burstcontracts

Immutable signed policy descriptors, publication verification, activation-revision guards and authenticated object encryption envelopes. The core control service persists/activates versions and enforces policy results; Starburst executes policy code.

The burstpolicy command generates private Ed25519 keys, exports public registrations and signs source-bound publication JSON. It never sends private keys to the server. AES-GCM object keys are independently generated, scoped with authenticated data and wrapped separately from peer ciphertext.

Run go test -race ./...; see ecosystem setup. Signing encoding is provisional Go JSON; cross-language signing envelopes, richer obligations and a staged approval workflow remain pending.

Object encryption supports KeyWrapper custody adapters. The local adapter preserves existing envelope bytes. The Vault Transit adapter sends only random per-object keys to the external service over HTTPS, binds them with AEAD associated data, rereads its token for each call and refuses redirects. It does not export or create the provider's wrapping key. Provider failures deny access; there is no local fallback. Metadata pins the custody identity; switching an existing store requires a separate explicit rewrap/migration design.

Configure burst -vault-address https://VAULT -vault-transit-key objects -vault-token-file /private/agent-token instead of -object-key-file. Provision an aes256-gcm96 Transit key and update-only access to its encrypt/decrypt paths. The service performs wrap/unwrap and wrong-scope startup probes. Use system TLS trust for the Vault endpoint; never disable certificate verification.

API fixtures verify the adapter and failure behavior. Live Vault deployment and key-rotation acceptance remain separate checks. See Vault Transit API.