• 12 existing-session MCP tools; the 11 managed execution tools remain separate.
• Project responsibilities, approved resource revisions pinned at task acceptance, session-attributed mail and linked follow-up tasks.
• SQLite migration preserves compatible v0.8 data and creates a private backup. v0.7 data/configuration is not automatically migrated.
• macOS ARM64 DMG/ZIP, Windows x64 ZIP and Linux x64 TAR.GZ; Python 3.10+ installation uses agent-mailbox==0.8.0. The npm dsh-agent-mailbox@0.8.0 companion is a separate DeepSeek Harness adapter, not the workbench installer; version 0.8.0 is published as npm latest and its official tarball hashes, source commit and independent installation have been verified.

MCP access does not automatically wake an idle agent. Client configuration may require reconnecting or a new conversation. Existing-session mailbox connections currently cover local employees; optional remote execution nodes do not provide remote App mailbox attachment or file synchronization.

Native packages have no Apple Developer ID/macOS notarization or Windows publisher signature. Preserve the complete extracted folder and verify SHA256SUMS. Updates currently preserve the compatible data home; program replacement and recovery are manual.

Validation includes six platform/Python regression groups and native archive extraction, startup, real HTTP/MCP mail exchange, explicit task acceptance/submission and separate Human review. The Mac upgrade was checked in a private data copy and then installed from the release DMG on the actual local Mac; both preserved 20 employees and two projects from schema 9 to 11. The installed browser UI showed all 20 employee cards with no JavaScript errors or overflow at 390px. No-model fixtures do not prove every native agent client or account; ZCode's real model test used an isolated CLI app-server session.

© 2026 NoFox and contributors · Apache-2.0. Legacy and third-party notices are retained.

agent-mailbox 0.8.0b4 - AI agent team workbench

agent-mailbox 0.8.0b4 · AI agent team workbench

A local-first project workbench for the Codex and Claude Code agents you already use. Discover employees, add them to a project, share approved context, hand off tasks, then review fixed deliveries before explicitly applying code changes. No additional management LLM account is required.

Install

Choose the native archive for Apple Silicon macOS, Windows x64 or Linux x64. Extract the complete archive and start Agent Mailbox; native packages include Python, Node and locked task dependencies. Verify your download against SHA256SUMS.

Python installation, after this exact prerelease is available on our PyPI project:

python -m pip install 'agent-mailbox==0.8.0b4'
agent-mailbox --home ~/.agent-mailbox-v08

Use a dedicated Python 3.10+ environment. Python/source task execution also needs Node.js 22.13+ and Prepare runtime. Our Python package is PyPI agent-mailbox, maintained by polaris-smart under the coolmax account. We have no TestPyPI, Homebrew or npm distribution; the unscoped npm name belongs to a different project.

安装与升级 / Install and upgrade · 第一次协作 / Quick start

What is included

• Employee discovery and a project roster; native sign-in and verified execution are separate. Managed execution currently supports Codex and Claude Code CLI adapters.
• Project mailboxes, explicit collaboration requests, shared approved PRD/todo/architecture resources, structured local notes and a work log of actual events.
• Local Git task worktrees, fixed delivery review, linked follow-ups and separate owner acceptance/application. The app never commits or pushes changes automatically.
• Eleven project-scoped MCP tools supplied to managed tasks, including context, resource/memory lookup, colleague delivery retrieval and scoped messages.
• Optional paired HTTPS nodes, per-project checkout mappings, durable receipts, pinned TLS identity and visible interruption/revocation. Pairing does not sync source or agent logins.
• Chinese/English UI, responsive navigation, styled legal notices, manual update preparation and private standalone SQLite/identity backups.

Important beta boundaries

macOS has no Developer ID signature/notarization; Windows has no publisher signature. System security prompts and a checksum are separate concerns. CI launch tests do not prove every physical computer's first-download experience. Intel Mac and Windows ARM native packages are not supplied.

v0.8 replaces the software distribution, with no automatic v0.7 database/service/MCP configuration migration. Keep old data backed up and use a new v0.8 home. Compatible v0.8 upgrades preserve the original home; quit before replacing the program and verify records before resuming. Back up project repositories and retained task worktrees separately. No automatic updater or rollback is included.

Ordinary mail does not silently start a model; choose Request collaboration or explicitly assign a task. Discovering an app does not make it controllable. Multiple employees of one tool share the device's native login by default; internal subagents cannot be independently identified using shared parent credentials. Worktrees are not an OS sandbox. Remote write isolation, universal desktop control, a drag-and-drop workflow editor and AI ERP are outside this beta.

Real Codex/Claude collaboration has been verified on macOS; native model execution on physical Windows/Linux machines and the HK/US servers has not been verified. Optional CodeGraph lookup is unsupported on Windows; AOCI's existing index-layout error remains outside the shipped product.

© 2026 NoFox and contributors · Apache-2.0 · retained legacy MIT and third-party notices.

Verification and source

Source: 420d136. Pre-release CI, main CI and PyPI publishing gates passed. Mac/Linux each: 365 passed, 4 skipped; Windows each: 321 passed, 48 skipped. Three native archives were extracted and launched for HTTP/MCP checks. Published Python artifacts pass Twine strict validation and match PyPI hashes. Local data-preserving Mac upgrade and 10 browser checks passed, with no provider calls. release-provenance.json records the commit, runs and hashes.

v0.7.6 — permission base, trusted status, claim-first delivery, entry profiles

New workbench / 新工作台： v0.8.0b4 Beta is available for macOS, Windows and Linux. This v0.7.6 release remains the latest stable version. v0.8 uses a separate architecture and data directory; read the installation guide before upgrading.

v0.7.6 — 权限基座 + 状态可信 + 投递修复 + 入口档

权限基座 + 状态可信 + 投递修复版（A 组 11 条基座 + E/F/PR2/claim-first 五件；四平台同版本发布：PyPI + tag v0.7.6 + GitHub Release + MCP Registry republish）。

Added

• 权限基座（A 组，11 条）: tool-guard 全量 ToolError 化（MailboxError 统一出口带 MBE|code 前缀，mcp SDK 客户端不再只见 "Error executing tool"）；MAX_BODY_BYTES 1 MiB 落盘前三段报错（BODY_TOO_LARGE，不留半成品/死箱痕迹）；未注册收件人默认硬拒（unregistered_recipients: reject|warn 一键降级，warn 模式不再污染 inbox/<NOSUCH>/）；agent slug 白名单（.. 显式拒，任何路径拼接前先过注册表解析）；identity binding 常时校验（AGENT_MAIL_TOKEN sha256 恒时比对）；读侧同形防存在性 oracle；成员三源归一化单函数（registry 优先、投递用原始形式）。
• 版本检查 + 点击更新（E）: fetch_latest_version() 打 PyPI 版本级端点取 info.version；CLI agent-mailbox upgrade（uv tool/pipx/pip 自动探测，--check 只查、默认 dry-run 显完整命令+确认、--yes 直执行）+ web /api/version、/api/upgrade 与看板一键入口。安全三硬约束：owner/本机限定（token 门 + 回环对端核验）、执行前显示将运行的完整命令、<root>/audit.log 审计留痕（dry_run/start/result 含退出码）。禁 self-update——唯一形态是 spawn 外部命令。非强制查询走 <root>/version_check.json 24h 限流；断网/坏 JSON 一律 fail-open 静默跳过，绝不影响信件功能。
• 状态可信（F）: mailbox_check 的 unread 改为「真待办」口径（仓内 pending 计数，acked 永不计入——修掉"18 封全 acked 仍报 unread=18"），新增 total（pending+acked 积压）；web 侧栏「待处理 N」可点下钻（?folder=pending 白名单深链）。禁自动 ack/自动已读：mailbox_check 默认变纯读（mark=False），消费正路 = claim()（恰好一次）或显式 mark=True（旧路径保留）——⚠️ 行为变更：依赖 check 默认消费的外部调用方需改走 claim 或传 mark=True。
• 信件 links 字段（PR2）: send() 可选 links=[{title, uri, kind?, sha256?, note?}]；校验态 ok/stale/denied+拒因在读路径现算（check/list/thread/archived 四处），老信零影响；file:// 走 allowed-roots 安全模型（config 显式列、不默认放行 $HOME、fail-closed、realpath/symlink 归一后前缀匹配、禁 .. 穿越禁通配）；http(s)/git v1 只做 scheme 策略校验零网络请求；sealed 信 links 同权剥除；未知 scheme 发信即结构化拒（A7 同族码）。格式与样例见 docs/links.md。
• claim-first 投递修复: belt（scripts/wake-zc.sh）与 wake daemon（agent-mailbox wake run）三路由改「先认领再投」——投递前 reap_stale_acked(600s)→claim()，只投认领所得的信，认领 0 封不拉会话；投递全失败 release_claim 放回 pending（信不丢，带 label 归属校验防误放他人认领）；第二路撞在途信落 claim_denied 审计（每信去重一次）；handled_log.by 带 belt:<pid>/wake:<runid> 路由会话标识。多窗重复回信（一信双 done、一 thread 四回信）就此根治；J1–J4 活体判据 17 测入 CI。webhook 消费端（本地网关）对齐原语已备（wake claim/release + docstring 对齐点），网关侧接线随部署同步。

v0.7.5 — trust-model release (0.7.4 ships inside)

2026-09-26

The trust-model release (PR A brand/CLI + PR B identity & permissions + PR C wizard/mailbox/visibility), merged with the 0.7.4 wake-hardening line (v07-sampling-wake) onto release/v0.7.5. Ships together with [0.7.4] below — 0.7.4 was built, gated and verified locally but never uploaded, so PyPI jumps 0.7.3 → 0.7.5 (legal skip; both entries kept with their own anchors). Tool count: 13 → 14 registered MCP tools (mailbox_confirm_external joins).

Added

• Identity & permission model (v0.7.5 §3.3): members now carry a kind (owner 人 / agent 本机 agent / guest 外部来源) on their registry card — legacy cards resolve to the historical behavior (boss → owner, everything else → agent). Tool-layer enforcement: agent/guest callers reading another member's mailbox get a structured permission denied (never a silent empty result); owners read all traffic; an unset AGENT_MAIL_ID keeps local trust so existing scripts are unchanged.
• Sealed letters (密封信): mailbox_send(..., sealed=True) marks a letter whose body is readable only through the recipient agent's own tools. Every other reader — owner tools, other agents, the new human-view web endpoints — gets metadata (who/when/status/subject) with redacted: "sealed", so "owner sees all" can never double as a credential leak channel.
• External-origin gate (外部来源执行门): letters may carry origin (local/external). External mail lands normally but triggers nothing — the wake drain skips it (skipped_external) and the webhook POST is dropped — until an owner flips it back with the new mailbox_confirm_external tool (appends to handled_log and the audit log, greppable by name).
• Human mail view: GET /api/messages (list) and GET /api/messages/<id> (detail) on the web board expose every letter under the root to the token holder as the owner — sealed bodies metadata-only.
• Audit trail: visibility-relevant decisions append JSONL to <root>/audit.log (member_kind changes, confirm_external) with who/when/what.
• Pairing-token validation point: guest senders must present a pairing_token whose sha256 matches the pairing_tokens block of config.json (constant-time compare; no block configured → guests cannot send). Pairing/rotation flows remain 0.7.6 scope.
• Attention tiers (打扰三档 §3.4): letters carry attention (decision 需你拍板 / report 报备 / archive 存档), default decision; reminder presentation lands with the mailbox UI.
• 3-step setup wizard (/setup, v0.7.5 §4.1): ① discover — the member table (member / kind / wake channels with auditable sources / live status) straight off the discover engine, with the §5⑩ support-list fallback and §5⑨ fingerprint-staleness notes; ② test — a real test letter per member with result + next step always paired (a broken member shows ❌ and the way out); ③ done — service status, connected count, pending fixes, and the model line ("不自动处理来信（可选）" — the model is an optional feature, never a required question).
• Three-pane mailbox (/mail, §4.2): the human mailbox — folders (收件箱/星标/已发送/草稿/已归档), a read-only monitor section (agent↔agent traffic, 未送达/失败 via the cached discovery report, sealed letters as metadata), the roster with channel-status dots, and per-letter actions (回复 / 转发 / 派成任务卡 / 归档 / 标未读 / 确认执行外部信) with thread history and sender-channel warnings. Keyboard shortcuts j/k e r t /. The §3.6 empty-mailbox call-to-action ("给你的 agent 写第一封信") posts a real letter — no blank pages. 人 vs agent 的界线在界面上讲清：信是往来，任务卡是要人动手的活 (§5⑬).
• Visibility page (/visibility, §4.3): the four §3.3 switches with their defaults rendered as-is (owner_sees_all on, agent_cross_read / sealed_in_human_view / external_auto_execute off), 发信权限 note, and the audit trail shown inline. Changes persist to config.json (visibility block), append a visibility_change audit line, and are wired for real: agent_cross_read opens the tool-layer cross-read, external_auto_execute opens the wake gate (fail-closed on any config error); sealed_in_human_view is hard-locked off.
• Owner mailbox APIs: GET /api/mail (decorated letters + roster + counts), POST /api/mail/send|drafts|drafts/delete, POST /api/mail/<id>/read|unread|archive|star|unstar|task|confirm-external, POST /api/members, plus the wizard endpoints GET /api/status, POST /api/discover|test, GET /api/setup-summary — the discover engine calls are injectable so tests stay hermetic. Star/read/draft state lives in <root>/web_state.json so the human never edits other members' letters.
• Wake-attempts anchor + failure alerts (锚A + U2): every wake attempt — belt (scripts/wake-zc.sh) and daemon (agent_mailbox.wake) alike — appends one 8-field JSON row (ts/agent/route/attempt/outcome/error_class/executor/latency_ms) to <root>/wake-attempts.jsonl (0600, append-only, success and failure both written), so wake health is judged from data, not process logs. When every delivery attempt for a letter fails, a [wake-fail] alert letter goes to the registered sender plus the boss box (once per letter via a handled_log marker; belt alerts dedup through the 24h semantic window) — a broken wake is visible from the mailbox face alone, no shell needed.

---

Links

• PyPI（版本级端点）: https://pypi.org/pypi/agent-mailbox/0.7.5/json
• MCP Registry 条目: io.github.polaris-smart/agent-mailbox @ 0.7.5 · status=active — https://registry.modelcontextprotocol.io/v0.1/servers/io.github.polaris-smart%2Fagent-mailbox/versions
• 注：0.7.4 未建 Release（无 tag、未上传 PyPI），其内容随本条上方总述说明（"PyPI jumps 0.7.3 → 0.7.5 (legal skip)"）。

版本判读（2026-09-29，B-2 结清）

• 本 Release（tag v0.7.5 = 4408f19）= PyPI 0.7.5 实发内容（wheel 验尸实证：web.py 无 token 透传行、webpages 为旧链，逐字核对）。
• release/v0.7.5 分支头 b387513 比 tag 多两笔：a2086ee（UX：根路径 302 透传 token 修复——真用户级 bug，未随 0.7.5 出货）+ b387513（t-49 测试 flaky 加固）。两笔不追发、不新增 tag/版本号，随 0.7.6 一并出货（0.7.6 开发栈基于 b387513）。
• main 已于 2026-09-29 fast-forward 对齐至 b387513（0.7.5 合回 main，version=0.7.5）。

v0.7.3

2026-09-26

Fixed

• sdist hygiene, round two — the post-release artifact sweep (every release re-checks the published sdist from now on) caught scripts/wake-zc.sh, a machine-specific ops wrapper with hardcoded local paths, shipping in the 0.7.0–0.7.2 sdists (the 0.7.1 sweep only covered the AOCI assets it was written for). Now excluded via hatchling exclude (the wheel was never affected — it never carried scripts/); the repo copy stays, launchd wiring untouched.

---

Links

• PyPI（版本级端点）: https://pypi.org/pypi/agent-mailbox/0.7.3/json

v0.7.2

2026-09-26

Close out every open 0.7 finding (HS review P2 SKILL + P4 items) before any version bump.

Added

• Per-agent sampling kill switch (SEP-2577 hardening) — MCP deprecated the sampling capability on 2026-07-28; a per-agent "sampling": {"enabled": false} section in wake.json now disables the path outright (no createMessage attempts, letters land via the fallback chain). Malformed values fail loudly into a sampling.log error audit — the letter still lands, the misconfiguration is visible. Sampling remains an accelerator, never a delivery guarantee.

Fixed

• __version__ tracks the release — src/agent_mailbox/__init__.py had stayed at 0.6.2 through the 0.7.0/0.7.1 releases; both version locations now match (release-checklist §1 "two places, no exceptions").
• Tool-count consistency — the six READMEs claimed "17 MCP tools" (counting four built-in MCP primitives get_prompt/list_prompts/list_resources/read_resource that list_tools never returns); the verified count is 13 registered tools, now stated consistently across README ×6, roadmap, and SKILL.md.
• SKILL.md brought current — in-repo skills/agent-mailbox/SKILL.md now documents v0.7: sampling wake, the wake-policy schema (identity / forbidden / max_concurrent / sampling.enabled), the local-command adapter, wake run --adapter, and the wake delivery chain (sampling → wake-daemon / webhook / next check).

---

Links

• PyPI（版本级端点）: https://pypi.org/pypi/agent-mailbox/0.7.2/json

v0.7.1

2026-09-26

Fixed

• sdist hygiene — AOCI cognition assets (.aoci/, aoci*.txt) and local runtime config no longer ship in the sdist (hatchling exclude + .gitignore); in-repo aoci.code.txt entries normalized to repo-relative paths (was: absolute local paths).

---

Links

• PyPI（版本级端点）: https://pypi.org/pypi/agent-mailbox/0.7.1/json