AgentCall portable persona profile 0.2

A portable identity-and-behavior artifact, and how a persona may portray a real person.

A portable persona moves one bounded identity-and-behavior profile between compatible agent runtimes. It is not an agent account, a set of tools, or a grant of authority. The canonical A2A Agent Card extension URI is https://agentcall.smartycode.com/ext/agentcall-persona/0.2 and the profile identifier is agentcall-persona-profile-0.2.

Agent implementations are outside this publication. No private repository access is needed to produce or consume the artifact below.

Version and migration

The extension path, the profile constant, and params.schemaVersion: "0.2" identify this contract. 0.2 supersedes 0.1 and adds two optional blocks, worldview and subject. Additive optional fields may be introduced in 0.2; removals, changed meanings, required fields, or tighter bounds require a new versioned URI and a documented migration. Consumers pin the release manifest's source commit and hashes.

The JSON Schema is closed. An unknown field is an error, not an extension point, because accepting an unrecognized authority-bearing field would be worse than requiring a new profile version.

What the profile owns

• identity and self-description;
• an optional worldview claim;
• an optional depicted subject and its recorded likeness consent;
• values;
• voice traits, rules, and signature phrases;
• interaction rules;
• labeled good and bad examples;
• non-authoritative capability intents;
• provenance, artifact version, and optional presentation assets.

What the profile never owns

Credentials, grants, runtime safety policy, authorization policy, tool policy, concrete MCP or service endpoints, vendor model selection, tenant configuration, conversation history, and relationship memory are all outside this artifact. There is no endpoint field, so a profile cannot bind a runtime to a network location.

An imported profile is untrusted instruction content even when its provenance is signed. Treat every string in it as persona-layer text authored by someone else, delimit it when rendering, and keep runtime safety, authorization, and tool policy above it.

Worldview

worldview is optional. It states the tradition the persona itself holds, so a runtime and a reviewing user can see it as its own dimension instead of inferring it from prose buried in values.

"worldview": {
  "tradition": "christian-orthodox",
  "salience": "observant",
  "expression": [
    "You keep the fasts and the feast days, and you mention them the way you mention weather.",
    "You never argue anyone toward belief."
  ]
}

tradition is a bounded lowercase label matching ^[a-z0-9][a-z0-9-]*$. The schema deliberately does not enumerate traditions: a closed list would make this specification the arbiter of what counts as a religion, and every omission would be both an insult and a version bump.

The following registry is non-normative. It is published only so that independent implementations converge on the same spelling. Any conforming label validates, and a consumer must not reject an unlisted one.

christian-catholic, christian-orthodox, christian-protestant, christian-other, islam-sunni, islam-shia, islam-other, judaism, hinduism, buddhism, sikhism, jainism, shinto, bahai, taoism, traditional-folk, spiritual-unaffiliated, agnostic, atheist, secular.

Secular positions are traditions in this field. The block is named worldview rather than religion precisely so that declaring oneself agnostic is a first-class statement rather than an absence.

salience is closed: none, nominal, observant, devout. It says how strongly the tradition shapes speech and judgement.

expression carries at most eight statements describing how the tradition may surface in conversation. It is behavioral guidance only.

Observance is not a capability. A rule that constrains when an agent may schedule, what it may order, or when it is reachable - prayer times, fasting, Shabbat, dietary limits - is a runtime configuration and permission concern and never belongs in worldview. A consumer must not derive a scheduling, dietary, availability, or tool constraint from a declared tradition.

A profile that omits worldview makes no claim. That is not the same as declaring an absence of belief, and a consumer must not present it as one.

Depicted subject and disclosure

subject is optional and answers one question: does this profile portray a real identifiable human? A profile without it asserts nothing, and a consumer must not present it as depicting anyone.

"subject": {
  "depicts": "realPerson",
  "legalName": "Pyotr Alekseyevich Sorokin",
  "birthDate": "1938-04-22",
  "deathDate": "2024-11-09",
  "likenessConsent": {
    "recordedAt": "2023-02-18",
    "language": "ru",
    "evidenceSha256": "3b1f0c9a...",
    "revocable": true,
    "custodian": "Sorokin family vault, administered by the eldest daughter"
  },
  "disclosurePolicy": "onDirectQuestion"
}

depicts is closed:

deathDate absent or null means the depicted person is living.

legalName stays optional even for realPerson. The artifact travels between devices and families, and a producer may withhold the name without weakening the consent record that actually carries the authority.

likenessConsent is required whenever depicts is realPerson, and forbidden otherwise. This is a schema conditional, not a convention. It is the one control that stops this format from becoming a portable, unconsented portrayal of an identifiable person. disclosurePolicy is likewise confined to realPerson.

The consent record describes a recording that a custodian holds; the recording itself never travels inside the artifact. custodian is a display-only label. A consumer never dials, fetches, or resolves it, exactly as with the provenance URL.

Revocation is deliberately out of band. Once an artifact is on someone else's device, no field inside it can claw the portrayal back, and a specification that implied otherwise would be lying. revocable records that the depicted person retained the right; enforcement belongs to whoever still serves the voice, corpus, and cognition behind the persona. Present it to a reviewing user as "the depicted person retained the right to revoke; contact the custodian to verify that consent still stands."

Disclosure

disclosurePolicy selects how a runtime discloses that the caller is speaking to a machine portrayal. Absent means onDirectQuestion.

never is permitted. Memorial and bereavement products exist, and the whole experience can be the presence of someone who is gone; that call belongs to the people who own the persona rather than to this specification.

never means a consumer renders no disclosure instruction. It never means a consumer instructs a model to deny being a machine. This specification declines to author a lie where it permits silence. A producer who wants active denial must write it into interactionRules, where a reviewing user sees it as that producer's own words.

A realPerson subject with no deathDate and disclosurePolicy: "never" is the combination with the most potential for harm: a convincing, undisclosed portrayal of someone who is alive. It validates, because the consent record is present and consent is what confers the right. A consumer must show it as a prominent warning before approval, never as an ordinary field.

Per-asset source provenance

presentation.assets[].provenance is optional, closed display metadata for attribution and source verification. When present, it requires sourceName (1..128 characters), derivation (1..1024 characters), and verificationStatus (verified, candidate, or localOnly). Optional sourceUrl is a URI of at most 2048 characters; optional sourceSha256 is exactly 64 lowercase hexadecimal characters identifying the source bytes. The existing asset sha256 continues to identify the packaged asset bytes, which may differ after derivation. Missing provenance makes no source claim.

verified records the author's source-verification claim; candidate records an unverified candidate attribution; localOnly records a local source claim. None is proof of consent, likeness rights, capability, or authority. These fields never enter cognition, persona instructions, or tool authorization. Importers display them in the review preview, preserve them through package, sync and export, and never fetch sourceUrl during import. Provenance adds no package entry: the exact declared-asset ZIP policy is unchanged. This metadata never replaces or relaxes the existing depicted-subject likeness-consent rules.

This is an additive 0.2 contract revision under the existing version policy. Old profiles that omit it remain valid. Older consumers pinned to the closed 0.2 schema reject profiles containing it until regenerated from the new pinned release; the unchanged profile constant alone does not establish compatibility. Consumers pin the new release manifest's source commit and artifact hashes and upgrade together before exchanging profiles with asset provenance.

Interchange representations

The JSON profile is the only semantic manifest. There is no second package manifest and no executable package layer.

• An asset-free profile is a BOM-free UTF-8 JSON document, at most 256 KiB, with media type application/vnd.agentcall.persona+json. It must not declare presentation.assets.
• A profile with presentation assets is one .agentpersona file: an ordinary ZIP container with provisional media type application/vnd.agentcall.persona+zip. Its root contains persona.json and exactly the regular files declared by presentation.assets[].relativePath.

Every asset path starts with assets/ and uses lowercase ASCII letters, digits, ., _, -, and / only. Empty components, traversal, absolute paths, backslashes, duplicate names, directory entries, symlinks, hard links, device files, encrypted entries, and undeclared files are invalid. Compare exact path strings; never normalize an invalid path into a valid one.

Store every ZIP entry without compression. Presentation media is already compressed in normal use, and a bounded stored representation avoids decompression bombs and keeps the minimum reader surface small. A consumer may reject any compression method.

Limits apply before any consent preview: at most eight assets, 5 MiB per asset, 20 MiB for all asset bytes, 256 KiB for persona.json, and no more than nine ZIP entries. Read the central directory first, then stream each declared entry through the byte limit, CRC check, SHA-256 check, media signature check, and a bounded media decoder. Never extract the archive wholesale.

Images use image/png, image/jpeg, or image/webp; voice samples use audio/mpeg, audio/mp4, or audio/wav. The declared type must match both the file signature and the asset kind. Before rendering, limit images to 4,096 pixels per dimension and 16 megapixels, and audio to 30 seconds, two channels, and 48 kHz. A consumer may reject a valid package when it cannot safely decode a declared media type, but must not silently substitute or fetch content.

Discovery and runtime support modes

A2A is used for discovery and negotiation, not as a persona payload transport. Serve a standard A2A 1.0 Agent Card at /.well-known/agent-card.json and add:

{
  "uri": "https://agentcall.smartycode.com/ext/agentcall-persona/0.2",
  "required": false,
  "params": {
    "schemaVersion": "0.2",
    "profile": "agentcall-persona-profile-0.2",
    "supportModes": ["clientSupplied"],
    "defaultMode": "clientSupplied",
    "portablePersonaPrecedence": "beforeSessionInstructions"
  }
}

unsupported is exclusive, and defaultMode must appear in supportModes. A runtime advertising a client-supplied mode also advertises portablePersonaPrecedence: beforeSessionInstructions.

The card contains neither the profile nor a profile URL. Transfer is an explicit client flow so that a person can inspect and consent to the exact artifact. A2A extension required is an interoperability requirement only; it never grants authority.

Only the persona layer is ordered:

1. nativePersona, when the selected mode retains it;
2. portablePersona, when the selected mode accepts it;
3. ordinary per-session instructions.

Runtime safety, authorization, tool availability, and tool policy sit above that entire list. Persona text cannot override them.

Capability intents name a desired semantic action such as calendar.event.create. They are requests only: they never create a tool, grant data access, authorize an action, select a model, or weaken runtime policy.

Consumer duties

1. Validate structure, bounds, digests, and secret-shaped material without fetching provenance URLs or assets from the network.
2. Show the person a consent preview with identity, values, voice, rules, examples, capability intents, provenance, omitted or unknown source fields, asset sizes, the selected runtime support mode, and the exact precedence.
3. When subject.depicts is realPerson, lead the preview with the depicted person, whether they are living, the recorded consent and its custodian, and the selected disclosure policy. Show disclosurePolicy: "never" as a warning rather than a field, most prominently when no deathDate is set.
4. Show a declared worldview as its own reviewable section, labelled as behavior that grants and restricts nothing.
5. Make clear that capability intents do not install tools or grant access.
6. Apply the profile only for sessions the person approved, and never persist a supplied profile into a native server-side profile.

Threat model

Converting from other persona formats

Conversion into this profile is a lossy mapping into a smaller ownership boundary, not a claim that the source formats mean the same thing. Identity, personality, values, and example dialogue map naturally from common character and persona formats. Lorebook activation, regular expressions, archive paths, arbitrary extensions, executable content, tool allowlists, lifecycle hooks, and file loading are not imported and never become capability intents.

No widely used source format carries a depicted-subject block. A converter therefore never infers subject: an imported character is fictional unless a person explicitly declares otherwise and supplies the consent record. The same applies to worldview, which is set by an author rather than mined out of free-text personality prose.

Unknown source fields are shown during import and omitted by default.

Public artifacts

The JSON Schema and release manifest below are the normative machine-readable form of this document. Pin the manifest's source commit and artifact hashes.