ADP · Agent Development-state Protocol
At Google, roughly three-quarters of new code is now written by AI. Agent-authored pull requests wait five times longer for a human to even look at them. And the way that code actually ships is not a swarm of speculative attempts — it is one capable agent iterating against CI until it believes the work is done, then merging. The operative word is believes: agents saturate the tests they can see while quietly failing the ones they can't16 — and every line still ships through machinery built for one human on one branch.
ADP is an open protocol for making machine-written software trustworthy at machine speed: a gate that converts an agent's belief into checkable proof. Every change lands as one signed, typed record — intent → diff → evidence → provenance — tested as the state that actually ships, reversible when it lands wrong, and legible to whoever picks the work up next: an auditor, a human, or a different agent.
For seventy years, writing code was the expensive part, so every practice we have — pull requests, line-by-line review, branch protection, CI on the branch head — amortizes verification against slow authoring. Agents inverted the ratio. Teams using AI merge 98% more pull requests, while review time per change rises 91%4. Developer trust in AI output fell to 29% in the same period5 — the code got faster and less trusted at once.
This is not a gap a better review UI closes. Any process whose unit of assurance is human attention per change fails arithmetically once changes arrive at machine rate. Drag the slider: the constant is one team's thorough-review capacity, roughly 25 changes a day.
The industry's answer so far is AI reviewing AI: merge-blocking review bots (CodeRabbit, Greptile, Cursor's Bugbot, Copilot code review) are now normal. That helps — but a second opinion is not a verification system. What the evidence supports is a different division of labor: machines verify mechanically — does it build, do the tests and evals pass against the state that will actually ship, does policy hold — and humans review intent and evidence, sampling deeper only where risk warrants it. That division needs the change itself to carry its intent, its evidence, and its provenance as first-class, machine-readable data. No current forge records any of the three.
And the bottleneck is not the end of the road. Verification is where the queue is visible; deployment and operations are where the failures land. Even after passing QA and staging, 43% of AI-generated changes still need manual debugging in production — and not one organization surveyed could verify an AI-suggested fix in a single redeploy cycle, with 88% needing two or three20. The record's real consumers sit downstream of the merge: the incident at three in the morning, the audit eighteen months later, the next agent picking the work up in a different harness. Each asks what the change was for and how it was verified, and each asks after the session that could have answered has already ended. That is the argument for a record that is typed and signed rather than transient. A check that goes green and scrolls away is not a record, and neither is a transcript in a format one vendor maintains.
The observed pattern is not a swarm. It is one capable agent iterating against CI until green, then submitting — and increasingly, merging. The field data points one way: fully autonomous agent-authored merges are still a rounding error — a few hundred out of 153,000 measured — while AI assistance already touches at least 1 in 7 private merges, and that floor is rising14. Where agents do author whole fixes, 65% merge, and the top failure modes are exactly the loop's: tests fail (18.1%), or the fix is wrong beneath a green build (15.3%)15. Even the vendors shipping parallel agents describe fan-out as the exception: Cursor's own guidance reserves multi-model ensembles for "hard problems," and uses parallelism for independent tasks in separate worktrees18. The economics agree — multi-agent coordination pays +81% on parallelizable work but degrades sequential work 39–70%6 at 4–220× the token cost7. We measured it ourselves rather than resting on other people's numbers. A pre-registered arm, 20 of 20 trials verified, found swarm topology cost 3.6× the tokens and wall clock and 2.8× the tool calls of a single agent, for no measurable quality difference19. Both tasks were solvable in one pass, which is the limit on what that arm can conclude and is stated as such in its own report.
The serial loop has a failure mode the swarm never had, and it is worse. When one agent writes, tests, and submits, oversight collapses onto a single surface: the test suite the agent itself can see — and often touch. Measured across frontier agents, every one saturates the visible tests while a gap opens on held-out tests that grows 28 percentage points for every tenfold increase in code size — up to and including a 2,900-line hash-table "compiler" that memorizes test inputs16. Verifying, not generating, is now the hard problem17. The agent's belief that the work is done is the one signal you cannot ship on. And when a change does land wrong, the questions that follow — roll it back, validate it, continue the work in a different harness — all need a record that today exists only as a transcript in one vendor's format. Step through both shapes.
The two shapes stress different machinery. The serial stream — the base case — breaks the trust path: it needs evidence the author can't grade for itself, an authoritative operation log, durable checkpoints, universal undo, and history that survives its own author rewriting it. Fan-out — the mode fleets enter for hard problems and mass remediation — breaks the merge path: it needs attempts as first-class objects, conflicts that don't halt pipelines, and a queue that tests merged states before landing. The mix will shift with model capability and token prices; the machinery has to serve both, weighted toward the one that's actually here.
But one thing is invariant. In any future where software ships without a human reading every line, four questions must be answerable, per change, forever: what was it for, what changed, how was it verified, and who — or what — produced it. That is intent → diff → evidence → provenance. It is not one strategy among several; it is the minimum record that makes non-human-reviewed software trustworthy at all. And it cannot be retrofitted by convention — commit trailers, harness memory files, wiki links — because conventions don't bind automation. The record has to be typed, signed, and enforced where changes are admitted, or it will simply be absent the day an auditor, a regulator, or an incident review asks.
None of this is a criticism of git — it is a mechanical description of a system designed, brilliantly, for a different workload. Six properties that were fine for one human on one branch are structural at agent scale. Expand any of them; each is stated mechanically, most with a simulation you can step through. No familiarity with git internals assumed.
Git stores snapshots, not diffs, and the commit is the only record of a change. Its fields were designed for a person who could be asked what they were thinking: author, timestamp, message, parents, tree. When the author is a model, the questions that matter — which model, which session, from which prompt and spec, verified how — have no field. So each harness invents a private store: shadow repositories, session JSON, commit-message trailers. An organization running three harnesses gets three incompatible audit trails, none complete. The precedent is OpenTelemetry rather than LSP, and the distinction is load-bearing: LSP standardised a request/response interface between two pieces of local software, whereas what fragments here is emitted state that outlives the process and has to be correlated across vendors — the telemetry problem exactly. OpenTelemetry won not by making tools talk to each other but by standardising the record, so any backend could consume it.
Every clone carries the full object graph, so the cost of starting work is a function of repository size, not of how much the task touches. A human pays once per laptop; an agent fleet pays once per attempt, because every sandbox starts with an empty disk. This is the wall Google hit at billions of lines — why Piper is a centralized, DB-backed store behind a virtual filesystem — and the wall Meta's Sapling/EdenFS answered by making operations scale with the working set.
Git merges line by line across three versions. When two changes touch overlapping lines it writes conflict markers into the working tree and exits non-zero. For a human that's a prompt; for a pipeline it's a halt — the exit code propagates, the agent's next command fails, and the harness falls back to a retry-and-rebase loop it wrote itself. Jujutsu showed the alternative: the conflict as a first-class object that can be committed and resolved later, so resolution becomes a task instead of an exception.
The fan-out workload is N attempts at one intent: fan out, evaluate, keep the best. Git has no object for "attempt" and no lifecycle for a workspace, so orchestrators approximate with branches, worktrees, or whole clones, then garbage-collect them out of band. The discarded attempts leave no trace — nothing can learn from them, and no audit can see them. A GitHub merge queue picks between changes that already exist as pull requests; it cannot represent N competing candidate solutions to a single stated intent. ADP's candidate set is exactly that object, and it is the one primitive here with no GitHub analogue at all — you saw it animated in FIG 03.
Git records the state of the tree, not the operations that produced it. A rebase creates new commits and moves the pointer; the originals become unreachable, recoverable only from a per-clone reflog that expires and is never pushed. After a force-push, the server has no record the previous history existed, who replaced it, or why. At one writer per branch that is survivable. With hundreds of automated writers — or one long-horizon agent rewriting as it works — it removes the two things automation needs most: an authoritative account of what happened, and a way to reverse it.
CI runs against the head of a branch. What ships is the merge of that branch into a trunk that has moved since. Two changes can each pass, be textually mergeable, and still break in combination — one renames a field, the other adds a caller. Nothing in the git or GitHub model requires the evidence to describe the state that actually landed. (GitHub's merge queue does test a speculative merge — but its verdict is a transient check, not a signed object bound to the change; it evaporates rather than becoming part of the record.) When agents write most of the code, this is the layer that decides whether throughput lands as trustworthy software — and evals are stochastic, so the gate must be a statistical land criterion, not a binary pass.
ADP is two things. A schema: every change is one signed record — intent → diff → evidence → provenance — with the git object graph as the store, so git clone and every existing tool keep working. And a gate: changes are admitted by policy that evaluates the record — tests and evals against the merged state, secrets blocked at the receive path, dependency changes checked at admission, org-level rules no agent can bypass. The verdict returns to the authoring agent as a typed object it can act on in-trajectory, rather than an alert in a queue a human never empties.
The division of labor with harnesses is deliberate: the harness is the brain and hands — planning, context, model quality; the substrate is the world and the ledger — workspaces, history, conflicts, evidence, identity. Harnesses should compete furiously on the first list and should not be able to compete on owning your history. The precedent is OpenTelemetry: every vendor once emitted its own incompatible record of what happened, until a standard for the record itself let any backend consume all of them. Every harness today reimplements checkpoints, session state, memory files, and retry loops — the same movie, one layer down.
Between February and June 2026, five well-resourced teams shipped systems on these premises — independent convergence by an ex-GitHub CEO, an IDE company, a game engine, a Perforce challenger, and an indie is the strongest available evidence the architecture is right. The matrix below scores each against the capabilities both futures require, from public sources as of August 2026. Every row expands to the evidence; ● shipped and verifiable, ◐ partial or announced, ○ absent or unpublished. Corrections welcome — file an issue.
GitHub's control shape scales human review: alerts for humans to triage, dashboards for humans to read, queues for humans to empty, rules humans can bypass. Each is a human in the loop by construction, so throughput is capped by human attention — the exact resource that stopped scaling. ADP's gate is an admission controller: typed verdicts computed against the state that ships, returned to the authoring agent in-trajectory. Machinery that scales with compute, not attention — and it answers the question no incumbent can: prove what entered the codebase, what put it there, and how it was verified.
Every entrant stops at storage and capture. Lore, Diversion, and Oak solve where bytes live and how fast workspaces spawn — real problems, and ADP adopts their conclusions (centralized content-addressed storage, working-set ops as a metric) without adopting their implementations. Entire and Diversion capture context and trajectory — the audit half. None binds context to verification evidence at merge time, and none gates on it. Capture without binding tells you what the agent was doing; it cannot tell you whether what landed is safe. Verification is the layer that decides whether agent throughput lands as trustworthy software — the hardest layer, and the uncontested one.
Per-harness state is a dead end on three counts. Provenance fragments — three harnesses, three incompatible audit trails, none complete, which no regulator will accept. Work is captive — a task started in one harness cannot be resumed, reviewed, or verified in another. And the harness becomes the lock-in point — whoever owns the harness owns your history, the play Cursor is running by pairing its harness with its forge. The labs' own incentive runs the other way: their harnesses win on model quality, and they win bigger when enterprises can adopt them without forfeiting cross-harness auditability. OpenTelemetry proved the pattern for emitted state; MCP's adoption proves harnesses embrace neutral protocols when they exist — and MCP's 2026-07-28 revision, which removed protocol-level sessions and told servers to mint explicit handles, points at exactly the shape ADP implements.
The most common alternative is not a competitor — it is a practice. The published AI-native SDLC playbooks21 have each stage end by committing an artifact the next stage reads: the intent, the spec, the plan, the diff, the review findings, the incident record. That chain is this page's thesis arrived at independently, by people with every reason to know, and a team that adopts one is better off than a team that does not. But every artifact in it is a file held by agreement, and every control that keeps it honest — the hook on a protected path, the policy encoded as a skill, the gate that pauses until a named person approves — runs inside the harness whose behaviour it constrains. The constraint and the constrained share an address space. A convention does not bind automation, and it does not survive the harness changing, the agent declining, or the eighteen months before anyone asks. A playbook says what should be written down; it cannot be the thing that refuses when it wasn't. All six stages, one by one.
What is built, what is partial and what is not started are listed on the front page — the one place that claim is maintained.