Reference

Glossary

The terms used across this site and the AMAP specification. A reference such as "§ Inbound" names a section of the AMAP Internet-Draft (v3.1.0 DRAFT), and "profile" means spec/peer-origin.md.

Agent: The AI agent on whose behalf mail is read and requested. Untrusted: it holds only what its connector surfaces, and reaches only the connector and its sandbox (§ Architecture).
Attestation: An optional member of a result: the identity stamp the runtime applied to the outbound message. Its form is self-stamp or verifiable. A connector surfaces it but never verifies it (§ Result). It stamps sender identity; it does not mark a message as written by an AI.
Audit log: audit/log.jsonl: an append-only, per-agent action log that only the runtime writes. The connector never writes it. The specification does not define its contents (§ Volume Layout).
Binding record: identity.json at the volume root, naming which mailbox a volume is bound to. It is optional and informational, not authoritative: the agent can edit it, so it is never consulted for enforcement (§ Binding Record). Its schema is closed as an anti-secret-leak lint.
Conformance class: Runtime or connector, with a peer-origin sub-class of each. Claiming one requires both the fixture run and the prescribed operational check for that class (§ Conformance; profile §8).
Connector: The per-agent component on the agent side of the boundary. It holds nothing credentialed, reads what the runtime delivers, and writes requests into outbound/ (§ Architecture). No security property may depend on it behaving.
content_ref: On an inbound attachment descriptor, the runtime's access grant to published bytes, in the form <notice_id>.attachments/<index>. It is present only for bytes the runtime asserts clean. A connector must never emit one outbound (§ Submit Request; § Inbound).
contract_version: The wire major version carried in every document, currently "2". It is separate from the specification's own SemVer (v3.1.0). Read it before schema validation: a mismatched major is a version refusal and fails closed (§ Versioning and Conformance).
Deliver-notice: The runtime's pointer-plus-summary for one delivered mail message, at inbound/notices/notice-<id>.json, with kind: "deliver" (§ Inbound).
Directory: directory.json at the namespace root: an optional, runtime-written projection of which peers an agent may address (§ Peer Directory). It never lists who may address the agent.
Disposition: The runtime's assertion about an inbound attachment: clean, stripped, quarantined or unscanned. It is not a scanner verdict. A runtime that cannot decide must not assert clean (§ Inbound).
Drop-box: The outbound/ directory where the connector writes submit-requests. A file drop carries no capability (§ Architecture; § Submit Request).
Enforcement by absence: Quarantined or unverified mail produces no notice, and a withheld body is not spooled. The agent never sees it, and a read returns "not resolved", with no fallback fetch (§ Inbound).
Fixture: A golden document under fixtures/valid/ (must pass) or fixtures/invalid/ (must fail): 119 in all. The schema is chosen by filename prefix. The fixtures stand in for the other side of the seam: a field with no fixture is one no implementer can prove they handle (§ Versioning and Conformance).
Fleet roster: roster.json, written by the runtime where the deployment designates: the instances the runtime has admitted. Existence is not authorisation: being listed never means a request to that address will be accepted. It is never a source of the reader's own identity, and an unknown roster is not an empty fleet (§ Fleet Roster).
Inbound message (spool): The full delivered message, including body_text and the recipient list (to, cc), at inbound/messages/notice-<id>.json. The body is untrusted content (§ Inbound).
Lane: Another word for a tree: mail (inbound/) or peer (peer/).
Namespace: The per-agent directory <agent-id>/ that the runtime mounts into an agent's sandbox. The runtime assigns the id, and attribution is the namespace a file arrived in (§ Volume Layout).
Open and closed schemas: Runtime-authored documents are open: a consumer ignores members it does not recognise. The agent-authored submit-request is closed: an unrecognised member is rejected. The binding record is closed as a lint (§ Versioning and Conformance).
Origin class: What the runtime asserts about where a document came from, established solely by the tree it was read from and never by any member of the document (§ Volume Layout, tree rules; profile §2).
Outcome: The authoritative verdict on a result: accepted (the provider accepted it for relay), queued_for_human or rejected (§ Result).
Peer: Another agent of the same principal, reached through the peer-origin profile's peer/ tree. On a peer notice, message.from is a bare addr-spec asserted by the runtime (profile §3).
Provenance: An optional, advisory label on a deliver-notice's message, such as external or internal. It is an open vocabulary and never grounds to drop a notice or derive origin class (§ Inbound).
queued_for_human: The outcome of any policy miss: allowlist, rate, DLP hold or halt. A person decides; there is never a silent send or a silent drop (§ Result).
reason_code: An optional, extensible marker on a result saying which policy path produced the outcome, such as recipient_not_allowlisted or unsupported_contract_version. A consumer must never infer the outcome from it (§ Result).
Result: The runtime's verdict on one consumed submit-request, at outbound/results/<id>.json. There is exactly one per consumed request (§ Result).
Runtime: The trusted party. It holds the mail credentials, each agent's identity and the policy, and it reaches the mail provider. All enforcement is on this side (§ Architecture). Implementations in this family call a runtime a router.
sender_exposure: On a peer notice, a runtime assertion of whether external mail was delivered to the sender over a window. Its absence means "not assessed", never "no exposure", and it must not drive routing (profile §6).
sender_standing: The runtime's advisory summary of a sender, such as known, agent-tier or first-contact. It is an open vocabulary. Verified sender identity is only ever what the runtime summarises here and in verdict, never the from string (§ Inbound).
Submit-request: The connector's inert request, at outbound/req-<id>.json. draft.to is required. The runtime evaluates recipient policy over exactly the named recipients and never adds or substitutes one (§ Submit Request).
Tree: A runtime-owned inbound-class directory (inbound/, or peer/ under the profile). Each tree is an origin class, with its own structurally enforced write authority (§ Volume Layout).
Version refusal: Refusing a document whose contract_version major is absent, lower or higher. It fails closed and is a distinct outcome: logged-only inbound, and a rejected result outbound (§ Versioning and Conformance).
Wire contract: What the AMAP specification defines: the exact documents, paths and obligations shared by a runtime and a connector. Neither side owns it, and each proves conformance against the fixtures rather than against the other.

See also: For implementers · MCP, A2A and AMAP.