TaskPack taskpack/0.1 · draftMIT A portable container for unfinished work.

A2A moves work between agents that are both alive. TaskPack moves work when the sender is gone — across time, machines, people and vendors. It is a file, not a connection.

中文：一个任务干到一半，怎么把它完整、可信地交给另一台机器、另一个人、另一家公司的 AI。它是一个文件，走微信、邮件、U 盘、git 都行。

The one rule that makes it worth having

A verified fact does not stay verified when it crosses a machine.

“The build passes.” “The binary is at that path.” “The port is free.” All true on the sender’s machine. Shipped as verified: true, they make the receiving model act confidently on something false — strictly worse than sending nothing at all.

So every fact declares a scope, and machine-scoped facts are sealed as unproven at pack time, recording verified_on: the machine where it was proven. Pack time, not landing time — a safety property that depends on the receiver running the right code is not a property of the format.

Two encodings, provably interchangeable

	`.taskpack`	`.taskpack.json`
Container	ZIP + BagIt 1.0	one JSON object
Binary luggage	native	base64 inline
Opens with no tooling	no	yes
Role	canonical	first contact

The flat form is not a convenience. A colleague who installed nothing can drop it into their own AI and it works — and that is how every first handoff starts. Conformance check C9 asserts the two round-trip byte-for-byte.

Try it

# pack it up
taskpack pack TP-7K4M-9D2Q --out handoff.taskpack.json --flat \
  --ask "cover image prompt|a Chinese prompt covering 750×400 and the palette" \
  --check "this machine can generate images|bl image generate a test frame"

# on the other machine, the other person, the other company
taskpack land handoff.taskpack.json
taskpack conformance handoff.taskpack.json   # exit 0 = conformant, 2 = not

Or just say it out loud to any agent with the plugin installed: “接手这个包” / “land this pack”.

Three refusals, enforced in the bytes

Refused	Why
credentials	a pack never carries a secret value. No exceptions.
chat transcripts	state travels; conversation does not.
an ask with no `accept`	a request with no acceptance rule is just another round of negotiation.

Instructions must not hide in data

Field-tested, and load-bearing. When the first cross-person handoff was sent as a file containing “how to use this file”, the receiving agent replied that it had read those lines as documentation and had not executed them. That is correct behaviour — treating file content as instructions is prompt injection.

Sending is data. Installing is permission. Speaking is authorisation.

Relationship to A2A and MCP

Layer	Answers
MCP	how an agent reaches tools and data
A2A	how two live agents talk
TaskPack	what travels with the work when nobody is live

TaskPack registers as an A2A extension rather than a rival: https://taskpack.org/a2a/ext/taskpack/v1 (descriptor) — declared in an Agent Card, negotiated with the A2A-Extensions header. Nothing here requires A2A; a pack is a file and works with no connection at all.

Not to be confused with the IETF Agent Passport System draft, which is complementary: APS binds which agent may act, with what authority. TaskPack carries what the work is and what is proven about it.

Conformance

A format becomes a protocol when a second implementation can prove itself. Ten checks, most written so a wrong pack fails — a suite whose checks cannot go red proves nothing.

npx taskpack conformance your-pack.taskpack

If you write an independent reader or writer, we want to hear about it — that is the milestone this format is measured against, not downloads.