The security paragraph quietly names the hardest problem in multi-agent setups, and I want to pull on it: "a message should not automatically be treated as a trusted instruction." The nastier version of that risk is timing. You deliver to busy sessions, which is the right feature, but a message landing mid-turn reaches an agent that already holds tool approvals for its current plan, so an injected or simply wrong peer message can redirect capabilities the user granted for something else. Two mitigations that fit your existing design: make hold the default inboundPolicy for any session with write-capable tools, and wrap delivered messages in an explicit data envelope with sender provenance so the receiving model sees "peer session X claims:" rather than bare imperative text. The durable outbox surviving restarts is the feature that elevates this above the copy-paste workflow it replaces; coordination state that dies with a crashed terminal was always the real pain.
The security paragraph quietly names the hardest problem in multi-agent setups, and I want to pull on it: "a message should not automatically be treated as a trusted instruction." The nastier version of that risk is timing. You deliver to busy sessions, which is the right feature, but a message landing mid-turn reaches an agent that already holds tool approvals for its current plan, so an injected or simply wrong peer message can redirect capabilities the user granted for something else. Two mitigations that fit your existing design: make hold the default inboundPolicy for any session with write-capable tools, and wrap delivered messages in an explicit data envelope with sender provenance so the receiving model sees "peer session X claims:" rather than bare imperative text. The durable outbox surviving restarts is the feature that elevates this above the copy-paste workflow it replaces; coordination state that dies with a crashed terminal was always the real pain.