A passport becomes most useful the moment someone else can read it. Publishing hosts the passport document at a shareable link, free while Mantyl is in alpha. The other side of the same coin is receiving: the recipient never has to take your word for anything.
Only the passport document is uploaded, never your source code. The CLI refuses to publish a passport that fails its own digest self-check, and the server independently re-validates both the schema and the digest before hosting anything. A hosted passport is checked, not merely stored.
The hosted address is derived from the passport’s digest, which means the same passport always maps to the same link and nobody can guess an address without possessing the passport itself. Save the delete token from the publish output. It is shown exactly once and it is the only way to unpublish.
Receive recomputes everything from the recipient’s own copy. It verifies the passport validates and its digest matches, fingerprints the delivered files and names any that differ, compares the commit, and re-executes the recorded verification plan in the recipient’s own sandbox. A modified file or a check that no longer passes turns into a named divergence and a non-zero exit.
This is the point of the whole system. Trust in an agentic delivery should not depend on the builder’s reputation or the agent’s confidence. It should be checkable by the person accepting the work, on their machine, with one command.
Session transcripts never leave your machine in any form. Scan artefacts and reports are written locally. Secret-bearing files such as .env are excluded from scanning, from the sandbox and from the file manifest entirely, and all extracted text passes through fail-closed redaction before it is stored. Publishing changes none of this, because the only thing that ever leaves is the passport document you approved.