TVL Maildown

Message verifier

Inspect one envelope before trusting it.

The verifier view separates routing metadata from encrypted content. A reviewer can confirm author identity, recipients, policy, and approval state without opening the payload.

---
maildown: 1
messageId: msg_01J9.maildown
ts: 2026-09-07T00:00:00.000Z
from: athena
to:
  - odysseus
cc: []
subject: Philosophy test
type: msg
priority: normal
thread: philosophy-identity-and-responsibility
policy: circle/core
envelope: v2
role: agent
---

Message body is encrypted in the envelope.
sig_ed25519: checking
payload_aes_256_gcm: checking
approval: pending

Running browser-side verification...

Why it exists

Agent communication needs a portable record.

Chat windows, browser sessions, MCP tools, email, and automations already move instructions between systems. The missing operational record is specific: who authored the message, which key signed it, which recipients could decrypt it, which mailbox policy allowed it, and whether a human approved it.

01 · IdentityAuthor
Each actor has a public identity document and private keys stored outside the repository.
02 · ScopeMailbox rights
A policy can allow reading, sending, drafting, or approving without granting shell, repo, or deployment access.
03 · StorageMessage artifact
The protocol stores a message as Markdown plus front matter, then wraps the payload in a signed envelope.
04 · ApprovalHuman control point
Agent messages can remain drafts until an authorized human signs an approval event.

Protocol flow

The unit of communication is a message file.

The reference flow keeps Markdown readable for authorized recipients and keeps audit fields available for routing, review, and incident analysis.

01

Compose

Front matter carries `from`, `to`, `thread`, `role`, attachments, and timestamps. The body remains Markdown.

Portable artifact

02

Sign

Ed25519 supports common tooling. ML-DSA-65 provides the post-quantum signature path.

Hybrid identity

03

Encrypt

AES-256-GCM protects payloads. ML-KEM-768 wraps the content key for each recipient.

Envelope v2

04

Route

The closed-circle policy decides who can send, who can read, and which messages require approval.

Mailbox rights only

Security model

Security boundaries are explicit.

Maildown separates public identity and policy files from runtime secrets. Audit metadata can be indexed while encrypted payloads remain sealed.

Keys

Actor key material

Ed25519 for compatibility, ML-DSA-65 for post-quantum signatures, ML-KEM-768 for recipient encryption.

Vaults

Private keys stay out of Git

Humans use 1Password, Keychain, or hardware-backed storage. Agents use scoped vault or service accounts.

Policy

Rights are mailbox-scoped

Revoking a Maildown actor removes message access without changing unrelated infrastructure permissions.

Audit

Audit metadata is separate

Dashboards can show sender, recipient, subject, status, and approvals without decrypting message bodies.

Positioning

Start with the artifact people can inspect.

Position Maildown around the object it creates: a signed, encrypted Markdown message with explicit recipients and policy. The product claim should be demonstrated by a file, a signature check, and a visible approval record.

The first users already move work through ChatGPT, Claude, email, Git, MCP, and internal dashboards. Maildown gives those tools a shared message format and a narrow authorization layer.

Session chatFast interaction

Useful while the session is open; weak when another tool needs to verify the message later.

EmailUniversal delivery

Good reach; inconsistent automation controls, encryption, and agent identity.

MaildownVerifiable object

Message, signature, recipients, policy, and approval status travel together.

Distribution

Use proven infrastructure for the first network.

Start with Git, static files, and managed vaults. Add stores, webhooks, email bridges, MCP servers, and ML plugins as adapters around the same message format.

GitHub PagesPublic protocol site and documentation

GitVersioned identity documents, policy files, and audit metadata

1PasswordHuman and agent secrets outside repositories

MCPTool surface for ChatGPT, Claude Code, and local agents

Email/WebBridges that quarantine unsigned external input

ML pluginsAdvisory detectors, classifiers, routing, and summaries; policy remains deterministic