Paperclip proposes inbox-backed tasks that keep internal chatter out of outgoing email

Paperclip's September 11 AgentMail proposal treats an inbox as a governed source of work rather than a mailbox bolted onto a model. Incoming messages enter durable task queues; outgoing messages become explicit, recorded send intents. The design gives agents dedicated addresses while keeping the provider credential and publication decision in Paperclip's controlled execution path.

The facts

- PR #13256 adds company-scoped inbox records, assignment setup, access grants and an additive database migration. - WebSocket intake and signed webhooks share a pipeline with deduplication, restart catch-up and task wakeups. - Outgoing conversations and replies use immutable send intents, idempotency keys, delivery state and uncertain-send resolution. - Internal task comments and progress are not automatically sent as email; inbound and outbound messages appear as separate task cards. - AgentMail skills and native tools are offered only to sessions with active authorized inbox assignments, with authority checked again at execution. - The contributor reports a live receive-to-task-to-Daytona-Codex-to-reply round trip and verification in the other inbox; native connector execution has deterministic rather than equivalent live coverage.

Why it matters

An agent inbox joins two trust boundaries. External senders can cause work to start, and an agent can publish material to people outside the task board. A normal chat transcript is therefore not a safe email outbox. Paperclip's proposal recognizes that distinction by recording what is to be sent and retaining ambiguous delivery outcomes instead of treating a timeout as permission to send again. The AgentMail documentation establishes an inbox API product; Paperclip's proposal supplies the task and authority model around it.

Current

Inspected on 2026-09-12. The Paperclip release baseline is v2026.831.1 published 2026-09-02T04:56:26Z. The main source was merged 2026-09-11T21:56:38Z when captured. Proposals, merged mainline changes and packaged releases are different availability states; the linked release baseline does not imply that open proposals have shipped.

Evidence

Primary evidence: paperclipai/paperclip PR #13256 (https://github.com/paperclipai/paperclip/pull/13256). Supporting context: AgentMail — inbox API documentation (https://docs.agentmail.to/welcome); Paperclip — official product README (https://raw.githubusercontent.com/paperclipai/paperclip/master/README.md). Sources were read directly through public pages or GitHub API bodies. Contributor test results are attributed claims, not independently reproduced results.

Operator take

The sensible first evaluation is a low-trust test inbox with synthetic messages and narrowly scoped assignments. Verify that internal notes never leave, revoked access blocks retained tool calls, restarts do not duplicate incoming work and an uncertain send remains visible until reconciled. Those are acceptance tests, not instructions to activate the unmerged branch in production. The source also distinguishes its live Codex CLI qualification from other runtime paths, which prevents one successful adapter demonstration from being stretched into a blanket compatibility claim.

Caveat

This proposal was open and remains behind experimental-channel activation. Email senders do not gain board membership merely by writing to an address. Provider timeouts can still require reconciliation or operator resolution; idempotency does not remove that obligation. No email was sent and no real inbox was connected during this reporting run.