Java SDK

Use com.veriproof:veriproof-sdk-core for application-owned actions. Add the Enforce adapter for each framework your application uses.

Govern one action

In the customer portal, open Tools and SDKs. Select your language and adapters, then follow the installation instructions shown there.

VeriProof SDKs are distributed through customer-gated GitLab packages, not public registries. See SDK access for workstation and CI guidance.

VeriProof packages used here: com.veriproof:veriproof-sdk-core, com.veriproof:veriproof-sdk-adapter-spring-ai.

Store the application SDK key as VERIPROOF_API_KEY, then create one client:

try (var veriproof = Veriproof.fromEnvironment()) {
    var result = veriproof.govern(
        "contract.answer",
        request,
        context -> {
            context.throwIfStopped();
            return answerContract(context.input());
        }
    );
}

The core SDK checks the input before it calls answerContract. It checks output before release through the typed result.value() boundary.

Only completed, completed-with-warning, and transformed results can contain a released value. Pass the governed context’s stop signal into child work. Never release a value from a blocked result, which the portal shows as Stopped by policy. Use the typed status, safe message, reason code, and evidence reference to handle results without a value.

Handle a stop

Pass the governed action context into child work. Call context.throwIfStopped() immediately before each protected side effect.

A live Stop directive applies only to its matching run or application. The SDK signals the action before it acknowledges the directive. It does not terminate the Java process. Reconcile the side effect when the result reports uncertain completion.

Use typed industry values for shared business terms and facts for application-specific rule data. The active field contract checks required fields, types, and allowed values before protected work begins.

Continue after human review

Save the review checkpoint in the provided SQLite protected workflow store or an application implementation of the review-store contract. Verify signed callback bytes before parsing. A worker can then resume the saved checkpoint with a rebuilt protected callback.

Core Human Review uses a 12-field bounded brief and a response and resume-mode matrix. route_to_revision starts application-owned revision work and never runs the superseded payload. Private-note content remains in VeriProof and is excluded from the callback.

The hosted Server Ingest path is the default. Set VERIPROOF_EDGE_ENDPOINT for a licensed Edge Gateway.

See Core Human Review for the lifecycle contract and the runnable Java receiver guide for callback hosting.

Framework adapters

Add the Enforce adapter for each framework your application uses. Checks names the operation the adapter controls. Put the core SDK’s governed action around anything under Not covered.

See the package catalog and Java release notes.