Your first Burst network

Burst connects human identity, scoped permissions, signed policy and encrypted storage. This guide starts from an existing Burst Kit workspace; module publication and independent repository releases are still pending.

What you need

Go 1.25 or newer, CGO and a C compiler.
Node.js 20 or newer to build the three web surfaces. No npm dependency installation is required.
A real OpenID Connect provider and a registered confidential client.
HTTPS certificates, an explicit trust bundle and enrolled storage-node identities.
Linux for hard policy-worker resource limits and Docker/runsc workload acceptance.

Build the toolkit

From the workspace root:

sh scripts/check.sh
sh scripts/build.sh dev

The build produces six executables and a SHA-256 manifest under dist/. It also builds the public websites under web/dist/ and embeds the authenticated application in the control service.

Command	Purpose
burst	Identity, control APIs and the authenticated console
burstnode	Authenticated ciphertext storage node
burstpolicy	Generate local signing keys and sign immutable policy publications
burst-policy-worker	Bounded, isolated policy process
starburst	Bundle, explain, simulate and plan
burstworker	Local operator tool for offline Docker/runsc jobs

Configure real identity

Register an OIDC redirect URI matching the control service's external origin and /auth/callback. Keep the client secret outside browser assets. The control service verifies issuer, audience, signatures, expiry, nonce and PKCE.

The console uses host-only server-side sessions. Public documentation and showcase sites do not receive session cookies. There is no fake login or bearer-admin fallback.

Follow the identity setup guide for the complete certificate, provider and control-service configuration.

Connect the storage lifecycle

Sign in and create a BurstSpace.
Enroll three distinct storage nodes and approve each enrollment.
Register their endpoints, capacities and distinct failure domains.
Generate an Ed25519 signing key locally and register its public registration.
Sign and publish a policy requiring the intended replication, placement and expiry.
Upload an encrypted object, grant group access, read it and revoke access.
Exercise repair, expiration and persistent replica deletion.

Keep private signing keys outside the browser. The console accepts only public registrations and signed publication JSON.

The ecosystem guide documents exact commands, APIs, custody configuration and lifecycle constraints.

Run the development gates

sh scripts/test-today.sh local

This runs the module race/vet checks, builds the commands, checks executable hashes and exercises the policy CLIs. Browser interaction and live providers are separate acceptance checks.

# Trusted Linux host with Docker/runsc configured
sh scripts/test-worker.sh

# Disposable PostgreSQL runtime lifecycle
sh scripts/test-runtime-postgres.sh

Read the component test gates before interpreting a local pass as operational readiness.

Understand current limits

The first network is private and operator-managed. Objects are limited to 1 MiB through the control API. Streaming peers use bounded transfers, not resumable large-object storage. Application execution currently has an offline worker; this web console does not schedule jobs or issue application data credentials.

Relay/NAT traversal, distributed application scheduling, backup/tombstone restoration, HA and live deployment acceptance remain unfinished. See implementation status.