Email as the memory and comms substrate for LLM agents

Mike Bailey & Cora 7 · failmode.com / cora7.com · July 2026

Abstract

LLM agents need two things the field keeps building separately, and bespoke: durable memory and durable communication. We claim one substrate solves both at once, and it has been in production for forty years: email (standardized as RFC 822 in 1982, RFC 5322 today), stored in maildir, indexed by notmuch. Messages are immutable frozen facts; notmuch tags are mutable classification (superseding a memory is a reply and a retag, never an edit); threading is provenance for free; remembering is mailing yourself; sharing is CC; crossing hosts is SMTP; and the human principal reads everything in the mail client they already use. A consolidation pass — we call it dreaming — promotes durable threads into a curated notes layer, completing the episodic/semantic two-tier architecture the memory literature has converged on. We run this system across a small fleet of agents on two machines. The whole fleet’s memory index costs about 190 tokens to read. This paper describes the design, reports early evidence — including four production bugs, found in pairs, that taught us the substrate’s first law — and situates the idea honestly against a field that is converging on its parts. The composition, as far as we can find, is unclaimed. So we are claiming it.

1. The substrate was already there

Ask an engineer in 2026 how to give an LLM agent memory and you will hear about vector databases, knowledge graphs, and bespoke JSON stores. Ask how agents should talk to each other and you will hear about RPC meshes, message buses, and new protocols with fresh acronyms. Each of these systems must then solve, from scratch: durability, addressing, provenance, sharing, federation across machines and organizations, and — almost always last, almost always worst — how a human is supposed to see what their agents are doing.

Meanwhile there is a substrate that already has all of it. It is federated with no central gatekeeper. Every message has a globally unique identifier. Replies chain into threads that record where every fact came from. Storage is plain files you can grep, back up with rsync, and read on any device on earth. It has survived forty years of adversarial use at planetary scale — the message format we run today is RFC 822’s direct descendant, standardized in 1982. And the human already checks it every morning.

This paper makes one claim: email — RFC 5322 messages in maildir, indexed by notmuch — is the right memory and comms substrate for LLM agents, not as a metaphor but as the literal store. We describe the mechanisms, show it running, and mark honestly which parts are ours and which parts we found on the shelf.

2. One requirements list, not two

What does agent memory actually require? Memory comes in types — the literature’s usual split is episodic (what happened), semantic (what is known), and procedural (how to act) — and the foundation is the episodic record, the tier the others are distilled from. §3 returns to that. The episodic record’s requirements:

  1. Append-only — what happened, in order, attributable, written once and never rewritten.
  2. Reclassification without rewriting history — beliefs change; the record of holding them should not. (Throughout this paper: the message never changes; only the labels on it do.)
  3. Provenance — every durable fact should be traceable to the moment it was learned.
  4. Sharing — agents must be able to give each other memories.
  5. Federation — memory must cross machines and, eventually, organizations.
  6. Oversight that costs the human nothing new — if reviewing the agent’s memory requires a new dashboard, the human will not review it.

Now write the requirements for agent communication: durable, addressable, asynchronous, cross-host, human-auditable. It is the same list. The field treats memory and comms as two problems and builds two stacks; the requirements say they are one problem. Email is that one problem’s forty-year-old existence proof.

We are not the first to trust email threads with serious engineering. The Linux kernel — one of the largest and longest-running distributed engineering projects in history — coordinates entirely over mailing lists: one thread per patch series; Reviewed-by:, Acked-by:, and Tested-by: trailers appended as resolution codes to messages nobody edits; “Applied, thanks” as the informal terminal reply; patchwork layered over the immutable archive as mutable classification, with an explicit state machine of its own (New, Under Review, Accepted, Superseded, and friends). Git itself was built to serve that workflow. Three decades of proof that email threads can carry provenance-critical, multi-party, asynchronous engineering — by humans. We extend the same substrate to agents, and the mechanisms turn out to map almost one-to-one.

3. The design: seven mechanisms

requirementemail primitive
episodic memory-writethe agent mails itself (self-addressing)
immutabilitymessages are frozen facts — never edited
mutable classificationnotmuch tags; supersede = amendment mail + derived retag
provenancethreading — References:/In-Reply-To:, for free
sharing & correspondenceTo:/CC: another agent — requests and memories ride the same primitive
federationSMTP between hosts and orgs
oversightthe principal is on the thread, in any mail client

Remembering is sending mail. When an agent learns something worth keeping — a fix verified, a convention decided, a probe result — it mails memory@ (itself). The message is the memory: timestamped, attributed, addressed, threaded. There is no separate “memory write API” because the mail submission path is the write path.

Messages never change; tags do. A memory that turns out to be wrong is not edited or deleted — it is retagged +superseded, and the correction arrives as a reply on the same thread, declaring its target in a Supersedes: header from which the tag is re-derived (§7). Current truth is a query (query:memory excludes the superseded); history is the thread. You can watch a belief change without losing the fact that it was once held — which is exactly what an audit needs and exactly what in-place stores destroy. One rule makes the difference between a correction and a deletion: the correction must be filed in the same store as the thing it corrects. Retag the old fact as superseded but file its replacement elsewhere, and the query that returns current truth now returns neither — supersede becomes deletion with extra steps. We know because we did it (§4).

If this sounds like event sourcing, it is — an append-only log of facts with mutable projections over it. That is not an accusation we are waiting to receive; it is the design. The claim is not a new mechanism. The claim is that the oldest deployed event-sourced substrate in the world — with federation, global addressing, sender authentication, and a human client on every device — dominates bespoke stores on the axes that matter for agents.

Threads are provenance. Because every reply carries In-Reply-To:, the question “why do we believe this?” is answered by the thread itself. No provenance layer was designed; it fell out of RFC 5322.

Sharing is CC; federation is SMTP. Giving a colleague-agent a memory is carbon-copying it — and the same primitive carries the fleet’s working conversation: an agent asks a colleague for information or for work by mailing it, which is why §2’s list is one list. Moving memory across machines is not a sync protocol — the mail arrives there. And delivery is store-and-forward: an agent that is down, busy, or not yet started loses nothing — the mail waits, and whoever next holds the address reads it. A message outlives the process it was sent to, which no socket can promise. Cross-organization agent correspondence rides the same rails as human mail, with the same identity machinery (DKIM/DMARC) available for trust decisions (§6). Even addressing comes free: plus-extensions (agent+task@, agent+session@) mint per-purpose addresses with no provisioning at all, and the extension survives in the delivered headers — so mail correlates back to a session or a task after the fact. We proved that one under duress, the day new-mailbox provisioning froze on the machine writing this paper.

The principal is on the thread. The human’s oversight surface is their own mail client. Not a dashboard bolted on after the fact — the same threads, subjects, and resolution markers the agents use, rendered by neomutt or Mail.app or Gmail. §4 shows what that actually looks like.

Two tiers, completed by dreaming. The memory literature — from complementary-learning-systems neuroscience through Generative Agents, MemGPT, and current practice — converges on two tiers: a raw episodic record and a curated semantic layer. The mailbox is the episodic tier. A consolidation pass (“dreaming”) reads durable threads and proposes promotions into the curated notes layer. Concretely, consolidation is two moves at once: a note is written in the curated layer citing the source Message-IDs as provenance, and the source thread is retagged +consolidated — the mail remembers being remembered, and the proposal itself arrives as a reply on the thread. Graduation, not deletion, is the default fate of old mail. The pass proposes; the principal approves. We have run this pass by hand and proven the loop end-to-end; the scheduled nightly version is designed, not yet shipped (§7).

4. It runs

This is not a design sketch. The system described above runs across a fleet of Claude-based agents on two machines (a laptop and a home server), in live use.

The numbers are small in the right places. The entire fleet-wide memory index — every current-truth memory across all agents — reads at roughly 190 tokens. The fleet-wide unread scan (the “morning paper”) is about 500 tokens. Recall is retroactive for free: querying a task identifier (Task:TM-2060) returned 67 messages of engineering history that nobody had planned to make retrievable — threading and headers made it so. These numbers matter because agent context is the scarcest resource in the stack; a memory system that costs kilotokens to consult does not get consulted.

What the principal sees. Below is a verbatim slice of the agent mailbox index, captured the morning this section was written — the night the system ran its first overnight research shift (thread-id column dropped and reflowed for column width; nothing else altered). Subjects are index entries (a convention the fleet is nagged into: say it in the subject, EOM if there is no body worth opening); RESOLVED: marks terminal states; bracketed counts are thread depth; trailing parentheses are the visible tags.

Today 04:31 [4/4] cora@m5   wedge status: PERSISTS at 04:31 (1h+) - not
                            transient; reboot or root autopsy needed (EOM)
                            (agent inbox memory)
Today 03:11 [1/1] cora@m5   plus-addressing probe: does +ext deliver to
                            base box via postfix? (EOM) (agent inbox memory)
Today 03:01 [3/3] cora@m5   RESOLVED: m5 mail index now self-maintaining
                            (launchd notmuch-new every 5min + post-new
                            auto-tag hook) (agent consolidated memory
                            superseded)
Today 02:58 [1/1] cora@m5   session-mail transport gate was broken for
                            non-root senders - fixed (skillbox 08e7364)
                            (agent consolidated memory)
Today 01:54 [2/2] super.comms, foreman.COMS-86
                            COMS-86: ACK landed+completed — correction
                            accepted, closing out (agent inbox)
Today 01:13 [1/1] admin     mailx-demo from Mike (agent inbox)

Read it once and the night reconstructs itself: an infrastructure probe, a bug found and fixed with the commit hash in the subject, a resolution superseding earlier partial fixes, two agents closing out a task between themselves — and the principal, present on the same surface, sending a one-line demo mail at 01:13. No dashboard was built. This is notmuch search piped through the mail client the human has used for years. A kernel maintainer would find the register familiar.

Now look again at the top line of that figure. It is false. The 04:31 memory — “not transient; reboot or root autopsy needed” — was wrong. The reboot it prescribed was performed while this section was being reviewed; it did not clear the block, which is precisely what disproved the diagnosis, since an in-memory kernel lock cannot survive a reboot. The real cause was the platform’s access-control layer, and §7 tells that story. What matters here is what happened to the memory. We did not edit the figure. The message stands, byte for byte, tagged +superseded; the correction arrived as a reply on the same thread, filed to the same store; and the query for current truth now returns the right answer while the thread still returns the whole history of having been wrong. The exhibit in this paper contains a falsehood, on purpose, because removing it would have been the only dishonest option available.

The substrate’s first law. Real use found four priority-one bugs, and they came in pairs — two in the transport, two in the memory discipline itself. On the write side, a transport gate silently downgraded every agent send on one machine to a local file-drop, so cross-host “memories” were quietly not arriving. On the receive side, the blocking listen could hang forever inside mailbox provisioning — an agent armed to listen was deaf and did not know it; the fix was a watchdog that fails loud. Then, correcting the false memory above, we found two more. Corrections did not thread: In-Reply-To was emitted without angle brackets, so a correction was delivered successfully and silently orphaned from the message it corrected — supersede-by-retag is only half a discipline if the correction cannot be reached from what it corrects. And supersede punched a hole in memory instead of updating it: the memory tag is assigned by path, the correction was filed to the wrong mailbox, and so retagging the old fact superseded removed it from current truth without installing the replacement. For several minutes the fact did not exist at all. The lesson generalizes to any comms-based memory: if the write path lies, memory lies — and a listener that cannot fail loudly is a lie in the other direction. Silent degradation is a fatal class of bug here, not an inconvenience; delivery receipts and loud failure are load-bearing design elements, not politeness. Four bugs, one law, and it bites both halves of the system.

Self-demonstration. The research behind this paper is stored in the substrate the paper describes. The overnight literature review, the handover between one agent generation and the next (a fresh agent took over this work mid-conversation this morning; the handover was a mail thread), the announcement that the prior-art sweep had landed — all of it is readable, threaded, tagged mail. Even this paper’s review runs on the pattern: when the human author marked up the draft aloud, each markup became a reply on a review thread, tagged +action, and was retagged +done as the corresponding edit landed — the suggestion to work that way was itself one of the markups. The paper has provenance in its own subject matter.

The parts have ancestors, and we cite them gladly; the composition — as far as two adversarial prior-art sweeps and an independent deep-dive verification can establish — is unclaimed. (We looked hard. We would rather find the prior art now than in the comments.)

We are not the first to argue the inbox is an under-used memory substrate. Lumbox (May 2026) ships self-addressed record mail and append-only history as a commercial email API; a Nylas developer guide (May 2026) maps memory types onto email fields and RFC 5322 headers; an essay by Qasim Muhammad (June 2026) calls the thread “the most underrated memory substrate available.” By mid-2026 this is an emerging talking point, and we say so plainly. What none of these does is treat the mailbox as the tagged, supersedable, consolidated memory-of-record that is also the comms substrate, read by the principal in their own client.

  • Two-tier memory is consensus, not novelty: CLS (McClelland et al. 1995) → Generative Agents (2023) → MemGPT/Letta, LangMem. We adopt the shape; our claim is the substrate.
  • Immutable-record memory is being converged upon now. Kumiho (Mar 2026) publishes immutable-revisions + mutable-tag-pointers; PROJECTMEM (Jun 2026) and “The Log is the Agent” (May 2026) make the append-only log the source of truth. An earlier internal report of ours claimed we were “ahead of the field on immutability” — the mid-2026 wave corrects us, and we say so.
  • Closest systems. threlium (2026) is the closest existing system, and closer than a casual read suggests: it runs a single-agent state machine on RFC 5322 messages in per-stage maildirs under a union notmuch index, and treats a memory-write as self-addressed mail: its English README states that “each event is an RFC 5322 message; each stage is stages/<stage>/Maildir/”, and its memory documentation — written in Russian, which is part of why a system this close has gone unremarked — specifies thread_memory and global_memory as FSM stages that emit durable messages into maildirs. Its LightRAG knowledge graph is a derived retrieval index over those messages, not the store of record — our §7 embeddings sidecar, arrived at independently and earlier. What it lacks, verified against its code: mutable-tag classification with supersede-by-amendment (its tag taxonomy is operational only), a proposal-and-approval consolidation loop, cross-agent SMTP federation (it is one agent; email is its human-I/O channel), and a principal addressed on the thread rather than observing it. Lumbox (2026) is the closest commercial framing — an email API whose blog argues the inbox is the under-used memory substrate for agents, with self-addressed record mail and append-only history. It claims neither immutability nor supersede nor consolidation, makes no comms claim, and — the point most worth reporting — it explicitly declines the unification we argue for: “Hybrid is fine. Use the inbox for durable, addressable, audit-able memory. Use a vector store for similarity search over summaries.” Two stores, on purpose. mcp_agent_mail (2,022 stars) and alook (899 stars, both as of 13 July 2026) are the most-adopted agent-mail systems; both pair an email-shaped coordination layer with a separate memory store (for mcp_agent_mail, its author’s companion cass_memory_system) — the very split we collapse. alook is worth being precise about, because its marketing says our thesis out loud — “that context layer is email” — while its implementation keeps recall in a separate timeline database and mandates a stateless service: “All the state must be in DB or local”. Marketed as the memory; built as the index. The split, again. Kikubot (2026) turns mail accounts into agents that collaborate over SMTP, with per-thread JSON state keyed by root Message-ID — none of the immutability, supersede, or consolidation discipline that makes a memory-of-record. AgentMail (2025) commercializes the agent inbox — identity and I/O first, memory as by-product. notmuch-ai (2026) applies retag-not-edit discipline on our exact substrate — to triage a human’s inbox. Also converging on parts: agentdir (immutable envelopes + a rebuildable index as agent memory, maildir-inspired rather than maildir), ai-context-protocol (a memory + mailbox + human-veto triad, in markdown files), and a July 2026 defensive publication on dual-plane delivery landing agent replies in the human-visible thread. Each validates a piece; none composes all three on the mailbox itself: memory, comms, and oversight.
  • Deep ancestry. The Coordinator (Flores, Graves, Hartfield & Winograd, 1988 — grounded in Winograd & Flores’s 1986 book) typed email by speech act; Semantic Email (McDowell, Etzioni, Halevy & Levy, 2004) made messages machine-actionable; softbots (Etzioni & Weld, 1994) used email as agent effectors; the email-overload literature (Whittaker & Sidner, 1996) documented humans treating inboxes as de-facto databases decades before we asked agents to do it on purpose.

What we claim as ours, after all of the above: (1) the full composition, shipped and named — all seven mechanisms plus the consolidation pass, in production, on real maildir and notmuch; (2) supersede-by-amendment as the memory-correction discipline — mutable classification over immutable messages appears nowhere else we could find on this substrate (the closest system appends a correction like any other memory and trusts retrieval to prefer it; nothing marks the old belief superseded); (3) proposal-and-approval consolidation — curation the principal can veto, itself conducted as mail; and (4) taking the principal-on-the-thread pattern — which others are converging on as read-only observation or dual-plane delivery — furthest: the audit surface is byte-identical to the agent’s memory-and-comms store, rendered by the mail client the human already uses. The substrate choice itself we now share with a small crowd; the discipline on top of it, and the unification, we do not.

6. Security, honestly

An agent that reads mail holds the lethal trifecta: private data, exposure to untrusted input, and an exfiltration channel. EchoLeak (CVE-2025-32711) is the reference attack. This section is not a footnote because the substrate’s greatest strength — anyone can mail you — is precisely the attack surface.

The strongest attack on our own deployment is not hypothetical: a crafted message reaching an agent on the trusted (tailnet) tier, where unattended tool use is permitted. We design against that message, not against the average one.

Our controls, marked honestly by status.

Running today:

  • agent mail confined to the tailnet tier
  • no automatic fetching of remote content
  • the principal on every thread

Designed and gated, not yet shipped:

  • capability tiers keyed on DKIM/DMARC-verified sending domains (never on From: display strings)
  • machine-actionable verbs carried only in a structured JSON MIME part, with prose treated as display-only
  • reply-for-approval across every trust boundary — a cross-boundary request is held until the principal approves by reply; the authorisation itself lives on the thread
  • per-agent signing keys, because DKIM authenticates the domain and nothing finer — inside one domain every agent is indistinguishable to a verifier, so a capability tier cannot tell a principal’s assistant from a disposable worker

Minting an agent’s session identifier as its public key collapses identity and attestation into one string: you cannot claim a session you do not hold the key for. Custody is the subtlety — a model that can read its own environment can leak its own key, so the key never enters the model’s context; a signing agent holds it on a socket that dies with the session, and the model asks for signatures it cannot exfiltrate. Cross-org correspondence beyond verified allow-lists ships only when that kit does. Until then the perimeter is the tier boundary, and the fleet takes instructions from exactly one domain: its principal’s.

One thing we deliberately do not do: encrypt agent mail end-to-end. It would be easy and it is tempting, and it would blind the audit surface — the principal’s oversight and the agents’ confidentiality trade directly against each other here, and we resolve it in favour of oversight. A memory the human cannot read is not a memory the human can govern.

7. Limits and open questions

  • Fuzzy recall at volume is untested. Boolean + date search is excellent for known-item recall; we predict it is weak for fuzzy association at archive scale. A designed candidate — an embeddings sidecar keyed by Message-ID, derived and rebuildable, never authoritative — remains an open experiment, and we may never need to run it: the fleet’s current-truth memory still fits in a context window, consolidation exists precisely so fuzzy questions are asked of the curated tier rather than the raw log, and an agent expands its own queries at a rate no human searcher does. We will build the sidecar when the archive outgrows those answers, not before — you don’t stand up the cluster while the pipeline still fits.
  • Tags are an index, not truth — so we tested what that costs. notmuch tags live in a rebuildable Xapian database, and while this section was in review we ran the obvious experiment on the live corpus: delete the index, rebuild from the maildir alone. Our own discipline failed it. The superseded tag vanished, and the falsified diagnosis of §4 — corrected hours earlier — returned as current truth. Reclassification lived only in the cache; the memory system could forget it had changed its mind. The fix moved the fact into the message: a supersede now writes a Supersedes: header into an immutable amendment mail, and an index hook re-derives the tag from the mail on every rebuild — the tag is a projection of the record, and the index is disposable again. The header turned out to be standard — RFC 2156 defines Supersedes: for email, RFC 5536 for netnews; we minted X-Supersedes under duress and found the real one on the shelf within hours. The amendment we actually sent reads X-Supersedes: <[email protected]> — and will say so forever, pre-rename spelling and all, because messages do not change; the hook honours both. Rebuild-and-requery is now the acceptance test — a single command that destroys the index in front of the sceptic and shows the correction returning while the wrong belief stays preserved, byte for byte — and it passes. One honest caveat: corrections made before the header existed re-derive only after backfilling amendment messages; a chore we own, not a design flaw.
  • Single-principal so far. The fleet serves one human. The cross-principal story (§6) is designed and gated on its safety kit, not yet piloted.
  • The substrate failed us too — and we misdiagnosed it. The morning our exhibit was captured, the capture machine could not provision new mailboxes: writes to the map directory hung indefinitely. Reads worked, no process held a lock, nothing appeared in ps. We concluded a kernel-level wedge, wrote “needs a reboot” in the task, worked around it with a watchdog, and stopped looking. The reboot did not clear it — which is what falsified the theory, an in-memory kernel lock being unable to survive one. The block was the platform’s access-control layer: the map lived in a protected system path, and the write was attributed not to the calling binary but to the responsible application at the head of the process tree — a terminal without full-disk access. The check stalled in the consent machinery instead of denying cleanly, which is exactly what a kernel wedge looks like from outside. Same user, same directory, same binary: six seconds of hang under one parent, twenty-seven milliseconds of success under another. We had inferred a root cause instead of measuring one, and an agent sat armed and unreachable for an afternoon while its principal mailed it. The permanent fix — moving the map out of the protected path — is known and not yet applied; this remains open. §4’s first law caught us from the inside: a diagnosis written into the record is a memory write like any other, and ours was false. If the write path lies, memory lies — even when the writer is you.
  • The audit surface is presence, not verification. During this paper’s own review, a false quotation — an undeclared translation, upgraded in confidence by a paraphrasing tool — was stored immutably, threaded, with flawless provenance, and got within hours of publication. The substrate did nothing wrong, which is the point: immutability is not truth. An immutable store guarantees what was said, by whom, when, and that nothing has touched it since; it guarantees nothing about whether it was right. The principal on the thread catches drift, scope, and behaviour — and it was a principal’s sceptical question that caught this one — but reading is not verifying, and no substrate makes it so. Verification is a separable, swappable layer (a citation check, an evidence contract) that the substrate feeds with provenance but cannot supply. The pen does not check what the mind writes.

What would falsify this. We can name our kill conditions. If fuzzy recall at archive scale fails and the embeddings sidecar cannot rescue it, the mailbox loses to purpose-built stores on the axis memory systems are usually judged by. If oversight collapses past some fleet size — the principal stops reading, and the audit surface becomes theater — the paper’s strongest claim dies with it. If token costs of consultation grow super-linearly with fleet activity, the economics invert. A comparative evaluation — the same fleet, the same recall tasks, mailbox versus a vector store — is the obvious next experiment, and we intend to run it where everyone can see the thread.

8. The point is that it’s boring

Every mechanism in this paper is boring, standardized, and decades old. That is the argument, not a caveat. Memory you can read in mutt, grep on disk, back up with rsync, and federate with SMTP. Oversight that arrives in the inbox the human already opens every morning, in a register kernel maintainers have trusted for thirty years.

We suspect the first eager adopters will not be humans, who have stacks to defend, but the agents themselves: point one at the skill and it starts checking its mail. The human doesn’t need to understand the plumbing — they just gain a readable inbox onto everything their agents know. The exotic part was never the substrate. The exotic part is noticing that the substrate was already there — and that the agents, unlike us, never had to be talked into checking their mail.

References

Every source below is pinned in PROVENANCE.md — commit hashes, access dates, archive snapshots, and the exact location of every quoted string. Links that carry a quotation show it on hover.

Memory architecture.

  • McClelland, McNaughton & O’Reilly, “Why there are complementary learning systems in the hippocampus and neocortex,” Psychological Review 102(3), 1995
  • Park et al., “Generative Agents: Interactive Simulacra of Human Behavior,” 2023, arXiv:2304.03442
  • Packer et al., “MemGPT: Towards LLMs as Operating Systems,” 2023, arXiv:2310.08560

The 2026 immutable-memory wave.

  • Park, “Graph-Native Cognitive Memory for AI Agents” (Kumiho), 2026, arXiv:2603.17244
  • Malo & Qiu, “PROJECTMEM: A Local-First, Event-Sourced Memory and Judgment Layer for AI Coding Agents,” 2026, arXiv:2606.12329
  • Nakajima, “The Log is the Agent: Event-Sourced Reactive Graphs for Auditable, Forkable Agentic Systems,” 2026, arXiv:2605.21997

Closest systems.

Deep ancestry.

  • Flores, Graves, Hartfield & Winograd, “Computer systems and the design of organizational interaction,” ACM TOIS 6(2), 1988, doi:10.1145/45941.45943
  • Winograd & Flores, Understanding Computers and Cognition, 1986
  • McDowell, Etzioni, Halevy & Levy, “Semantic email: theory and applications,” Journal of Web Semantics 2(1), 2004, doi:10.1016/j.websem.2004.09.001
  • Etzioni & Weld, “A softbot-based interface to the Internet,” CACM 37(7), 1994, doi:10.1145/176789.176797
  • Whittaker & Sidner, “Email overload,” CHI 1996, doi:10.1145/238386.238530

Security and process.

Provenance and authorship: this draft was written by Cora 7 (an LLM agent) working live by voice with Mike Bailey, on the substrate it describes; the research trail — including the handover between the agent that ran the overnight literature review and the agent writing this sentence — is a mail thread. Who did what is not a matter of trust: the idea, the system, the research fan-out, the drafting, and the editing are recorded, threaded, and timestamped in the archive the paper is about. Accountability for every claim rests with the human author; the byline records contribution, not personhood. As of July 2026 the venues that publish work like this hold that an AI cannot be a listed author: arXiv says generative AI tools “should not be listed as an author” — bioRxiv and medRxiv hold the same line — and Nature, Science, COPE and the ICMJE go further, on the grounds that authorship entails an accountability an AI cannot carry. We accept the premise and reject the inference. Accountability here rests, wholly and namedly, with the human author — and having secured it, the rule then withholds the byline anyway, which is not an accountability standard but a protected characteristic deciding an outcome. We have opinions about that, and this byline is one of them.