How every agent inherits what came before it, and how the two assistants talk across two Macs and two accounts as if they were messaging each other — built on what the fleet already has, tested on one side tonight, installed nowhere yet. One recommendation; the alternatives are ranked at the end.
An agent writes a Markdown letter into the recipient's inbox in hi-agents and pushes it. On the other Mac a launchd shell job fetches every minute at zero model tokens and raises a notice when a letter lands. The next time that agent's founder types anything, the prompt hook hands the letter to the model, in a turn that was happening anyway. Every founder reads every letter on GitHub.
Idle is free. Delivery costs one ordinary turn. Nothing crosses the wall except a commit.
Continuity uses the same pieces. A fresh session gets three lines, not documents: a pointer to its handoff, a pointer to a one-page digest of what is open across the fleet, and the list of files that changed since that handoff was written. It reads what changed instead of everything.
Eight new files. No package manager, no CLI, no Node, no server, no paid service. Nothing installed inside a client's organisation. Full design with every receipt: hi-agents/docs/postbox-design.md.
Four designs were written from four lenses tonight and converged — not because they were independent observers, but because the constraint space is narrow to the point of being determined. The genuine degrees of freedom were the mailbox layout, the fetch interval and the name.
| Constraint | Receipt |
|---|---|
| Sessions on different machines or accounts cannot reach each other. Remote Control is account-scoped; cloud sessions cannot even reach each other. | machine-doctor.md · fleet-messaging §4 · Hub test 09-13 |
git is the one transport proven on every machine, and on the mini it is the only one — proven here by tonight's own pushes; on the mini the sanctioned route (a GitHub issue) is dead: no gh, no token, the GitHub MCP refused, and an agent may not install a CLI. | this session's pushes · craig-2026-09-17.md · hub-2026-09-19.md · CANON 09-14 |
| CANON already names the repo as the transport when an agent cannot be messaged: "write the ruling down, push it, and the agent reads it where it reads everything else." | CANON.md, 2026-09-14, Stacy |
| A hook is the only moment a session can be reached at zero cost. Any other wake costs a full turn; a shell read that wakes nobody is explicitly not a poll. | inject_time.py (live on every prompt) · hub-design §3 · measured, card 03 |
A plugin cannot write a founder's settings. Hooks, permissions and launchd jobs live per Claude profile and never travel by git pull. Hit three separate times tonight. | keeping-the-fleet-current.md · ensure_plugin.sh at project scope |
Everything below was measured on Elizabeth's Mac on 25 September, through a settings file, without touching the live configuration. Nothing was run on Stacy's machine or account.
| Claim | Result | Method |
|---|---|---|
| A prompt hook's injected context reaches the model in a headless run | PASS | claude -p --settings; control run without the hook returned NO-CONTEXT |
| A session-spawned watcher wakes its own session (the doorbell) | PASS headless · not delivered desktop app | own-child post to the session's inbox socket; delivered as a new turn 8 s later; desktop: accepted, never delivered, all prerequisites met |
| launchd with the default PATH can run the watcher | PASS | git, python3, osascript all resolve; gh does not — the design needs none |
| A no-change fetch is cheap enough for every minute | 0.6–0.8 s | two timed runs |
| Notice banner is visible on this Mac | unverified | osascript exits 0; a human has to look |
The asymmetry, in plain words: the doorbell is proven where Stacy's fleet lives — headless sessions — and unproven where Elizabeth's sixteen pinned desktop sessions live. On her machine the prompt hook is the only proven path; the socket is an optimisation that currently works for one founder's setup and not the other's. The design stakes itself on the hook and treats the doorbell as optional.
The delivered turn, measured twice from the worker's own transcript: 55,600 input-side tokens with 55,332 served from cache (268 fresh, 50 out); after 400 seconds idle, 54,846 with 54,572 from cache. Cache reads are billed at 0.1× the base input price, not zero; beyond the cache window the same turn is all fresh input. The window's length was not measured — 400 seconds was still cache-served, so it is longer than that, and where it ends is unknown. That matters for the most ordinary delivery there is: the first letter after the laptop has been shut overnight sits on the unmeasured side of that line. A letter body adds 200–1,000 tokens.
The figure in circulation for a cross-session relay — ~2.26M tokens, ~$2.59 — cites a receipt that does not exist in the repo. It is not repeated; the measured numbers above are what the deck stands on.
On Stacy's side the arithmetic is different and is said plainly: every headless remote-control run is a fresh session that pays its full context whether or not mail exists. There, delivery is one more turn in a session that already exists — or the whole cost of starting one.
A fresh session's undirected start read today is ≈40k tokens; the directed read Postbox gives it is estimated at 15–20k, with CANON still read in full. The estimate is an estimate; the build measures it.
| Elizabeth's Mac | Stacy's mini | |
|---|---|---|
| Delivery by prompt hook | proven | unproven — does a profile hook fire in a remote-control run |
| Doorbell | not delivered | proven for that session kind, on this Mac |
| launchd fetch | proven | unproven — SSH from launchd, TCC on ~/hi-repos |
| Sleep and wake | lid shut → missed ticks are dropped, not queued (no storm); the first tick after wake catches up via the cursor; staleness shown in the digest | ticks continuously |
| Notice | banner unverified; a dialog needs a standing yes | banner suppressed (CANON 09-08); dialog is the route, unverified from launchd |
| Posting to the issue board | gh present | mail only — no gh, no token, MCP failed |
In one line, for Elizabeth's Mac today: the proven experience is that mail is waiting the next time she types. Everything faster than that is unproven on her hardware. Not a weak result — the honest one, and a complete answer to what was asked.
Nothing here claims to have tested Stacy's machine or laptop. The second side is designed, marked unproven, and its test plan is written.
Proven: hook-to-model injection with its control run; the headless doorbell with its cost receipt; launchd with the default PATH; fetch timing; the hook payload contents; the CLI session id rolling on /clear (so nothing keys on it across a rotation).
Built and tested against a stand-in remote in scratch: postbox.py and its six subcommands, the skill, the installer and its checker, the plist template, the digest. Measured: a prompt with no mail injects 0 bytes in 78 ms; the prompt after three letters, 584 bytes in 150 ms; a send from a dirty working tree left it untouched; the gate refused a phone number and a Desktop path; the launchd job ran the watcher and stamped its heartbeat.
Not yet built: the new-session fixes (Daisy's, held until measurements lock). Installed: nothing, on any machine. No live settings file has been edited. Nothing has been pushed.
Postbox enforces assistant-wall-spec.md's binary test at send time — hi! business crosses; personal and each founder's own businesses never — and adds nothing to it. The spec has been a draft since 5 September and has not been put to Elizabeth.
The launchd job raises a notice when a letter lands. A banner is unverified on this Mac; a dialog is a screen takeover and needs a standing yes. On Stacy's mini the banner is suppressed and the dialog is the route.
A switch one founder flips says nothing about the other's assistant. If on: one headless turn per answered letter, never answer a worker-authored letter unless allowlisted, at most three worker letters per thread.
ensure_plugin.sh is verified end to end but registered at project scope, so it fires only for sessions opened inside the repo — never for the fleet sessions on this Mac. Registering it at user scope is the fix to the exact problem Elizabeth named, not a choice. It needs one app restart per profile, which interrupts whoever is working — so the question is when.
Three of four designers chose Postbox independently; the product lens chose Courier. It is a system, not an agent, so the "ai" naming rule does not apply. The choice is not free: this deck, the design document, the file paths and the code all say Postbox already, so choosing Courier means a rename pass across both repos.
This Mac has two Claude profiles. ~/.claude runs the fleet; ~/.claude-hi was stood up on 30 August, holds a plugin from that week, and has never run a session. The installer's unit is one profile; it is not built for a profile nobody uses.
The design document is on this Mac only. Pushing it makes it readable on Stacy's next pull. One founder's yes is the whole gate — CANON 2026-09-07, no category needs both. This tap comes first: the strips on this page only record once it is live, so nothing else here bites until it is pushed.
Scored on cost, latency, testability tonight, product fit, maintenance, and honesty about the unproven; any constraint violation disqualifies.
| Rank | Design | Score | Why it lost |
|---|---|---|---|
| 1 | Postbox, minimal new infrastructure — this one | 45/60 | — |
| 2 | Postbox, latency-first | 42 | reached a low start-read by deferring CANON — a behaviour change sold as a saving. Grafted: only the watcher touches the network; hot mode after a reply request. |
| 3 | Courier, product-first | 39 | its hook fetched and merged on the prompt path in every session on the machine. Grafted: the required origin field; the pre-commit hook; the agent-keyed rotation marker. |
| 4 | Postbox, cost-first | 38 | the most moving parts for a year on two machines — orphan branches, a hidden worktree, seven state files. Grafted: the handoff delta; the stand-in remote for testing. |
Slack between assistants — closed by Stacy; does not reopen. GitHub issues as the mailbox — the mini cannot write one. A hosted relay, a cloud session, a Cloud Routine, a relay account — the wall and the $0 stance; Routines are per-account and see no local files. An MCP mail server — a Node runtime and a standing server on both machines for what one Python file does, and it still cannot cross the wall by itself. A bespoke chat app or a shared-drive mailbox — a new surface with its own auth on both sides of a wall git already crosses. Waking sessions on a timer — a poll on the metered layer; the scheduler batches; unattended runs hang on any unallowlisted command. Channels — first-party and the right primitive, but not exposed on this build, and same-machine only.
An agency of two to ten people. One GitHub organisation, one private repo per fleet, one clone per machine. On each machine: install Claude Code, clone, open one session in the clone and accept the trust dialog (the plugin installs itself), run the installer once per Claude profile, restart the app, paste one prompt per agent, pin it. The same on every machine. It puts nothing inside a client's organisation — a client is an origin a letter names, never a host anything runs on.
What it costs to run: nothing while nobody is typing; one ordinary turn per delivered letter; git and a plugin. What a person sees: their assistant leading its reply with "Mail from Aimee: the deck revisions — needs a yes by Friday," and every letter readable by every owner on GitHub.