agentmbx identity list [--project <dir>] [--all] [--json] identities with role, holder, claimable and unread (read-only)
agentmbx identity prune [--days 7] [--apply] retire mailboxes older versions generated that nobody holds (dry run by default)
agentmbx identity forward <from> <to> move a mailbox's unread mail to another, with your owner signature
agentmbx identity claim [name] --cli <provider> --session <id> [--wait-ms 5000] [--json]
agentmbx identity release --cli <provider> --session <id> [--wait-ms 5000] [--json]
agentmbx identity takeover <name> --force --cli <provider> --session <id> replace a holder after owner signature
agentmbx identity result <request-id> [--json] inspect a receipt and finalize expiry; pending means outcome unknown (exit 75)
agentmbx identity export <file> [--force] passphrase-sealed backup (0600) of this host's keys, config and paired peers
agentmbx identity import <file> [--force] restore it on a replacement machine; --force backs up an existing identity first
passphrase from the terminal, or MBX_IDENTITY_PASSPHRASE; a Keychain owner key is not exported