Short answer
#The whole file, as it looks on disk
The two columns above are the argument. This is the object itself — a fragment of an Evidence Package for the invented billing system, exactly as an agent writes it.
{
"schema": "1adk.evidence-package/1",
"protocol_version": "1",
"scan_job_id": "9d1f…",
"generated_by": { "agent": "claude-code", "version": "…" },
"source": { "kind": "AGENT_SCAN", "title": "Static scan", "revision": "9f3c1a2" },
"coverage": [
{ "kind": "REPOSITORY", "scope_key": ".", "status": "PARTIAL",
"excluded": ["node_modules", "vendor"],
"reason": "Dependencies were not read." }
],
"limitations": ["Runtime behaviour was not observed; nothing was executed."],
"entities": [
{ "key": "svc.payments", "type": "SERVICE", "name": "PaymentService",
"description": "Creates and changes payment operations.",
"repository_path": "app/Services/PaymentService.php",
"confidence": "HIGH" },
{ "key": "db.main", "type": "DATABASE", "name": "Main database",
"description": "Where orders and payments are kept." }
],
"relations": [
{ "from": "svc.payments", "type": "WRITES_TO", "to": "db.main",
"description": "Records every payment attempt." }
],
"evidence": [
{ "key": "ev.create", "kind": "CODE_REFERENCE",
"summary": "Where the payment is created.",
"locator": { "path": "app/Services/PaymentService.php", "lines": "40-88" },
"confidence": "HIGH" }
],
"claims": [
{ "about": "op.create", "predicate": "idempotency",
"value": "Repeating a request with the same reference returns the first payment.",
"perspective": "OBSERVED", "evidence": ["ev.create"] }
],
"unknowns": [
{ "question": "What happens to a payment the provider never confirms?",
"why_it_matters": "Money may be taken with nothing recorded against it.",
"reason_kind": "NOT_ESTABLISHED", "priority": "HIGH", "about": "svc.payments" }
]
}Read it as a whole and the pattern is clear: locators without contents, statements without proof-by-assertion, and questions left open on purpose. There is no field in this format that a function body could go into.
#What happens between your disk and the map
-
The agent writes the file and stops
The instruction forbids opening a network connection. The file sits next to your repository and nothing has left the machine.
-
A person reads it
This step is deliberately manual. An automatic upload would remove the one moment at which a human can see what is about to leave.
-
Upload over HTTPS, into quarantine
The bytes land somewhere that is not a project store. Nothing has been parsed yet.
-
Validation
Schema, size, the job it claims to belong to, and a sweep of free text for credential shapes. A package carrying one is refused whole.
-
Your approval
A validated package waits. You see what is in it and decide whether it becomes part of the project.
-
The write
One writer per project, a verified lock, short transactions. If it fails, the store is untouched.
#The exact claim, and the one nobody else makes
What 1ADK says
1ADK does not require access to your repository and does not require uploading source code to 1ADK.
What 1ADK does not say
That nobody else ever sees your source. That would be false: the coding agent which runs the instruction reads your code, and if it is a cloud agent then that vendor sees it, under their terms — the same terms that already apply to every other task you give that agent on that repository. It is a different claim from ours, and merging the two would be dishonest.
If your code may not be read by a cloud agent, run a local one, or do not run this at all.
#What this page does not prove
What this does not do
- It is an example, not your file. What your agent produces depends on your system; the shape of the format is the same, the content is not.
- It does not prove the secret sweep catches everything. Nothing could. It is a second line behind the instruction and the human read, and it is described that way deliberately.
- It says nothing about the coding agent vendor's handling of your source. That is between you and them.
- It is not a legal document. The privacy page is the one that states retention, deletion and what personal data is held.
Questions people actually ask
No. It is invented, and it always will be — a customer package would never be published here whatever permission existed. What it shows accurately is the shape of the format and the boundary it enforces.
Yes. The agent writes the JSON file into your repository root on either road, so it is on your own disk to open. By hand it stops there and a person uploads it. If you connected your agent, the same file travels over the connection as soon as it is written — and it is still quarantined, still put in front of you, and still written into your project only when you approve it.
Three things stand in the way and none of them is a guarantee: the instruction forbids values and secrets; a person reads what arrived before it is written into the project; and the server refuses a package whose free text carries credential shapes. The reason the file is readable and the approval deliberate is precisely that the first and third are imperfect.
Sometimes, yes — and this page says so rather than glossing over it. A path can name a client. A component name can describe an unannounced product. That is a judgement for you to make with the example in front of you, which is why the example is here.