StableMindDeveloper CenterSIO26 · Developer Center
StableMind developer tooling helps an agent runtime describe an exact semantic action, submit it to ActionGate, receive a deterministic governance decision, and integrate a certified execution boundary later. The SDK can make a request easier to express. It cannot make the request authorized.
01 · First principle
The source-backed ActionGate SDKs deliberately reject framework authority claims, hidden or credentialed tools, nested-agent shortcuts, and credential material inside request arguments. They open an attributable runtime session, prepare a semantic tool-call request, and submit it for governance. A decision response is required to report executed=false; execution belongs downstream to a separate permit-bound fabric.
Go, Python and TypeScript implementations share the same contract vectors and SDK version 1.3.0. Session and action helpers normalize request IDs, idempotency, tool manifests and credential-material checks before governance submission.
Boundary: the client submits governed intent. It does not execute the underlying tool.
The Go, Python and TypeScript connector SDKs share the actiongate.connector/1.0 protocol, nonce-bound handshake and deterministic receipt behavior. A successful connector response requires a side-effect identifier and never echoes credential material.
Boundary: using the SDK does not certify the connector. AG42 certification evaluates the final packaged executable.
Source examples cover custom Go, LangChain Python, Semantic Kernel Python and an OpenAI Agents TypeScript adapter shape. Runtime/framework metadata helps establish provenance and compatibility; StableMind rejects any attempt to treat framework-supplied authority claims as delegation.
Boundary: agent identity and framework metadata remain inputs, not authority.
02 · Source-backed quickstart
client, _ := actiongate.NewClient(baseURL, workspaceToken, apiVersion)
session, _ := client.OpenSession(ctx, actiongate.SessionRequest{
RequestID: "req_01", IdempotencyKey: "req_01",
AgentID: "agent_demo", EnvironmentID: "shadow",
RuntimeInstanceID: "runtime_01", RuntimeClass: "CUSTOM",
FrameworkProfileID: "custom-go", FrameworkVersion: "1",
AdapterVersion: "1", ToolManifest: tools,
})
request, _ := actiongate.PrepareAction(session, "act_01", "supplier.update", args)
decision, _ := client.Evaluate(ctx, request)
// decision.Executed must remain false.client = ActionGateClient(base_url, workspace_token, api_version)
session = client.open_session(SessionRequest(
request_id="req_01", agent_id="agent_demo", environment_id="shadow",
runtime_instance_id="runtime_01", runtime_class="CUSTOM",
framework_profile_id="custom-python", framework_version="1",
adapter_version="1", tool_manifest=tools,
))
request = prepare_action(session, "act_01", "supplier.update", args)
decision = client.evaluate(request)
# The SDK never executes the underlying tool.const client = new ActionGateClient(baseUrl, workspaceToken, apiVersion);
const session = await client.openSession(await prepareSession({
request_id: "req_01", agent_id: "agent_demo", environment_id: "shadow",
runtime_instance_id: "runtime_01", runtime_class: "CUSTOM",
framework_profile_id: "custom-ts", framework_version: "1",
adapter_version: "1", tool_manifest: tools,
}));
const request = prepareAction(session, "act_01", "supplier.update", args);
const decision = await client.evaluate(request);
// A decision is not execution capability.The snippets mirror the existing source APIs but intentionally omit installation commands. SIO26 does not claim that these SDKs are already published to public package registries. The sealed source tree contains the SDK implementations and their tests; public distribution is a separate release fact.
03 · Developer surface
Open an attributable agent/runtime session with a non-secret tool manifest. Session provenance, runtime class, adapter version and tool digest help make the request explainable without creating machine authority.
Submit one exact semantic tool-call intent for deterministic evaluation. Streaming, background execution, nested-agent shortcuts and framework authority claims are rejected by the current source-backed SDK helpers.
Bind execution later to a nonce, deadline, idempotency identifier, semantic action and deterministic receipt. Connectors are downstream of permits and cannot broaden the upstream decision.
Credential material is forbidden from SDK metadata and action arguments. JIT credential release belongs to Credential Broker after authority and permit eligibility, not inside application code examples.
Execution receipts can be appended to attributable evidence, but an executor cannot self-certify the final consequence. Independent verifier observations remain distinct from connector success.
The repository includes OpenAPI governance and JSON-schema contracts for registering and validating external API surfaces. Schemas constrain shape; they do not authorize calls.
04 · Implementation order
Expose a visible, non-credentialed tool schema and the exact semantic action the agent intends to request.
Submit the semantic request with attributable runtime/session context. Do not execute optimistically while governance runs.
If the core decision allows the effective request, a separate permit service may create an exact, short-lived Action Permit. An SDK decision object is not that permit.
Only then may a certified connector receive bounded capability, emit a receipt, and hand evidence to independent verification.
05 · What code must never do
Tokens, passwords, API keys, private keys and credential material are rejected from the request surfaces the SDK can inspect. Examples should use references or deployment-time secret injection, never committed secrets.
SSO roles, cloud IAM roles, framework identity, tool registration, connector installation and successful API reach are not delegated machine authority. The source of power must remain explicit and independently resolvable.
A 200 response, connector side-effect ID or execution receipt is evidence of an executor report. It cannot become independent Proof of Consequence without postcondition observation by a distinct verifier.
06 · Failure semantics
StableMind SDK helpers expect attributable request identifiers, explicit tool names, structured arguments, active sessions and consistent idempotency. If the request cannot be normalized safely, the developer path should stop before ActionGate receives a misleading intent. A retry should preserve the same semantic consequence rather than quietly becoming a different action.
The SDKs scan metadata and arguments for common credential material, including authorization headers, API keys, access and refresh tokens, passwords, private keys, cookies and credential-like fields. That is a developer guardrail around request construction, not a replacement for vaulting or Credential Broker. Secrets belong in the downstream capability boundary, after authority exists.
The governance client treats a decision response that claims the SDK executed the action as invalid. That property matters because developer convenience often pressures systems to combine evaluation and side effects. StableMind keeps those responsibilities apart so decision replay, audit, revocation and evidence can remain attributable.
The sealed source includes shared contract vectors and language-specific tests. Before any customer environment is connected, developers can exercise canonical JSON normalization, credential-material rejection, tool-manifest digest behavior and connector framing locally. A passing local test proves only conformance to the tested source contract.
Source code in this build is not the same fact as a package published to npm, PyPI, a Go proxy, a hosted developer cloud or a production API endpoint. SIO26 deliberately documents the programming model without inventing a distribution channel. When public packages or hosted endpoints exist, they require their own attributable release and availability evidence.
07 · Source lineage
SIO26 is grounded in the ActionGate 1.3.0 Go/Python/TypeScript SDKs, the Connector SDK protocol and vectors, framework examples, REST/OpenAPI governance, MCP governance, Connector Host, Connector Certification and the SIO25 Integration Studio catalog. It claims source-backed engineering availability only. It does not claim public package-registry availability, customer adoption, a live developer cloud, production API uptime, external vendor certification, customer execution, revenue, or realized value.
Enterprise evaluation
Use the source-backed Enterprise Evaluation Room to review security, architecture, deployment, procurement, evidence and pilot design without turning evaluation completeness into production proof.
Open Enterprise Evaluation