REST Gateway integration guides

These guides cover the programs that integrate with the REST Gateway, and the operator's setup they start from. The programs use only the Gateway's published /api/v1 contract (see the API Reference). None of them needs a native SDK. The integration starter and the workflow adapter come in two editions, with the same behaviour and the same configuration file: the Python edition needs Python 3.10 or newer and one OpenSSL executable; the TypeScript edition needs Node.js 22.18 or newer and nothing else. The MCP server is Python.

Guide	What it is
Python integration starter	a standalone example for an application developer. It covers certificate login, DPoP on every request, and delegated sessions. It shows selective field sharing, where a recipient reads one field and is refused the other. It also shows that a revoked grant is refused on the session that just used it.
TypeScript integration starter	the same starter for a backend written in TypeScript: the client, the example and the workflow adapter, with no dependencies, run as .ts by Node.js. It reads the Python edition's config.json, so one operator bootstrap serves both.
Workflow access lifecycle adapter	a library a trusted application backend embeds. It ties protected fields, and temporary READ access to them, to one step of a workflow. It ends that access when the step closes, and it recovers from a crash by reading the key server.
Connect an AI agent through MCP	a local MCP server, built on the starter's client, that gives an AI agent only the tools its task grant names. There are three document tools: list the approved documents, read one, and save a result under an existing key. A grant that names one folder may add two file tools: encrypt a file in that folder under a new key, and decrypt one the server encrypted there. The agent never chooses an identity, a key or an address. Every call runs on a scoped, sender-constrained task session, and the key server still decides every decrypt. It is the one part of the starter that needs a package, the MCP Python SDK, installed from a hash lock.
Operator bootstrap	the operator's half of the starter: setting up one Gateway and its key server so the starter can log in by certificate, mint delegated sessions for its own users, and create and remove them.
Importing your own keys	bringing symmetric keys you already hold into the key server, wrapped to its trust certificate or in the clear, each under a hidden link the key server mints. This one is a page, not a program.

Where the code is

The code ships in the Console bundle, under examples/python-agent-starter/ and examples/typescript-integration-starter/. The Linux package and the Windows MSI both carry them. On Linux it is under /opt/pisoft/tricryption/console-gateway/. On Windows it is under C:\Program Files\PiSoft\Tricryption\console-gateway\. Each guide is rendered from the README that ships in that directory, so the page and the copy you install say the same thing.

Start with the starter. Your operator registers your service with the Gateway, and the operator's half of that is the starter's operator bootstrap, the same for either edition. The adapter reuses the starter's client and its config.json.

The time window on the wire

A grant's endTime is the key server's own time_t, sent as base64 of an 8-byte big-endian count of UTC seconds. It is not an ISO date. The adapter's page explains the encoding, with a worked value, in The time window on the wire.