Install the EVE SDK

Install the release-candidate EVE governance client in Python or TypeScript and confirm it can reach a governance endpoint. EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS; the pip and npm clients govern via hosted mode (they call an EVE service endpoint). Embedded in-process evaluation is the EVE service, not the client wheel.

Prerequisites

• Python 3.9+ (validated on 3.12.8) for the Python client, or Node 18+ with ESM for the TypeScript client.
• A reachable EVE governance endpoint (hosted or sidecar) for the client SDKs. For fully in-process examples, use the embedded service facade shipped with the EVE repo.
• The clients are published on public registries: pip install eve-coreguard (PyPI) and npm install eve-ai-governance (npm).

Installation

Python (from PyPI):

python -m venv .venv && . .venv/bin/activate
pip install eve-coreguard

TypeScript (from npm, ESM project):

npm init -y
npm pkg set type=module
npm install eve-ai-governance

Runnable code

Python — confirm the primary entry point imports:

from eve_coreguard import CoreGuardClient

client = CoreGuardClient(api_key="eve_sk_...", base_url="https://api.eveaicore.com")
print("CoreGuard client ready:", type(client).__name__)

TypeScript — confirm the ESM entry point resolves:

import { verifyDecisionCertificate } from "eve-ai-governance";

// eve-ai-governance (npm 0.3.1) is an offline verification library (no enforcement client).
console.log("Verifier ready:", typeof verifyDecisionCertificate);  // "function"

Expected result

• Python prints CoreGuard client ready: CoreGuardClient; the import resolves from site-packages, not from a repo checkout.
• TypeScript prints Verifier ready: function; the import resolves from node_modules.
• No governance call has been made yet — this only verifies the client loaded.

Evidence output

Install itself produces no signed evidence. The reproducible-build record for the artifacts you installed is:

The Python wheel is byte-reproducible from committed source.

Verification

Confirm the client imports from the installed package and not from a repo checkout:

python -c "import eve_coreguard, os; print(os.path.dirname(eve_coreguard.__file__))"

The printed path should be inside site-packages. In the TypeScript project, node -e "import('eve-ai-governance').then(m => console.log(!!m.verifyDecisionCertificate))" should print true.

Failure example

If you point the client at an unreachable endpoint and then make a governance call, the SDK fails closed — it raises (Python) or returns a BLOCK (TypeScript) rather than silently allowing the action. A missing endpoint in hosted mode is a configuration error, not a permissive fallback.

Production considerations

• Pin the exact artifact hash you install; verify it against the table above.
• Hosted and sidecar modes require a reachable endpoint; plan for network failure as a fail-closed (deny) condition, not a bypass.
• The TypeScript client never signs and holds no secrets; embedded mode is unsupported in TypeScript and raises SDK_TS_EMBEDDED_UNSUPPORTED.

Limitations

• EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS. The Python client is version 0.2.7 and the TypeScript client is 0.3.1; both are release-candidate core clients.
• The pip/npm clients govern via hosted mode and require an endpoint. Embedded in-process governance is the EVE service, validated in-repo, not shipped in the client wheel.
• Packages are published on PyPI and npm.
• Framework adapters other than the generic adapter are experimental and not validated against pinned live framework versions.

Next step

Continue with govern-a-tool-call.md to make your first governed decision and verify its evidence.