Install the EVE SDK

Install the release-candidate EVE governance client in Python or TypeScript and confirm it can reach a governance endpoint. EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS; the pip and npm clients govern via hosted mode (they call an EVE service endpoint). Embedded in-process evaluation is the EVE service, not the client wheel.

Prerequisites

• Python 3.9+ (validated on 3.12.8) for the Python client, or Node 18+ with ESM for the TypeScript client.
• A reachable EVE governance endpoint (hosted or sidecar) for the client SDKs. For fully in-process examples, use the embedded service facade shipped with the EVE repo.
• The release-candidate clients are distributed privately for pilots — install the pilot artifact, not a public pip/npm install (see readiness for public-registry status). Install from the pilot-provided artifact (wheel / tarball), not from a public pip install / npm install name.

Installation

Python (from a pilot-provided wheel):

python -m venv .venv && . .venv/bin/activate
pip install ./eve_coreguard-0.2.2-py3-none-any.whl

TypeScript (from a pilot-provided tarball, ESM project):

npm init -y
npm pkg set type=module
npm install ./eve-coreguard-0.1.0-rc1.tgz

Runnable code

Python — confirm the primary entry point imports:

from eve_coreguard import EVE

eve = EVE(policy="lending_v1", mode="hosted", endpoint="https://eve.internal.example/v1")
print("EVE client ready:", type(eve).__name__)

TypeScript — confirm the ESM entry point resolves:

import { EVE } from "@eve/coreguard";

const eve = new EVE({ policy: "lending_v1", mode: "hosted", endpoint: "https://eve.internal.example/v1" });
console.log("EVE client ready:", eve.constructor.name);

Expected result

• Python prints EVE client ready: EVE; the import resolves from site-packages, not from a repo checkout.
• TypeScript prints EVE client ready: EVE; the import resolves from node_modules.
• No governance call has been made yet — this only verifies the client loaded.

Evidence output

Install itself produces no signed evidence. The reproducible-build record for the artifacts you installed is:

The Python wheel is byte-reproducible from committed source.

Verification

Confirm the client imports from the installed package and not from a repo checkout:

python -c "import eve_coreguard, os; print(os.path.dirname(eve_coreguard.__file__))"

The printed path should be inside site-packages. In the TypeScript project, node -e "import('@eve/coreguard').then(m => console.log(!!m.EVE))" should print true.

Failure example

If you point the client at an unreachable endpoint and then make a governance call, the SDK fails closed — it raises (Python) or returns a BLOCK (TypeScript) rather than silently allowing the action. A missing endpoint in hosted mode is a configuration error, not a permissive fallback.

Production considerations

• Pin the exact artifact hash you install; verify it against the table above.
• Hosted and sidecar modes require a reachable endpoint; plan for network failure as a fail-closed (deny) condition, not a bypass.
• The TypeScript client never signs and holds no secrets; embedded mode is unsupported in TypeScript and raises SDK_TS_EMBEDDED_UNSUPPORTED.

Limitations

• EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS. The Python client is version 0.2.2 and the TypeScript client is 0.1.0-rc1; both are release-candidate core clients.
• The pip/npm clients govern via hosted mode and require an endpoint. Embedded in-process governance is the EVE service, validated in-repo, not shipped in the client wheel.
• Packages are not on public registries yet; install from pilot-provided artifacts.
• Framework adapters other than the generic adapter are experimental and not validated against pinned live framework versions.

Next step

Continue with govern-a-tool-call.md to make your first governed decision and verify its evidence.