burstdocsV1 implementation status
Updated 2026-10-29. The local ecosystem now spans identity, authorization, signed policy execution and encrypted three-node storage with repair/expiry. It is still a development slice, not nine completed production products. See ecosystem setup and API, identity setup, and troubleshooting.
Component status
| Component | Implemented | Still needed |
|---|---|---|
| burst | Console/control APIs, durable groups/grants, staged encrypted objects, reconciliation, SQLite/PostgreSQL adapters, audit/outcomes, diagnostics | Production operations, broader pagination/quotas, live Vault/provider/browser acceptance, restore/HA |
| burstauth | OIDC relying party, default-deny grants, bounded delegated provenance; core persists groups/grants/revocation | Back-channel identity-provider logout and live provider acceptance |
| burstsecurity | CSR/key validation, peer profiles, development signing boundary, renewal, managed-certificate attestation/refresh, trust-bundle support, validated file credential refresh | Live issuer/Workload API automation, production key custody and attestation deployment |
| burstnet | Membership/placement, capacity-aware control directory, immutable ciphertext store, authenticated gRPC node command/client, chunk streams | Relays, NAT traversal, discovery/heartbeat automation and public participation |
| burstrpc | Versioned context, generated Protobuf/gRPC storage API and pinned generators | Broader control-plane RPC schemas, resumable transfers and SDK compatibility matrix |
| burstcontracts | Signed descriptor verification, activation guards, scope-bound AES-GCM envelopes, local/Vault key custody; core persists immutable policy versions/obligations | Cross-language signing envelope, approval workflow, richer lifecycle obligations |
| starburst | Pinned interpreter, v1 compatibility, v2 authority context, bundled modules, inspection CLI/API, bounded automation proposals, strict decisions and isolated process worker | Target-host security review and broader language/API evolution |
| burstdecentraapp | Admission and bounded offline Docker/runsc worker, local CLI, cancellation/cleanup | Live sandbox acceptance, distributed scheduling, service credentials/data broker, durable reconciliation |
| burstlib | Tenant scope, shared IDs, bounded HTTP JSON client, logging/diagnostics and Prometheus metrics | Generated typed SDKs and OpenTelemetry integration |
Scope and authority
The six prior roadmap steps were extended with build/release preparation and troubleshooting as areas 7–8. The ecosystem guide maps each area to code and limits. Private operator-managed networks remain the working default; no public peer admission or new consensus protocol was added.
Permission and group state is read from transactional authority on each request. Explicit deny overrides allow. Root grants require a network operator. Delegated allows require a currently held delegable parent, matching action, equal/narrower resource and expiry, and at most eight delegation hops. Operators or original issuers may revoke grants. Current parent state and issuer group membership are rechecked on each authorization. Data-read authority is never inferred from a certificate, network operator status or possession of ciphertext.
Policies have immutable signed source versions and static storage obligations. Updates can shorten existing retention but cannot extend it. Upload visibility requires all required acknowledgments plus commit-time checks. Reads fetch verified ciphertext before a fresh authorization/key-release transaction. Expiry destroys the active wrapped-key reference and queues physical deletion; unavailable peers retain pending obligations. Old metadata and peer tombstones are not garbage-collected in this slice.
Persistence and publication
SQLite schema versions 1–3 upgrade to version 4, preserving owner authority through explicit bootstrap grants. PostgreSQL uses the separate burst_runtime_v1 runtime schema and explicit migration. It does not use the earlier planning prototype. Its initial transaction adapter deliberately serializes metadata using a DB advisory lock; it is not a scaling/HA design.
Build/release tooling produces six executables and a hash manifest. The publication gate remains blocked on provisional burstkit.dev namespaces, local sibling replacements and unselected licenses. No repository was created/pushed and no service was deployed.
Verification
The local race/vet suite passes across all nine modules, including signed OIDC fixtures and real HTTP/TLS over in-memory connections. Protobuf generation/compilation, JavaScript/shell syntax, executable builds and checksums are checked. Tests cover groups/member removal, grant revocation, certificate renewal, managed enrollment without signing keys, three-node encrypted replication, degraded durability/replacement repair, corruption, scope/role/path/digest denial, authority loss, retention non-resurrection, stale uploads, staged cleanup and expiration/deletion.
Linux Go 1.25 race tests and vet passed across all nine modules, including PostgreSQL 16 adapter and worker checks. Native TCP/TLS control/data suites passed with SQLite and PostgreSQL. The full PostgreSQL-backed suite passed on Linux Go 1.27.3, including all object, policy, reconciliation, identity, restart and rollback tests; it was repeated to check stability. A Go 1.27 virtual-address reservation issue was fixed while retaining separate writable-data and CPU caps. Two hundred worker startup probes and the repeated hard-limit regression passed.
Source/dependency mounts were read-only, PostgreSQL used temporary memory-backed storage, no host ports were published, and the dedicated containers/network were removed after testing. macOS race/vet checks also passed with in-memory transports and explicit soft-memory development mode. Dependency checksums, generator output, CLI key/signing behavior and binary manifests were verified.
Real-provider/browser automation, live SPIRE deployment and production rollout are not claimed. The OIDC provider remains a signed test fixture in both transport modes.
Operational acceptance still needs live identity-provider/issuer integration, backups with tombstone replay, recovery targets, production role/RLS design, secret custody, load/capacity measurements, app-worker isolation and deployment testing. No full V1 delivery milestone is declared complete.
Starburst v2 increment
The v2 guide documents authority-owned classification/groups/node capabilities, signed module bundles, simulation and automation proposals. Automation does not execute effects. New regression and race/vet checks run locally; Docker access is denied in this session, so the new schema and worker changes have not been revalidated on native Linux/PostgreSQL. The earlier Linux/PostgreSQL results above describe the preceding ecosystem increment.
Component completion pass (2026-10-29)
See component work and test gates for the current pass. New coverage includes delegated-chain API revocation/discovery, TLS streaming framing/scope/integrity, external custody denial/pinning/late-unwrap expiry, credential-file rotation, and offline worker lifecycle/revocation/cleanup. Provider and runtime fixtures are not live deployment acceptance. Native Linux/PostgreSQL, live Vault and live Docker/runsc checks for this increment remain pending until their environments are available.
Web ecosystem increment
Three domain surfaces are staged under web/: the orange/black ecosystem showcase, a searchable developer site with 25 generated guides and API reference, and a rich authenticated console embedded in burst. The console adds current scope permissions, encrypted-object catalogs/actions, policy metadata/simulation, groups/grants/delegation, node enrollment/placement, audit and maintenance views. New catalog endpoints use keyset pagination and current-authority checks. Object metadata visibility never implies permission to read plaintext.
Build/request tests and scoped API integration tests run locally. Browser QA has not passed: no connected browser is available and local Chromium aborts during launch. A pinned Playwright fixture suite and CI job are included; real-provider interoperability, visual acceptance and actual domain deployment remain pending. See the web guide.