> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# The Keystone SDK

> algovoi-keystone is the umbrella install: the connector builder, the agentic behaviour layer and the keystone command line in one place. Apache 2.0.

`algovoi-keystone` is the whole Keystone bolt-on toolchain in one install and one command. It pulls the
connector builder ([keystone-connect](/keystone-connect)) and the agentic behaviour layer
([keystone-agent](/keystone-agent)), re-exports both from a single import, and ships the `keystone`
command line. Everything still reduces to one primitive,
`ref = "sha256:" + SHA-256(RFC 8785 JCS(payload))`, with no AlgoVoi software in your trust base.

<Note>
  Install it from the Keystone control panel: the integrity path, from the AlgoVoi index baked into the
  installer, so you run the validated build. New releases land on the AlgoVoi index first; PyPI mirrors
  follow for those not using the panel. One install brings connect, agent and the CLI together.
</Note>

## Install

```bash theme={null}
pip install algovoi-keystone
```

CPython 3.10 to 3.13 on Linux (x86\_64 / aarch64) or Windows (AMD64). Prerequisites, the AlgoVoi-index
integrity path, control-panel setup, and `keystone doctor` verification are documented once on the
[Keystone install hub](/keystone#install-and-run).

## One import surface

```python theme={null}
from algovoi_keystone import connector, rule, trigger, behaviour, Engine, keystone_ref, behaviours

keystone_s3 = connector("s3", writes={"put_object": ("put", lambda c: c.kwargs["Bucket"])})
engine = Engine([behaviours.cap_charges(500)], decision_ref=decision_ref)
```

Connectors, rules, behaviours, the `Engine`, the ready-made `behaviours` library, and the primitive
all come from the one module, so there is nothing to wire together.

## The `keystone` command line

| Command                                                  | What it does                                                     |
| -------------------------------------------------------- | ---------------------------------------------------------------- |
| `keystone new <name> --kind connector\|behaviour\|stage` | scaffold a publishable bolt-on, wired to the conformance battery |
| `keystone test [path]`                                   | run the bolt-on's tests                                          |
| `keystone validate <records.json>`                       | verify emitted refs offline                                      |
| `keystone doctor`                                        | check the environment                                            |
| `keystone info`                                          | show installed pieces and the primitive                          |
| `keystone journal <db> --show`                           | verify (and list) a [runtime journal](/keystone-runtime)         |
| `keystone publish [path]`                                | build the dist and check it (mirror-first)                       |

### From nothing to tested in one step

`keystone new` writes a complete package, already wired to the check battery, so a bolt-on is green
before you touch it:

```
keystone new redis-stream --kind connector
cd redis-stream/python
keystone test        # recompute, decision-bound, tamper-evident all pass
```

Then edit the one connector spec in the generated module, and publish it per
[Publishing a Keystone bolt-on](/publishing-bolt-ons). Coverage of new data planes becomes the
ecosystem's job, not a bottleneck.

### Verify any record offline

`keystone validate` recomputes the reference in each record from its own fields and reports any that
do not match, whether it is an `execution_ref` from a connector or a `behaviour_ref` from the agent
layer:

```
keystone validate records.json
  [ok]   record 0 [behaviour_ref] content-addressed
  [ok]   record 1 [execution_ref] execution record
=> PASS
```

A mutated field breaks the reference and the command exits non-zero, so this drops straight into CI.
Any third party runs the same check with a stock RFC 8785 implementation and standard SHA-256.

### Check your environment

```
keystone doctor
  [ok]   rfc8785 (RFC 8785 JCS) importable
  [ok]   keystone_ref canonical + deterministic (key order independent)
  [ok]   algovoi-keystone-connect importable
  [ok]   algovoi-keystone-agent importable
  [ok]   AlgoVoi index reachable
=> PASS
```

## Where to go next

* Build a connector or test any bolt-on at any stage: [Build a bolt-on](/keystone-connect).
* Govern an agent with rules, behaviours and triggers: [Agent behaviours](/keystone-agent).
* The connector catalogue and the chain: [Connectors](/keystone-connectors), [Keystone](/keystone).