# EcoKure integration starter kit

This kit is the customer-facing starting point for a bounded pilot. It describes
the seam between an existing AI or operational workflow and the EcoKure
assurance boundary.

## Start here

1. Choose one workflow with a named owner and explicit exclusions.
2. Request a tenant-scoped API key from an authorised EcoKure operator.
3. Store the key in the customer secret manager; it is shown once and never
   belongs in a browser bundle, URL or source repository.
4. Verify the key with `POST /api/access/verify`.
5. Send only the fields required by the agreed Control Pack.
6. Retain the returned decision and EvidencePack reference in the customer
   boundary.

## Included contracts

- [`openapi.yaml`](openapi.yaml) — pilot API surface.
- [`control-pack.schema.json`](control-pack.schema.json) — versioned customer
  rules, evidence requirements and reviewer ownership.
- [`evidence-pack.schema.json`](evidence-pack.schema.json) — signed, replayable
  result envelope.
- [`webhook-events.md`](webhook-events.md) — optional event delivery shape.
- [`../../examples/ecokure-integration/`](../../examples/ecokure-integration/)
  — minimal Python and curl examples.

The public demo uses synthetic data. Production endpoints, signing custody,
retention, SSO and tenant isolation are agreed and validated during the
customer-controlled pilot; these examples do not claim production readiness.

For a no-credential walkthrough, use the public synthetic fixture only:

```bash
curl -X POST "$ECOKURE_BASE_URL/api/biochangegate/demo-run"
# Or download the same signed fixture for offline verification.
curl -fsS "$ECOKURE_BASE_URL/evidence-pack/demo.json" -o evidence-pack-demo.json
```

The demo responds with a signed, independently verifiable EvidencePack and
explicitly marks its records as synthetic. It contains no customer data and
must never be used as a production workflow. There is deliberately no shared
"sandbox key": production-style credentials are tenant-scoped, issued once by
an authorised operator, and transferred through the customer-approved secret
channel.