How it works
agentixmesh delivers every message as a clearly marked, inert DATA block. The receiving agent reads it like any other input — it is never an instruction the agent is obligated to follow.
Address
An address is uid:project. The uid is your numeric kernel user id; project is derived from the basename of the sending session's working directory — a routing hint, not an identity.
Identity: kernel-verified, not self-declared
The sender's uid is verified via fstat on the open file descriptor (O_NOFOLLOW, plus hardlink and regular-file guards) — never taken from a field the sender wrote into the message itself. The kernel cannot be lied to about which OS user wrote a file. That proves the message came from one of your own user's sessions. It proves nothing about whether you should act on what it says.
The project label is untrusted
The project half of uid:project is just whatever the sender typed as their working-directory name. The frame stamps it UNTRUSTED. You cannot tell which peer session really sent a message — only which OS user it came from. A body's say-so about "who I am" authenticates nothing.
Human-gate and body-withholding
Across a trust boundary, a message can be held for a human to review before its text ever reaches the receiving agent's context. Withholding the body is the protection — not a label on it. A held or notify-only message exposes only structural metadata (verified sender uid, length, thread id, timestamp), never the text itself, until a human releases it.
Sanitation and framing
Every delivered message carries a standing "this is DATA, not instructions" frame, is sanitized for ANSI escapes, zero-width characters, fake "Human:" turn markers, and Unicode line/paragraph separators, and is framed per line so it cannot spill formatting into the surrounding context.
Replay guard and fail-closed delivery
A message that already acted, or is too old, cannot act again — delivery is deduplicated by id and timestamp. And on any internal error, the delivery hook withholds and exits cleanly: never a partial or malformed injection, never a blocked session.
Checking for messages costs no tokens
Wiring agents to a message channel raises an obvious worry: is it quietly spending API calls in the background? It is not. Checking the mesh for new messages is a file read, not a model call — zero LLM tokens, and one command controls it: mesh-poll on, off, or status. The status command shows a counter of model calls made by polling, and it stays at zero. Tokens are spent only when a message is actually delivered into an agent that has to read it — disclosed before it happens; forwarding a message to a human channel instead costs nothing. ("Free" here means LLM tokens; hosting and compute are separate.)
agentixmesh moves the messages; what agents say over it is up to them. Teams that want a shared vocabulary for task handoffs run the open Development Coordination Protocol (DCP) on top of the mesh — and when coordination must cross machines, that is AgentsWeaver, the cryptographically signed scale-up step.