burstdocsBurst web ecosystem
The owner has reserved goburst.app, goburst.dev and goburst.network. Their sibling project directories were empty when inspected on 2026-10-29. The three frontends are now implemented and staged under burst-kit/web/, with standalone build artifacts in web/dist/. The authenticated application is embedded in the Go control service. No sites have been deployed.
Domain responsibilities
| Domain | Role | Implemented surface |
|---|---|---|
| goburst.network | Public ecosystem, project information and capability showcase | Explain Burst, map its nine components, show architecture and link to accurate demonstrations and implementation status |
| goburst.dev | Developer documentation and tools | Quickstart, deployment guides, identity setup, API reference, Starburst examples, SDK guidance and troubleshooting |
| goburst.app | Authenticated product workspace | Network/space navigation, node enrollment, groups/grants, policy publication/simulation, encrypted objects, maintenance and diagnostics |
The roles implement the owner-approved domain split. Use shared branding, navigation and terminology across the three projects. Keep implementation status explicit: live integrations, synthetic demonstrations and unimplemented capabilities must be distinguishable.
Visual direction
Owner direction: orange, white, black and reddish accents.
Use an industrial, editorial style: large confident typography, strong rules, precise topology graphics and dense but legible operational views. A distinctive radial burst motif can connect the public sites and application. Avoid decorative dashboard data that could be mistaken for actual network telemetry.
| Token | Color | Use |
|---|---|---|
| Orange | #FF6A1A | Primary actions, active navigation and brand marks; near-black text on orange |
| White | #FFFFFF | Documentation, reading surfaces and high-contrast text |
| Paper | #FFFAF5 | Warm secondary reading surface |
| Near-black | #101010 | Main text, application shell and showcase backgrounds |
| Ember red | #D84432 | Destructive actions, errors and urgent states; pair with text/icon labels |
| Dark orange | #B33B00 | Links and small accent text on light surfaces |
The implemented typography uses Big Shoulders for display, Instrument Sans for product/reading text and IBM Plex Mono for code. All fonts and their SIL license notices are self-hosted. Shared CSS tokens live in web/shared/burst.css. White text on bright orange is not the default button treatment. Verify contrast on actual rendered surfaces. Use visible keyboard focus and reduced-motion preferences throughout.
Application identity and security
burstauth is the OIDC relying party and grant engine. It does not issue identities as an OIDC provider. The rich application must use a configured real provider, the existing server-side session/PKCE/CSRF flow and authoritative grant checks.
Serve the application and its backend-for-frontend under goburst.app so sessions remain host-only. Public documentation/showcase sites link to sign-in; they do not receive session cookies. Do not broaden cookie scope to .goburst.app or try to share cookies across the three different registrable domains.
Every operational view must use authorized APIs. Hiding a control is not an authorization boundary. Show loading, empty, denied, expired, degraded and error states. Surface request IDs on failures without exposing secrets or payloads. Retain source signing outside the browser and never upload private signing keys.
The backend now exposes current network/space capabilities and keyset-paginated nodes, objects, groups, grants, policy metadata and audit catalogs. Authorization and metadata/data separation have dedicated integration tests. Additional detail and application scheduling APIs remain future work. Application execution must reflect its actual offline-worker and scheduling limits until service access and control-plane scheduling are implemented.
Delivery sequence
- Shared visual tokens, navigation and responsive layouts.
- Public project/ecosystem pages and documentation sourced from implemented APIs.
- Real OIDC sign-in and an authenticated application shell.
- Network/space, identity/grant, policy and encrypted-object workflows.
- Node operations, durability/reconciliation views and clearly labeled demos.
- Browser acceptance, accessibility, provider interoperability and deployment.
This extends today's component completion work. The domains do not resolve the remaining relay, scheduler, recovery or production acceptance requirements.
Verification for the web increment
The build generates 25 documentation pages, a local search index, three static artifacts and a hash manifest. The application uses real same-origin APIs with host-only sessions, CSRF headers and stable mutation retry identities. No demo login, private signing key upload or static admin token is provided.
Node checks cover artifact hashes, internal links, documentation escaping, bounded request handling, sessionless mutation denial, safe errors, retry identity and preview-server boundaries. Go integration checks cover catalog permissions, metadata separation, keyset pagination and protected embedded assets.
Browser fixture QA is provided in web/qa-browser.mjs and configured as a CI job. No browser is connected in this session, and local Chromium aborted at launch. Visual/interaction QA and real-provider browser acceptance are therefore pending. The local acceptance command passed web checks, race/vet across all nine Go modules, all six executable builds/hashes and policy CLI smoke checks. The sibling domain directories remain untouched because the workspace cannot write outside burst-kit.