You have built an agent that works. Phaeacia moves it to someone else: one file that lets a person on a different platform rebuild it against their own accounts, and a table of what did not survive the move.
Phaeacia · fee-AY-sha · they gave the stranger passage
Agent Passport 0.1 Not yet public Design partners open One founder
01 / The problem
One agent's trigger and capability list, quoted from the example passport. It carries five inputs and five personal slots besides. None of it sits in one place until somebody writes it down.
The obvious objection first. A Custom GPT is a set of instructions in a chat window, and yes, you can send someone a link to one. An agent runs. It wakes at 06:45, reads five sources, and puts a brief where you will see it before you have asked for it. There is no way to hand someone that.
The symptom
There is no file to send, because the agent is not in one place. It is a set of instructions here, a connection to a mailbox there, a schedule, a handful of accounts that are yours and only yours, and a year of small corrections that were never written down anywhere. Sending a colleague the parts that happen to be files gives them a machine with its wiring cut.
And underneath it
Even if you could send all of it, the part that makes it good would not arrive. What makes an agent good is context: which senders matter, what the labels mean, which of two true stories is the one that changes your day. That context has nowhere to live except inside the agent that grew it, so it is never handed over, only lost.
Two people working together produce something neither would alone. Two agents, today, do not.
02 / Agent Passport
Four of the nine frontmatter keys, with the values the format actually allows.
One file that describes an agent well enough that someone on a different platform rebuilds a working version of it with their own accounts, plus an honest account of what did not survive. The second half is section 6, and it is the part worth looking at first.
§ 6 / Losses
| What | Status | What that means in practice |
|---|---|---|
| calendar.read | delivered | Today's schedule is in the brief, read from the recipient's own calendar, granted on the recipient's own consent screen. |
| email.send | substituted | The original mailed the brief to its owner. This copy puts it in chat instead. Nothing is sent from anyone's account. |
| web.fetch tag: market-wire |
lost | One of the five inputs was a wire the original's owner pays for. Without that subscription there is nothing to substitute, so that beat is simply missing. |
Section 6 of examples/daily-brief-passport.md, as an install would fill it in. The file ships this table empty, because capture writes the template and the install writes the rows; these three are derived from the consent table in its section 2 and the capability list in its section 3.
That file is a synthetic example, written to exercise the format rather than captured from a real run, and it says so on line 156. It is the shape of the report, not evidence about anybody's agent. A product whose argument is an honest losses table does not get to blur that line on its own website.
It is not a copy and it does not run anything. Capabilities are named rather than bound: the file says calendar.read, not the name of a calendar company, and the recipient's own assistant resolves that against whatever they actually use. The things the owner never wrote down are asked for once, at capture, and travel as text. The file calls them personal_slots and tacit_notes.
| Section number | Section | What it carries |
|---|---|---|
| 01 | What this agent is | Plain language. What it is for, when it runs, and what it is not trying to be. |
| 02 | What it needs from you | A consent table. One row per capability, marked required or optional, each with what you lose by skipping it. |
| 03 | Functional spec | The machine-owned part: goal, trigger, inputs, processing, output, each carrying a confidence value the owner has confirmed. |
| 04 | Golden examples | Real outputs from the original, so the rebuild is checked against something instead of approved by feel. |
| 05 | Installer | Steps written for the recipient's own assistant to carry out, with one appendix per platform. |
| 06 | Losses | What did not survive the move, and what that means in practice. |
The tool that makes one, and the page a recipient opens, live on the app.
03 / The rules
A vocabulary id, the envelope constant, and the status enum. The third rule is a heading rather than a key: ## 6. Losses has to appear, by name, in every file. These are constraints on the format, not settings on an account.
Someone is about to connect a colleague's agent to their own mailbox. Three rules decide whether that is allowed to happen, and none of them is a toggle anyone can turn off.
capability_ref: email.read
A passport names credential types, never values. It can say that the original read a mailbox. It cannot carry the token that opened one. The recipient connects their own accounts during the install, or the capability does not install at all. Every workflow migration tool people already pay for behaves this way; the difference here is that the file says so on its face.
envelope: read-notify
Version 0.1 installs capabilities that read, plus delivery into a chat window. Anything that acts outside the recipient's own screen renders as declared rather than installable, and the install will not attempt it. In the example passport, email.send carries the status declared_only: the recipient can see that the original mailed its brief, and their copy puts it in chat instead.
## 6. Losses
Even when every row says delivered, and even when there are no rows. A tool that reports damage only when it decides the damage is worth mentioning is a tool you have to check by hand, and a tool you check by hand is one you stop using. Printing the empty table is what makes the full one believable.
04 / Where this goes
The three keys that say when the record was made and who checked it, read off the example passport. Everything the format knows about time is that one date, which is the gap the argument below turns on.
Sharing is the wedge because it is the smallest thing anyone would pay for. The company is the layer underneath it. That step is the part founders usually assert, so here is the argument instead, together with the result that would settle it against us.
A passport is only honest if it writes down the part that was never written down: the ranking rule that lives in no file, the instruction not to be clever about weekends, the sentence an owner would only ever say out loud. Capture asks for exactly that, the owner corrects it, and it travels as text. So the first thing sharing produces, as a by-product rather than a goal, is a written record of the context that made an agent good.
That record is the interesting object. It is not a copy of an agent. It is a description of how one person's judgment works, in a form another system can act on. Three things would have to be true before it is a product rather than a by-product, and each one is answered by shipping rather than by argument.
If fifty passports install cleanly and nobody comes back to update one, then the context was worth moving once and it is not a layer, it is a file format. Sharing would be a feature belonging inside a platform rather than a company standing beside one, and the right response would be to sell the tool and stop. That is measurable from installs and edits, and it should be settled within a year rather than argued about now.
05 / Distribution
The one delivery channel version 0.1 installs. The spec also forbids installers from reading source_stack, so no install can branch on the platform the original ran on.
There is nothing to join. A passport arrives as a link, opening it needs no account, and nothing is migrated off the tools a team already pays for. The install runs inside the assistant the recipient is using today.
It therefore works across platforms that have no interest in working with each other. That holds because no part of this calls a model on our side: the reading happens inside the owner's assistant at capture and inside the recipient's at install. An agent's internals never reach a server we run, and the thing costs almost nothing to operate.
06 / Access
No spec field governs this section, so there is no manifest to print. What the form stores, and for how long, is set out in the privacy note.
The people we want are those with an agent worth handing to someone, or with someone who wants one. Leave an address and an automated reply follows, saying where the build currently is and what a design-partner slot involves. There is no queue and no waiting list to be prioritised in.