Mantyl.devHosted passport
digest 495fc5a9be5bf678Mantyl Verified · independently re-executed
Mantyl · Project passporta764589 · 2026-08-28
Projectmantyl-monorepo
Issued2026-08-28
Stacktypescript, node
Commita764589
Checks5 / 5 passed
Unknowns6 surfaced
01Verification (5/5 passed)
02Architecture
03Decisions (16)
04Claims (0 · 0 contradicted)
05Risks & unknowns (6)
06Setup & environment (16 vars)
P<MANTYL<MANTYL<MONOREPO<<<<<<<<<<<<<<<<<<<<<495FC5A9BE5B<5OF5PASSED<16DECISIONS<<<<<<<<<<
§ 01

Verification

+corepack enable && pnpm install --frozen-lockfilepassed (exit 0) · 13s
+corepack enable && pnpm run buildpassed (exit 0) · 29s
+corepack enable && pnpm run typecheckpassed (exit 0) · 19s
+corepack enable && pnpm run testpassed (exit 0) · 30s
+corepack enable && pnpm run lintpassed (exit 0) · 5s
§ 02

Architecture

Inferred

Mantyl is a pnpm/TypeScript monorepo implementing a 'software handover' tool: it inspects a repository, gathers evidence from coding-agent sessions and executed verification, and renders a 'project passport' for whoever inherits the codebase. The architecture is cleanly modular: apps/cli is the primary product; apps/web is a Next.js marketing site plus hosted passport pages; apps/worker is a smaller background-job service with its own CI verification workflow. The packages/ tree separates concerns tightly — schema (canonical passport contract), core (workflow/exit-code logic), evidence (evidence graph), config, collectors-git and collectors-repository (raw observation gathering), three adapter packages for AI coding agents (Claude Code, Codex, Cursor), a Node/TS verifier, a Docker-based sandbox runner, HTML/Markdown renderers, and a signing package for cryptographic authenticity of passports. Documentation is unusually thorough for a project this size, with an architecture spec, implementation plan, GTM plan, and a design-system spec, and the working tree is clean at a pinned commit. The env-var surface is large and touches payment/membership (Whop), cloud storage (Vercel Blob), GitHub dispatch automation, and passport signing keys — most of which are undocumented, meaning the new owner will need to reconstruct configuration and secret-provisioning knowledge largely from source rather than docs. Some local-only artifacts (a packed CLI tarball, a passport-store directory with opaque hashed filenames, Next.js build caches) are untracked and represent machine state rather than delivered project content.

cliapps/cliRepo
webapps/webRepo
workerapps/workerRepo
adapter-claude-codepackages/adapter-claude-codeRepo
adapter-codexpackages/adapter-codexRepo
adapter-cursorpackages/adapter-cursorRepo
collectors-gitpackages/collectors-gitRepo
collectors-repositorypackages/collectors-repositoryRepo
configpackages/configRepo
corepackages/coreRepo
evidencepackages/evidenceRepo
renderer-htmlpackages/renderer-htmlRepo
renderer-markdownpackages/renderer-markdownRepo
runner-dockerpackages/runner-dockerRepo
schemapackages/schemaRepo
signingpackages/signingRepo
verifier-nodepackages/verifier-nodeRepo
§ 03

Decisions

I want to create a really strong landing page that has a top tier design system and clearly communicates the idea

2026-07-15Creator

I want to create an outstanding landing page

2026-07-15Creator

I want this to be built with next so if I build it our properly the SEO is great from the start

2026-07-15Creator

lets pick something else please

2026-07-15Creator

I want to commit this to my github account, private repo and not on any of the organisations im a part of please make sure it just ends up o

I want to commit this to my github account, private repo and not on any of the organisations im a part of please make sure it just ends up on my account only

2026-07-16Creator

we are rebranding to cueset, please change any text related

2026-07-16Creator

I want this to be top tier and not something that's been done before, the overall idea is to allow picking up and verification of AI project

I want this to be top tier and not something that's been done before, the overall idea is to allow picking up and verification of AI projects between developers and clients and potentially shari

2026-07-21Creator

lets use opus or a cost efficient model to do the analysis with

2026-07-22Creator

I want to bench the productisation for the time being and get the core idea & product fully built and not beind a literal payawall yet

2026-07-23Creator

I want to share this with a small user group initally

2026-07-24Creator

I want to build out the base product

2026-08-18Creator

I want to launch through sites like product hunt and then sync some money into marketing and see what happens, organic socials isn't an opti

I want to launch through sites like product hunt and then sync some money into marketing and see what happens, organic socials isn't an option for this product

2026-08-18Creator

I want to make use of which allows you to create ad creative via AI and get started proving product on their application really quickly

2026-08-26Creator

I want to work on a landing page uplift, where we create a PRD based on these website refernces and anaalyse the sales tactics, pshycology a

I want to work on a landing page uplift, where we create a PRD based on these website refernces and anaalyse the sales tactics, pshycology and layout

2026-08-26Creator

I want to ensure that we have full SEO compatibility including indexing and content guides, we also need to set-up a proper tracking layer f

I want to ensure that we have full SEO compatibility including indexing and content guides, we also need to set-up a proper tracking layer for the ads

2026-08-28Creator

I want to ensure that once we start ads UX is good across the board and we are immediatley providing value

2026-08-28Creator
§ 04

Claims

None recorded.

§ 05

Risks & unknowns

~13 environment variables are required but undocumented (APPDATA, BLOB_READ_WRITE_TOKEN, GITHUB_DISPATCH_TOKEN, MANTYL_API, MANTYL_SIGNING_PRIVATE_KEY, MANTYL_SIGNING_PUBLIC_KEY and 7 more) — the next owner will discover them at runtimemedium · repo
!Several environment variables tied to security-sensitive functionality (MANTYL_SIGNING_PRIVATE_KEY, MANTYL_SIGNING_PUBLIC_KEY, MANTYL_TOKEN, MANTYL_WORKER_TOKEN, GITHUB_DISPATCH_TOKEN) are referenced in code but not documented anywhere, so the new owner has no guidance on how these secrets are generated, stored, or rotated. (basis: factStatements list MANTYL_SIGNING_PRIVATE_KEY, MANTYL_SIGNING_PUBLIC_KEY, MANTYL_TOKEN, MANTYL_WORKER_TOKEN, and GITHUB_DISPATCH_TOKEN as 'referenced but NOT documented'.)high · inferred
!A cluster of Whop-related environment variables (WHOP_ACCOUNT_ID, WHOP_API_BASE, WHOP_API_KEY, WHOP_ENV, WHOP_WEBHOOK_SECRET) indicates an undocumented payment/membership integration; the new owner may not understand billing or webhook behavior without reading the relevant source directly. (basis: factStatements list all five WHOP_* variables as 'referenced but NOT documented', and none of docs/, README, or .env.example excerpts mention Whop.)high · inferred
~BLOB_READ_WRITE_TOKEN and MANTYL_API are undocumented, suggesting the web app or worker depends on external storage and an API endpoint whose setup is not explained in onboarding docs. (basis: factStatements list BLOB_READ_WRITE_TOKEN and MANTYL_API as 'referenced but NOT documented'.)medium · inferred
~The signing package, which appears to manage cryptographic keys for passport authenticity, is represented by only 4 files in the directory map, giving limited visibility into how key material is generated, validated, or protected. (basis: directories lists packages/signing (4 files); only package.json and src/index.test.ts appear in filePaths, with no src/index.ts sampled, and MANTYL_SIGNING_PRIVATE_KEY/PUBLIC_KEY are undocumented env vars.)medium · inferred
~Untracked local artifacts include a packed CLI tarball (mantyl-0.1.0.tgz) and a .passport-store directory of opaquely-named JSON files under apps/web; if these are relied upon locally by any developer without being part of the committed repo, onboarding or reproducibility could silently break. (basis: untrackedPaths includes apps/cli/mantyl-0.1.0.tgz and three apps/web/.passport-store/*.json files, which per the rules are local machine state not delivered with the repository.)low · inferred
§ 06

Setup & environment

corepack enable && pnpm install --frozen-lockfileVerified
corepack enable && pnpm run buildVerified
ANTHROPIC_API_KEYdocumentedDocumented
APPDATANOT documentedUndocumented
BLOB_READ_WRITE_TOKENNOT documentedUndocumented
GITHUB_DISPATCH_TOKENNOT documentedUndocumented
MANTYL_APINOT documentedUndocumented
MANTYL_SIGNING_PRIVATE_KEYNOT documentedUndocumented
MANTYL_SIGNING_PUBLIC_KEYNOT documentedUndocumented
MANTYL_TOKENNOT documentedUndocumented
MANTYL_WORKER_TOKENNOT documentedUndocumented
VERCELdocumentedDocumented
VERCEL_PROJECT_PRODUCTION_URLdocumentedDocumented
WHOP_ACCOUNT_IDNOT documentedUndocumented
WHOP_API_BASENOT documentedUndocumented
WHOP_API_KEYNOT documentedUndocumented
WHOP_ENVNOT documentedUndocumented
WHOP_WEBHOOK_SECRETNOT documentedUndocumented
Passport — mantyl-monorepo · Mantyl