Component work and test gates — 2026-10-29

This is the execution record for today's component pass. Implemented code is distinguished from live acceptance and the remaining ecosystem work. No full production-completion claim is made.

Component	Changes in this pass	Remaining completion gates
burstlib	Shared resource IDs used by the core; bounded HTTPS JSON transport; protected Prometheus request metrics	Generated typed/multi-language SDKs, OpenTelemetry
burstauth	Current-authority delegated chains; narrower resources/expiry; parent revocation, group removal and deny handling; persisted API/console provenance	Back-channel IdP logout, live provider/browser acceptance
burstsecurity	Validated file credential refresh on each new handshake for nodes/control clients; identity/chain/usage/expiry checks and rollback rejection	Live issuer/SPIRE automation, live trust-root rotation acceptance
burstnet	Chunk-stream storage adapter and client; per-frame TLS/scope enforcement; existing durable immutable writes/tombstones retained	Relay/NAT traversal, discovery/heartbeat automation, public admission
burstrpc	Generated PutChunks/GetChunks services with contiguous 64 KiB frames and bounded deadlines	Resumable transfers, broader control schemas, cross-language compatibility
burstcontracts	KeyWrapper abstraction preserving local envelopes; HTTPS Vault Transit adapter; custody pinning and wrong-scope startup probes	Live Vault/key-rotation acceptance, custody migration/rewrap, portable signing/approvals
starburst	Existing v2 evaluator, signed modules, simulation and planning included in workspace regression checks	Target Linux sandbox acceptance; activated automation executor/editor/module registry remain unimplemented
burstdecentraapp	Offline Docker/runsc backend and burstworker CLI; bounded concurrency/time/output; live authorization rechecks; forced cleanup and retryable cleanup reporting	Live runsc isolation test, control API scheduling, service identities/data broker, durable crash reconciliation and distributed scheduler
burst	ID/metrics integration; delegated grant UI/API; schema v4 migrations; streaming enabled for production command; local/Vault custody configuration; late-unwrap authorization/expiry checks	Backup/restore with tombstone preservation, HA, quotas/pagination, real-provider UI acceptance, deployment

Local checks

sh scripts/test-today.sh local

The check script runs race tests and vet independently in all nine modules, validates Protobuf schemas when protoc is installed and checks JavaScript/shell syntax. Focused tests cover delegation revocation/discovery; stream scope, offsets, integrity and tombstones over real TLS on in-memory transports; credential refresh; Vault API behavior; external-custody outage/pinning and expiry during unwrap; and worker denial, cancellation, revocation, output and cleanup.

Worker unit tests use a test-only fake Docker executable for lifecycle behavior. Vault adapter unit tests use an in-memory HTTP transport and real local wrapping crypto behind the API fixture. Neither proves a deployed runtime/provider.

The full local race/vet suite passed across all nine modules after the component changes. The initial concurrent build/check run hit a policy-worker startup deadline; the isolated rerun passed without changing execution budgets. sh scripts/test-today.sh local subsequently passed end to end, including all six executable hashes, version checks and the policy/automation CLI smoke tests. Additional delegation-depth and streaming caller-role regressions passed with the race detector after that run.

Live acceptance commands

# Trusted Linux Docker host with runsc registered and cgroup limits enabled:
sh scripts/test-worker.sh

# Existing HTTPS Vault deployment and preprovisioned Transit AEAD key:
# Set BURST_TEST_VAULT_ADDRESS, BURST_TEST_VAULT_KEY,
# and BURST_TEST_VAULT_TOKEN_FILE to a private agent-token file.
go test -race ./burstcontracts/... -run TestLiveVaultTransit -count=1

# Disposable PostgreSQL cluster for runtime schema v4 and the full lifecycle:
sh scripts/test-runtime-postgres.sh

# Run local gates plus configured live worker/Vault/PostgreSQL checks:
sh scripts/test-today.sh all

Native socket mode is selected with BURST_TEST_NATIVE_SOCKETS=1 on a host that permits listeners. This sandbox rejects native listeners, PostgreSQL shared-memory allocation and Docker daemon access. A disposable PostgreSQL attempt failed at initdb with shmget: Operation not permitted; no server started. The new schema v4, Vault integration and worker changes therefore still need the corresponding live acceptance runs. Existing live Linux/PostgreSQL results in implementation-status.md describe earlier increments.

Publication

sh scripts/release-check.sh remains a static prerequisite gate. Namespaces, published sibling dependency versions and licenses are still unresolved. Nothing in this pass creates repositories, publishes artifacts or deploys services.

Web ecosystem extension

web/ contains the three domain projects and a shared orange/white/black/red visual system. The build emits 25 documentation pages, a search index, standalone site artifacts and the application assets embedded in Go. New authenticated catalogs cover nodes, objects, groups, grants, policies and audit with keyset pagination and current-authority checks. The console exposes the real backend workflows and explicitly identifies offline-only application execution.

Thirteen Node checks pass for build artifacts, links, request security/retries, escaping and preview boundaries. Focused Go race checks pass for catalog isolation, data/metadata separation, pagination and embedded CSP/assets. Browser interaction/visual acceptance remains blocked by browser availability; web/qa-browser.mjs and the web-browser CI job provide a repeatable fixture suite. No sites were deployed or sibling project directories modified.