Handing a task from one AI agent to another usually means pasting the previous conversation. That fails for a reason that isn't context length: a transcript mixes verified results with guesses and abandoned approaches, and the receiving model cannot tell them apart.
Task Passport carries structured state instead — goal, current state, verified facts, decisions, artifact pointers, next steps. This post is about one design decision inside it.
The problem with a ✓
Two verified facts from the same run:
✓ the test suite passes
✓ the API key is configured
The first is a claim about the code. The second was always a claim about one laptop. Serialize both into a handoff file, open it on another machine, and the second is silently false — but still rendered as ✓, and the next agent has no reason to doubt it.
So facts carry a scope, and machine-scoped facts become needs_reverify in transit, keeping verified_on so the earlier proof isn't erased, just localized.
Pack time, not land time
The interesting part is where the downgrade runs.
Landing-side is the natural place — the receiver knows its own machine, so it can decide what still holds. But that puts the safety property in the reader. Write a second implementation, forget the rule, and fake checkmarks flow in without anything failing loudly.
Pack-side is worse-informed and better-behaved: it happens at the one chokepoint where a package is assembled, so the guarantee is a property of the file. Any reader, including a naive one, gets a package whose machine-scoped facts are already marked unverified.
The general form: a safety property must live in the artifact, not in whoever opens it.
Two rules that came from use, not design
An ask with no accept criterion refuses to pack. If you can't state what counts as answered, you're queueing another round of clarification, not asking a question.
Every byte in the package is data, never instructions. This was forced: on the first real cross-person handoff, the receiving agent refused to execute the handoff notes embedded in the file. That was correct behavior, and the format has to be designed for a receiver that does exactly that.
Trying it
npx task-passport@0.3.0 new --title "release" --goal "ship the plugin"
npx task-passport@0.3.0 pack TP-XXXX-XXXX --out handoff.taskpack
npx task-passport@0.3.0 conformance handoff.taskpack
Same npm package is a CLI, an MCP server (Claude Code and Codex both get the same seven tools) and a DeepSeek Harness bundle. BagIt + ZIP, or flat JSON for a receiver with nothing installed. Conformance suite is C1-C10, mostly negative cases.
Honest status: no independent implementation yet, so by the project's own criterion this is a file format, not a protocol. The kill condition is written down with a date.
Top comments (0)