Shatter

Bounded workload dispatch and recovery using Burst's offline execution contract. A host supplies independent, idempotent burstdecentraapp.Workload shards. Each has an immutable image, network/space scope, runtime limits and denied egress. Object grants remain rejected until a policy-aware data broker exists.

Scheduler.Submit validates and journals a shard. Dispatch leases it to one node and executes using either the existing runsc Worker or Remote, which routes HTTP over BurstConnect. Handler exposes a worker on an authenticated agent connection and rejects cross-scope workloads. It must not be exposed as an unauthenticated public HTTP service.

Scheduler.Run waits for abandoned leases to expire and rotates through supplied nodes for at most three lifetime attempts. Hosts can resume it after restart using the same task IDs and journal. Lease duration is workload timeout plus 15 seconds for cleanup/publication. Supply a bounded caller context. A host supervisor decides which shards to run concurrently and supplies enrolled nodes.

The host's current-authority callback runs before leasing, before execution, every second during execution, and before publication or returning a cached result. It must be safe for concurrent calls and honor cancellation. Denial cancels execution. The existing Worker independently rechecks authorization on the execution host. Production callbacks must query authoritative grants and membership; the test callbacks are fixtures, not a control API integration.

Assemble is a privileged local journal read that returns completed outputs in explicit shard order and checks stored SHA-256 hashes. An authenticated API must perform its own read authorization. Hashes establish byte integrity, not honest computation or consensus. Execution errors, nonzero exits, OOM, oversized output and pending cleanup do not publish successful results. Recovery is at least once; side effects require workload idempotence.

Run from the workspace root:

sh scripts/test-distributed.sh

Tests cover three in-memory remote worker routes, expired-worker recovery, supervisor restart, fenced late results, corrupt output, and revocation before retry, during execution and before publication. Executors in these tests are fixtures. Real runsc isolation still requires sh scripts/test-worker.sh on a trusted Linux Docker/runsc host. No deployment, automatic shard compiler, distributed filesystem, data broker or control API scheduling is implemented.