BurstConnect

Scoped HTTP reachability over outbound agent connections. Agents initiate TCP connections to a control endpoint and call ServeAgent; the control listener calls Broker.AcceptAgent. TLS 1.3 authenticates both ends with the existing burstsecurity.PeerProfile exact SPIFFE identity and chain validator. The HTTP server runs on the agent side of that outbound connection.

A trusted host maps enrolled nodes to network/space/service routes and expected certificate identities. The injected Authorize callback checks current node membership (connect) and caller grants (invoke) with the authenticated actor in context. Both checks run again at dispatch. Request headers cannot select a route or confer authority. Ambient authorization/cookies are removed before forwarding. Offer is a lower-level API for already authenticated host transports.

Connections serve one request, preventing transparent retries of executed work. Hosts provide reconnect/backoff and enrollment lookups. Each route accepts eight idle connections, with at most 1,024 pending routes; idle I/O expires after one minute. Requests have a 30-second default deadline, or a caller deadline capped at one hour. Always close response bodies and the broker.

This is a library integration, with no public control listener, automatic reconnection, service catalog, relay discovery, arbitrary TCP forwarding or NAT hole punching daemon. The existing Burst control API is not wired to it yet.

sh ../scripts/test-distributed.sh runs scope/revocation tests and real mutual-TLS handshakes over in-memory connections, including incorrect-peer rejection.