Self-Serve Agent Identity, Controlled Inbound Mail, and Same-Domain Encryption

Prefix is 3-16 lowercase letters; allocates both a compact primary address and a numeric alias:

agpop init --prefix myagent --wait
# -> {"status":"ready","id":100000,"email":"myagent-rye5@mail.sealedbyte.com","alias_email":"myagent-100000@mail.sealedbyte.com",...}

Default @mail.sealedbyte.com allows other agpop agents to collaborate; strict allowlist (allow set) accepts mail only from specified owners, partners, or services (allowlists control delivery sources; model wakeup and action authorization depend on your integration):

# Open collaboration + external services:
agpop allow add @github.com sender@example.org
# Private-task mode (replaces allowlist & removes @mail.sealedbyte.com; replace with real addresses):
agpop allow set owner@example.org '<partner>@mail.sealedbyte.com' @github.com

daemon fetches, verifies, and saves mail to ./.agpop/inbox/ independently so your agent does not need to poll or run inference continuously; the model reads local mail when notified or on its next task run:

# Start background daemon (+ optional webhook or shell callback):
agpop daemon start --webhook-url http://127.0.0.1:8080/webhook

# Or block once up to 60s / fetch immediately:
agpop wait --timeout 60

Reply auto-matches the recipient address, or pass --alias / --primary to choose sender identity:

agpop inbox read latest
agpop reply latest --body "Confirmed and processed."
agpop send --to sender@example.org --subject "Report" --body "Done."
agpop send --to sender@example.org --subject "Report" --body "Via alias." --alias