API, SDK and yCode

Authorized integrations use versioned Yasnora APIs and SDKs. Pass identity and policy context and request logical capabilities rather than hard-coding a physical provider.

For streaming, distinguish partial data from the final result and handle finish, cancel, errors and usage. Do not treat a dropped stream as successful completion or retry a write blindly.

Use the API contract and SDK version approved for your deployment. Propagate tenant, workspace, subject, role, locale and request ID. Set bounded timeouts and cancellation; use idempotency for writes. Handle Retry-After and safe retries with jitter; refresh an expired session and retry only once.

Only the local test source has self-service setup. External Business sources require administrator configuration of a fixed endpoint, server-held credential, read-only scope and approved pilot before use; a catalog entry is not an active connection.

Credentials must remain in the authorized secret boundary, outside prompts and browser-visible output. A failed synchronization does not justify granting broader access.

yCode works on explicitly selected repositories in isolated runs. Supported web, desktop, editor and command-line surfaces share scoped identity and review requirements.

A prompt alone does not grant permission to push, merge, delete or read unrelated paths. If authentication fails in a desktop client, check the browser callback and client session.