Onboarding

One guided journey from published packages to ALLOW, DENY, evidence lookup, and observe/enforce proofs.

This is the only Start-here linear path. Complete every step below with published packages and credentials issued to you. Do not treat health checks, telemetry, or a single ALLOW as onboarding success.

You will:

1. Install and authenticate
2. Produce expected ALLOW and DENY
3. Retrieve matching decision evidence
4. Verify observation continues on DENY / evaluation failure
5. Verify enforcement dispatches only on ALLOW

Latency budgets and concurrency limits are out of scope for this journey. Completing onboarding does not certify pilot kickoff performance.

What you need

• Runtime credentials issued by Sector8 Operator / support (SECTOR8_API_KEY, SECTOR8_CLIENT_ID) — shell environment only. Never paste keys into chat, tickets, or source control.
• Separately provisioned dashboard access (browser session) for Decision Feed. The runtime key is not authority for dashboard APIs.
• Python 3.10+ or Node.js 18+
• The public example bundle below. No GitHub account or repository access is needed.

No credentials yet? Contact [e-mail] or book a demo. Do not borrow another tenant’s key.

Public example bundles

Choose one language. Each versioned JSON download contains three scripts that use the published 1.0.4 SDK. Step 3 saves them into your new project directory without overwriting existing files.

Current: TypeScript examples v2 · Python examples v2

v2 is Windows cp1252-safe (ASCII console output) so a successful live walkthrough exits 0. v1 remains available but is not the acceptance path.

These examples simulate refund dispatch; they never move money. The refund cap is a narrow fixture that Sector8 must bind to your issued tenant before live verification.

Environment variables

Both language paths accept SECTOR8_ENDPOINT or SECTOR8_BASE_URL; set only one. Use the endpoint issued with your credentials. The default is https://sdkapi.sector8.ai. A separately issued non-default endpoint requires an explicit opt-in before credential use:

Variable	Required when
SECTOR8_API_KEY	Always for live runs
SECTOR8_CLIENT_ID	Always for live runs
SECTOR8_ENDPOINT or SECTOR8_BASE_URL	Only for an issued non-default endpoint
SECTOR8_UNSAFE_ENDPOINT=true	Any non-default host (including staging) for both language paths

# bash
export SECTOR8_API_KEY="YOUR_API_KEY"
export SECTOR8_CLIENT_ID="YOUR_CLIENT_ID"
export SECTOR8_ENDPOINT="https://sdkapi.sector8.ai"
# Only for an issued non-default endpoint: export SECTOR8_UNSAFE_ENDPOINT=true

# PowerShell
$env:SECTOR8_API_KEY = "YOUR_API_KEY"
$env:SECTOR8_CLIENT_ID = "YOUR_CLIENT_ID"
$env:SECTOR8_ENDPOINT = "https://sdkapi.sector8.ai"
# Only for an issued non-default endpoint: $env:SECTOR8_UNSAFE_ENDPOINT = "true"

Local .env files are fine if gitignored. Neither walkthrough auto-loads dotenv — export vars in the shell (or Get-Content .env patterns you already use) before running.

Journey

1. 1. Set credentials securely

   Inject issued credentials through your shell (bash or PowerShell above). Never paste keys into chat.

2. 2. Install published packages (pinned)

   Choose one language and start in a new directory.

   Python (bash)

   mkdir s8-onboard
   cd s8-onboard
   python -m venv .venv
   source .venv/bin/activate
   python -m pip install sector8-sdk==1.0.4
   

   Python (PowerShell)

   mkdir s8-onboard
   cd s8-onboard
   python -m venv .venv
   .\.venv\Scripts\Activate.ps1
   python -m pip install sector8-sdk==1.0.4
   

   TypeScript

   mkdir s8-onboard
   cd s8-onboard
   npm init -y
   npm install @sector8/sdk@1.0.4
   
3. 3. Download public examples

   Run the commands for your language and shell in the directory from step 2. Downloads require no credentials. The extraction command refuses to overwrite existing example files; use a fresh directory for a retest.

   Typescript (bash)

   curl -fsSL -o typescript.json https://sector8.mintlify.app/downloads/onboarding/v2/typescript.json
   node -e "const fs=require('node:fs'); const b=JSON.parse(fs.readFileSync('typescript.json','utf8')); for(const n of ['onboarding-verify.js','refund-pilot-core.js','refund-pilot-walkthrough.js']) fs.writeFileSync(n,b.files[n],{flag:'wx'});"
   

   Typescript (powershell)

   Invoke-WebRequest -UseBasicParsing -OutFile typescript.json https://sector8.mintlify.app/downloads/onboarding/v2/typescript.json
   node -e "const fs=require('node:fs'); const b=JSON.parse(fs.readFileSync('typescript.json','utf8')); for(const n of ['onboarding-verify.js','refund-pilot-core.js','refund-pilot-walkthrough.js']) fs.writeFileSync(n,b.files[n],{flag:'wx'});"
   

   Python (bash)

   curl -fsSL -o python.json https://sector8.mintlify.app/downloads/onboarding/v2/python.json
   python -c "import json,pathlib; b=json.loads(pathlib.Path('python.json').read_text(encoding='utf-8')); names=('onboarding_verify.py','refund_pilot_core.py','refund_pilot_walkthrough.py'); [pathlib.Path(n).open('x',encoding='utf-8').write(b['files'][n]) for n in names]"
   

   Python (powershell)

   Invoke-WebRequest -UseBasicParsing -OutFile python.json https://sector8.mintlify.app/downloads/onboarding/v2/python.json
   python -c "import json,pathlib; b=json.loads(pathlib.Path('python.json').read_text(encoding='utf-8')); names=('onboarding_verify.py','refund_pilot_core.py','refund_pilot_walkthrough.py'); [pathlib.Path(n).open('x',encoding='utf-8').write(b['files'][n]) for n in names]"
   
4. 4. Confirm the gate is reachable

   curl -fsS https://sdkapi.sector8.ai/api/health
   

   For an issued non-default endpoint, use that endpoint with /api/health. In PowerShell, use curl.exe. If health fails, stop. Do not route live actions.

5. 5. Prove ALLOW and DENY (full artifact fields)

   Use the downloaded verifiers — they print outcome, reason_code, decision_trace_id, evidence_hash, and policy_version_id for Decision Feed comparison.

   Python

   python onboarding_verify.py
   

   TypeScript

   node onboarding-verify.js
   

   These scripts import the published packages only (sector8-sdk / @sector8/sdk). They do not require a repository dist/ or src/ tree.

   The package CLI sector8-verify still prints traces only. Prefer onboarding_verify.py / onboarding-verify.js for full-field proof.

   Evaluate timeouts that are too aggressive can fail-close safe traffic. Prefer the SDK defaults unless your Operator gives a specific timeout for your path. This page does not define a product latency budget.

6. 6. Retrieve matching evidence

   1. Open your issued dashboard and go to Decisions.
   2. Use Verify / lookup with each decision_trace_id from step 5.
   3. Confirm matching outcome, reason_code, policy_version_id, and evidence_hash against the JSON printed by the verifier.

   Dashboard login is a session cookie. Do not send the runtime API key to dashboard APIs.

7. 7. Observe and enforce proofs (refund walkthrough)

   Offline (no credentials) proves helper dispatch effects only and must exit 0. Simulated trace IDs have no Decision Feed row — do not look them up.

   # Python
   python refund_pilot_walkthrough.py --offline
   
   # TypeScript
   node refund-pilot-walkthrough.js --offline
   

   Live verification (Operator-issued key + Refund Agent fixture bound for your tenant) must also exit 0:

   # Python
   python refund_pilot_walkthrough.py
   
   # TypeScript
   node refund-pilot-walkthrough.js
   

   Fixture defaults (confirm with Operator): cap 100 GBP, under 25, over 250, agent Refund Agent, expect over-cap DENY / AMOUNT_LIMIT_EXCEEDED.

   Mode	What must be true
   Enforce	Valid ALLOW → exactly one fake refund dispatch; DENY / timeout / auth / malformed → zero dispatches
   Observe	Workflow continues once even on DENY or evaluation failure; report decision separately from dispatched

   Live mode fails closed when expected outcomes are missing (network failure, wrong verdict, or wrong reason). Fake refunds never move money. Wrong fixture binding is a mismatch, not success. Copy LIVE decision_trace_id values back into Decision Feed Verify.

8. 8. Completion checklist

   • Published 1.0.4 packages installed in a clean environment
   • Public v2 example bundle downloaded and extracted (no local edits)
   • Credentials only via shell environment
   • Verifier produced ALLOW + DENY with full artifact fields
   • Both traces retrieved in Decision Feed and fields matched
   • Observe/enforce walkthrough exited 0 (offline and live)
   • Observe proof: continuation on DENY / failure
   • Enforce proof: dispatch only on ALLOW
   • No founder undocumented steps required

   You are onboarded when this checklist is complete for your language path.

Reference only (not alternate start pages)

• Quickstart — short install snippets
• Observe then enforce — mode concepts behind step 7
• Python SDK / TypeScript SDK — API detail
• Evaluate API
• Assistant setup companion: guides/onboard-assistant

Common mistakes

• Omitting SECTOR8_UNSAFE_ENDPOINT=true for staging on TypeScript or Python examples
• Pasting runtime keys into chat or committing them
• Using the runtime key against dashboard APIs
• Treating --offline helper proofs as live gate evidence
• Looking up simulated trace IDs in Decision Feed
• Using a repository checkout or the superseded v1 bundle instead of the current v2 bundle
• Treating a non-zero walkthrough exit as success (Windows consoles must still exit 0)
• Claiming observation “had zero impact” on a real production workflow
• Branching only on reason_code instead of outcome / decision for enforce