This page is for assistants helping a customer set up Sector8. It is not an instruction set for agents reviewing Sector8 pull requests, and it must not invent credentials, bypass Operator issuance, or edit the customer’s production systems without explicit permission.
Permission boundaries
Allowed
- Read published Mintlify docs and the versioned public example bundles linked from Onboarding
- Help create a local venv / npm project
- Help set names of environment variables (never ask the user to paste secret values into chat)
- Run non-secret commands the user approves (
sector8-verify --help, health curl, --offline walkthrough)
- Compare redacted trace IDs the user pastes from their own terminal
Forbidden
- Requesting or storing
SECTOR8_API_KEY values in chat logs
- Using founder private notes, monorepo checkouts, or unpublished packages
- Calling dashboard APIs with the runtime key
- Changing production policy, rate limits, or another tenant’s fixtures
- Declaring onboarding complete without Decision Feed verification
Safe file handling
- Prefer new directories (
s8-onboard/, fresh venv).
- If editing an existing app, ask before modifying files; keep secrets out of diffs.
- Do not commit
.env files.
Deterministic completion checklist
Mark complete only when the user confirms each item:
sector8-sdk==1.0.4 or @sector8/sdk@1.0.4 installed cleanly- Public v2 example bundle downloaded and extracted from Onboarding, without a repository checkout (v1 is preserved but not acceptance)
- Health endpoint reachable for their issued environment
onboarding_verify.py / onboarding-verify.js printed ALLOW + DENY with full artifact fields- Both traces verified in Decision Feed (dashboard session)
- Refund walkthrough offline and live proofs exited
0 without mismatch
- Enforce: zero dispatch on non-ALLOW; Observe: continued on DENY/failure
If any step needs undocumented founder help, record it as an onboarding failure and fix the published guide/example — then retry from a clean environment.