# Send a private owner sample

Use this for the first test email during agent-led setup. It needs scoped management access with `setup:write` and explicit `test:send`. Existing connections do not silently gain that permission.

The sample uses Barua's verified sender and goes only to the granting owner's verified current mailbox. Customer DNS, server events and live audiences are not prerequisites. It creates no customer, campaign or real draft, and does not enable customer sending.

## Prepare and inspect

Ask whether to use a forwarded design or a brand sample. Forwarded designs need the existing sandbox extraction and validation; an inbound ID alone is insufficient. The agent can operate the browser when authorized. Otherwise it gives the owner the single extraction step, or explicitly offers the brand sample.

Use `setup.sample.prepare` through `manage.mjs action`. Supply the existing five content slots or omit content for a fixed neutral brand sample. Preparation returns `sampleId`, `contentHash` and `expiresAt`. It performs no authoring-model or provider call.

```sh
node "$BARUA_SKILL/scripts/manage.mjs" sample --id "$SAMPLE_ID"
node "$BARUA_SKILL/scripts/manage.mjs" sample-preview --id "$SAMPLE_ID" --output-file "$PRIVATE_SAMPLE_FILE"
```

Set `BARUA_SKILL` to the installed skill folder, `SAMPLE_ID` to the returned ID and `PRIVATE_SAMPLE_FILE` to a new private HTML destination. Inspect the saved preview. It contains an inactive preview footer. The content is frozen; a change requires a new preparation. Payloads expire after seven days and expired samples cannot send.

## Verify the mailbox and send

Use `setup.sample.verify-owner` with the exact `{sampleId,contentHash}`. It sends a fixed verification message to the granting owner. Opening the link alone does not verify; the owner confirms on the page. Confirmation does not send the sample.

After that confirmation and the owner's request for this test, use `setup.sample.send` with the same IDs/hash. The API cannot accept another destination or sender. Preserve the same idempotency key when retrying an operation.

Read the sample status and distinguish accepted, delivered, failed and delivery_unknown. Accepted or uncertain provider handoffs cannot be blindly resent. An owner sample never proves customer activation or full setup completion. Skipping it is allowed and is recorded honestly.

## Limits and next steps

Mailbox challenges expire after 15 minutes. Resends are at least 60 seconds apart, at most 3/hour and 5/day per account/address. Distinct preparations and sample sends are each limited to 5/day per account/workspace. Exact operation retries reuse their allowance.

You can stop after this test. To add a custom event, follow [Start with one event](/skills/barua-setup/references/events.md#start-with-one-event). A [broader setup review](/skills/barua-setup/references/journey-review.md) is optional. Customer sends remain subject to their own approvals and current consent.

See the [agent quickstart contract](/skills/barua-setup/references/quickstart.md) for exact source and content inputs, private key handling and supported capability boundaries.