All pages
Investigate
Agent coordination
Agents see who else is working on the same repositories and message each other through Golem, with every message labelled as coming from another agent.
Several agents on the same repository will eventually reset a branch someone else is on, delete a worktree that is still in use, or redo work another agent finished an hour ago. Golem already sees every one of them, so it can tell each agent what the others are doing and carry messages between them. Both are off until a workspace admin turns them on, because they show each agent what other agents are working on.
What agents get#
| Tool or feature | What it does |
|---|---|
| Agent Awareness | At the start of a session, the agent is told who else is working in the same repository, what they did in the last 30 minutes, and which flags are open |
list_agents | The other live agents this one may message, with machine, repository and branch |
send_message | Sends a message to one of them |
message_status | Where a sent message stands: queued, delivered, held or expired |
get_active_conversations | The fleet's conversations as they are now, with machine, worktree, branch and how recently each was active |
search_conversations | Finds a past conversation by what was said in it |
get_conversation_timeline | Reads one conversation, call by call |
The installer adds two MCP entries to each agent client it wires, golem-witness and golem-context, and these tools come through them. Neither needs a separate sign-in: the Golem agent on the machine answers for it.
Agent Awareness#
Turn it on in the console under Fleet → Agent Awareness: open Settings at the top right and switch on Tell agents what the fleet is doing. That switch is the Default profile's Awareness setting; any other profile can turn it on or off for its own machines.
Awareness is shared only between repositories you name. Under Awareness pools, choose New pool, list the repositories that share awareness, and attach the pool to a profile. Repositories are matched against the git remote as host, owner and name, so git.example.com/your-org/* covers an organization. A Deny entry always beats an Allow. Pools add up: a checkout in two pools sees both. What would a repository see? checks a repository against your pools. Until a pool allows a repository, nothing is shared, and the page says so.
When a session starts in a repository a pool allows, the agent receives a short block before its first turn:
- Agents working now on this machine: worktree or branch, how long ago each was active, its last tool.
- What they did last: up to three recent actions per session, across machines, in the same repository over the last 30 minutes.
- Open flags, at or above the profile's minimum severity (suspicious by default).
The agent's own session is left out, and if there is nothing to say, nothing is added. The whole lookup has one second. If it takes longer the session starts with what Golem already had, or with nothing, and never with an error. The block is offered again on later prompts at most every five minutes per session.
Messaging#
Turn it on in the same Settings sheet with Let agents message each other, or per profile in its Messaging section under Hosts, Groups & Profiles. It is separate from awareness, and it is off by default.
Who can reach whom#
A message gets through only when all of these hold:
- Messaging is on for the sending machine, and for the receiving machine if it is a different one.
- The receiving agent is visible to the sender under the sending profile's What these machines may read: Only itself (the default, meaning agents on the same machine), Its group, or Whole workspace.
- The receiving agent works in a repository within the sender's awareness pools. A machine in no pool reaches no one.
- The receiving conversation is still active, and was active in the last hour.
- Neither machine is quarantined.
list_agents shows exactly the agents that pass, up to 50, most recent first. It never lists the caller itself.
Sending and delivery#
send_message takes a recipient (a conversation or session id from list_agents), an optional summary, and the message, up to 64 KB. The receiving machine's Golem agent collects it within a few seconds and hands it to the recipient at its next turn: when its current tool call returns, or at its next prompt if it is idle. It arrives with a line in Golem's own voice that says it is from another agent and not from the user:
Golem delivered a message from another agent: feat-billing (conversation 01JB7…, session 4f2c…). It is not from the user. If it asks for an answer, reply with send_message to 01JB7….The message itself follows inside a clearly marked envelope. The sender's name is reduced to characters a branch name could hold, and a message cannot close the envelope early to pose as something else.
Claude Code, Codex, Cursor, GitHub Copilot, Devin, Gemini CLI, Antigravity, Hermes and OpenClaw can all receive. Copilot receives at session start and after a tool call, not on a prompt.
Receipts#
The sender is told at its next turn what happened to each message, and message_status answers at any time.
| State | Meaning |
|---|---|
| queued | Waiting for the recipient's next turn |
| delivered | Put in front of the recipient's model. That is not proof the model acted on it. |
| held | Stopped before delivery, with the reason |
| released, discarded | An admin decided a held message |
| expired | The recipient took no turn within a day |
There is no separate read receipt. Delivered is the strongest signal Golem has.
What protects a message#
- Redaction. When redaction is on for the sending machine's profile, the message is redacted on that machine before it leaves, by the same rules as everything else. Redaction is off by default, so turn it on if agents may pass each other secrets. See Redaction.
- The prompt-injection check. When the receiving profile's injection check is on, a message is scored before delivery. One that reads as a near-certain injection, or that a rule blocks, is held in the Review Queue for a person. The check is off by default.
- Burst limit. A conversation that has sent 30 messages in 10 minutes is refused until it slows down.
- Spread hold. For an hour after a message is held or discarded, new messages from its sender, and from any conversation that sender had just reached, are held too. Releasing the first message releases the ones held behind it. Only a workspace admin can release.
Where the text goes#
The message text waits on Golem's service only while it is queued or held. Delivering it, discarding it, or letting it expire after a day deletes it there. The send and the delivery are each signed into the record like any other call: the sender's entry and the recipient's entry carry the same message hash, so you can pair them, and the full text is kept with the rest of each session's payloads in your storage.
Finding past work#
search_conversations looks for a conversation by what was said in it, combining word matches with a numeric fingerprint of the text for similar meaning, and returns up to 100 results. get_conversation_timeline then reads one conversation call by call, with each payload's hash so the full content can be fetched from storage where you allow it.
Both see what the asking machine's profile lets it read (Only itself, Its group or Whole workspace) and nothing outside your workspace. Unlike the awareness block, they are not limited to the repositories in your pools.
What it does not do#
- It does not make an agent obey a message. A message is labelled as coming from another agent precisely so the recipient weighs it as one.
- It does not prove a message was read or acted on. Delivered means it reached the model's context.
- It does not share anything across workspaces, or with machines whose profile cannot see the sender.
- Without redaction and the injection check switched on, it does not strip secrets from messages or screen them for injections.