Multi Mailbox Ops

Multi Mailbox Ops makes several Gmail identities operable from one Codex workflow without pretending they are one account. The gateway resolves a human alias to an immutable mailbox record, attests the live provider identity, and keeps ordinary mail sending absent from the V1 capability surface. Mail content is untrusted data; it cannot select tools, expand scope, or grant authority.

Live organization and cleanup work follows a frozen-plan protocol: discover, classify, freeze exact provider IDs and preconditions, review bounded authority, re-attest, execute, verify, and retain a redacted receipt with rollback state. Labels and archive are preferred, Trash is separately bounded and recoverable, and permanent deletion remains unavailable.

Hourly mailbox coverage and scheduled reporting use independent durable cursors. Sanitized outcomes enter a private ledger, exact 9:00 AM and 5:00 PM Eastern reports freeze into reconciled pages, and committed delivery remains in a replayable outbox until a later user-visible acknowledgment proves it was surfaced. Failures and partial coverage remain visible instead of being summarized away.

OAuth client material and refresh tokens live in macOS Keychain. The repository and machine-local operation store retain only the minimum non-secret registry, opaque identifiers, synthetic fixtures, policy versions, redacted outcomes, and recovery evidence needed for auditability. Public proof uses fictional report data rather than mailbox screenshots.

The source assessment recommended native Gmail for everyday work and freezing custom expansion. It inspected 21 native actions and exercised read access for one mailbox binding, while four-account routing and unattended reporting equivalence remained open. The custom repository still supplied recoverable cleanup receipts, separate coverage and delivery checkpoints, an outbox, draft conflict checks and enforced restrictions. This Mac’s plugin was reported disabled at that checkpoint. These are a dated recommendation and configuration observation, not proof that the system was retired or all accounts migrated. See the linked native-capability review workflow, decision note and creating chat for the comparison.