A project passport is a structured, machine-checkable record of a software project, generated at the moment the project changes hands. It documents what the software contains, how it runs, what was decided during the build, what was verified by execution, and what remains unknown, with every statement labelled by the kind of evidence behind it.
Three properties distinguish a project passport from ordinary documentation. It is generated from evidence: the content is extracted from the repository, the version history and the AI-agent session transcripts behind the build, rather than written from memory. It is verified by execution: the setup, build and test steps it records were actually run in a clean, isolated environment, and the results are part of the document. And it is independently checkable: the passport carries cryptographic digests binding it to the exact commit and file contents it describes, so a recipient can later prove the delivery matches the description, or see exactly where it diverges.
The term draws on the travel document: a compact artifact that crosses a boundary with its holder and can be inspected by the other side. Here the boundary is a change of ownership, from a freelancer to a client, an agency to a customer, a seller to a buyer, or a team to its future self.
A typical passport records the project’s architecture and services, the environment and setup reproduced from a clean start, the decision log recovered from agent history, the claims made about the system with their verification status, a risk register of unknowns and unfinished work, and the verification log itself. In Mantyl’s implementation each entry carries one of eight truth statuses, from independently verified down to contradicted, under rules where interpretation can never be upgraded into proof; the vocabulary is documented in the truth model. A complete annotated specimen is at the example passport.
Software built with AI coding agents concentrates its knowledge in fragile places: session transcripts, discarded prompts and the operator’s memory. When such a project is delivered, the recipient traditionally receives source code and assurances. The passport exists to replace the assurances with a checkable record, addressing what its proponents call transfer debt, the gap between what was delivered and what the recipient can actually understand, run and maintain.
A passport is only as good as the recipient’s ability to test it. In the open passport.json format used by Mantyl, the recipient runs a single command against the delivered project; it recomputes the file manifest, compares the commit and re-executes the recorded checks in the recipient’s own sandbox, naming any divergence. An optional signed accreditation goes further: an independent service re-executes the checks on neutral infrastructure and signs the result, so the proof rests on neither party. The recipient’s walkthrough is at receiving a passport, and the wider delivery practice the artifact belongs to is covered in AI code handover.