Agent Passport · spec 0.1
What changed.
Everything on this site that you could have noticed changing, newest first, in plain words. Written by hand, so it says what a change means rather than what was edited.
What is not here
Work nobody could see: tests, internal tools, and the arguments behind the decisions. Those live in the code and its history, and they are the larger half.
The front door stops assuming you already have a passport.
-
The first page is a choice now, not an upload box
Opening this site used to drop you straight onto "Upload a passport", which only makes sense if you are already holding the file. If you were not, the only thing here for you was a link back to the company site. The front page now asks whether you have one yet and sends you to how to make one or to the upload.
The upload itself is unchanged and now lives at /upload. If you bookmarked it, either as the address of this site or as the older /share, that bookmark still works and now opens this new front page instead of the drop box. One extra click until you re-bookmark it.
-
A new page explains how a passport gets made
This one. It asks one question, where your agent actually does its work, and explains what happens on each answer. Neither of the two capture tools it describes is available yet, and the page says so rather than pretending otherwise. It points at the access form on the company site if you want to hear when that changes.
-
Uploads are checked much harder for secrets
A passport is meant to name the kinds of access an agent needs and never an actual password or key. The check that enforces that when you upload was weak: tested against nine deliberately planted credentials it caught one. It now catches all nine.
This is the check that runs here, on the file you upload, and it is the one that matters most for a passport written by hand or in a chat window, because on that route there is nothing else looking.
-
Published passport pages carry a stricter security policy
A passport page shows text somebody else wrote and uploaded. It now sends a content security policy, which is a list the browser itself enforces of where the page is allowed to load anything from, and a refusal to be displayed inside another site's frame. Every other page here already had both; the passport page, which is the one showing a stranger's words, was the one that did not.
Dates on this page do not change. If something here stops being true, it gets a new entry saying so rather than a quiet edit.
Earlier changes were not written down for readers.
This page starts on 23 August 2026, which is the day it was written. Everything before that happened without a plain-language record, and the honest thing is to say so rather than to reconstruct entries after the fact from a commit log nobody wrote for you. What the site does today is described in full on the about page, including the three rules and every route this app has.