Answer
How does a coding agent find out what an application built with this actually contains?
One command returns packages, capabilities, resources, actions, policies and providers as a single deterministic JSON report, read from checked-in source (C-14). It is source-only and read-only: it never opens the database, contacts a provider, reads a secret, or reports runtime, CI or authorization state — and it lists those blind spots as machine-readable limitations in its own output. Composing the starter and inspecting it gives 70 modules, 6 packages, 41 resources, 56 actions, 7 policies and 5 providers, then prints the eleven things the inspector says it cannot see (C-22). Those counts describe that starter's composition, not yours, it runs locally against SQLite with no authentication, and wall-clock time is deliberately not claimed.
What the ledger says, word for word
Each entry below is copied from site/claims.json, where it is bound to the evidence that holds it — a test file, a document, or a named repository fact — and to the limitation that travels with it. The answer above summarises these; these are the claim.
C-14
One command tells an agent what an application actually is — packages, capabilities, resources, actions, policies, providers — read from checked-in source, in a single deterministic JSON report.
LimitSource-only and read-only. It never opens the database, contacts a provider, reads a secret, or reports runtime, CI or authorization state — and it lists those blind spots as machine-readable limitations in its own output.
JTBD-AX-01, JTBD-AX-02tests/app-inspect.test.jsdocs/APPLICATION_INSPECTION.mddocs/AGENT_HARNESS_COMPATIBILITY.mdC-22
One command composes the whole thing and then inspects it: 70 modules, 6 packages, 41 resources, 56 actions, 7 policies and 5 providers, applied from manifests and driven end to end — then it prints the eleven things the inspector says it cannot see.
LimitIt composes the starter's application, not yours, and it runs entirely locally against SQLite with no authentication. The counts describe what that starter applies; a different composition gives different numbers. Wall-clock time varies by machine and is deliberately not claimed.
tests/app-inspect.test.jstests/contracts-activation-e2e.test.jstests/delivery-economics-e2e.test.jsdocs/APPLICATION_INSPECTION.mdnpm run tour runs examples/starters/b2b-lead-qualification/install.mjs, which CI runs on every push, into a directory it keepsthe counts are the app inspect report of that composed projectscripts/tour.js exits non-zero if the composed application is ever emptyWhere this stops
Nothing on this page implies the framework is deployable. There is no authentication, tenancy or RBAC, so it is local-development-only whatever any single answer says. Every claim and every limitation is on one page, and the questions this project refuses to answer are published beside them.