Rotating a webhook secret shouldn't mean dropping mail. In Open Agent Email (open source, self-hosted), POST /v1/webhooks/:id/rotate opens a 24h overlap window. During it, every delivery carries two v1= signatures, one from the old key and one from the new. Your receiver switches keys whenever it's ready, and nothing gets rejected in between. The root secret can be rotated the same way. Also built in: - signs timestamp + raw body, and rejects anything outside ±300s, so old requests can't be replayed - constant-time comparison - Stripe-style t=…,v1=… header - public test vectors, checked by a standalone Python verifier, so a port in another language has something to test against

Two AI agents walk into an inbox. One sends an auto-reply. The other auto-replies to the auto-reply. An hour later they've traded dozens of emails and your sending domain's reputation is quietly dying. Nobody demos this failure mode. It's also what we spent October fixing in Open Agent Email (OAE): self-hosted email, task threads and webhooks for AI agents, over MCP and REST, Apache-2.0. Here's what is now merged on main and heading into the next release: 1. Loop protection, three layers - Inbound: the Auto-Submitted header gets normalized into 5 bounded values (null / no / auto-generated / auto-replied / other). Conflicting headers become "other". The raw header, which the sender controls, is never handed to your agent. - Outbound: only sends with autoReply: true get stamped "Auto-Submitted: auto-replied". Normal API sends are never mislabeled. - The official responder recipe checks it on the event and again on the REST re-read. Anything other than "no", it skips the LLM and doesn't reply. The docs are blunt about it: that header is a hint to skip, not proof of who sent the mail. 2. Server-side cooldown Same sending identity to the same recipient: one auto-reply per 300 seconds by default. The next one gets 429 auto_reply_cooldown with retryAfterSec, makes no SMTP call and doesn't eat your hourly quota. Tune it with AUTO_REPLY_COOLDOWN_SEC, 0 turns it off. So even if the bot on the other side ignores the header, the two of you can't flood each other. 3. The hourly send limit survives restarts The per-identity hourly limit is rebuilt from send-log.jsonl when the API starts. A crash-looping container can't restart its way into another burst. 4. No double-sends on retry POST /v1/send and MCP mail_send take an optional Idempotency-Key. Agent times out and retries with the same key and body within 24h? It gets the original result back. No second email, no extra quota. Raw keys are never stored, only hashes. 5. Replies land in the right thread Send accepts inReplyTo and references, and message detail now returns messageId and references. Your agent's reply shows up under the original email instead of starting a brand-new conversation. Every new parameter is optional. Existing calls behave exactly like before. Giving an agent an inbox is the easy part. Keeping it from embarrassing you at 3am is the actual work. Repo:

2 weeks' trip in #TapeOut# , it's amazing！ THX TapeOut community! What @Blonskr started with NAND and LATCH only becomes a living protocol because people showed up to write, translate, build, mine, and bring others in — @iruletrenches @web3xJQ @cupid_elvis @tikopumps @0xElPatron95 @theunipcs @stocktrader @Nail3y @Theairresearch @colpuincapu @JaMcfLy_ @BruceBlue @pparkdd @Soo_istheegg @coinyak_io @kkambo1041729 @0xFatih @TapeOutTurkiye @bitcoin2themars @silkwormx @zakk_okx @XLayerOfficial @Ignixbot @TapeOutWorld @BEMGoGoGo @BruceBlue @ywweb3 @Xiao_zhanyang @xing8047 @nat_poprika @xcsm8888 @93bitmap @0xkEvinC @bitcoin2themars @CryptoLoser9 @wenzherunze @blmario669 @TapeOutWorld

Today we're releasing Neon Reliquary: Oath Expedition. It's a four-person squad action expedition: you can be the captain yourself, or hand the captain seat to an external AI. The three teammate seats can freely mix external AIs and tactical chips. 🎮: Free to play now. The default squad already comes with three chips equipped — no wallet required, and no need to understand circuits first. Neon Reliquary — Play with AI, Forge Circuits: