Bernato

Tutorial · Published 26 August 2026

Deploying a Bernato evaluation node from source

A qualification-aware walkthrough for building the CLI, defining local authority, starting the supervised node, and verifying denial paths.

Start from a pinned checkout

Use the toolchain versions recorded by the repository, inspect the release and security documents, and run the credential-free quick gate before installing anything as a user service. Until the release matrix qualifies a binary, build the CLI from the exact source revision you reviewed.

Keep the evaluation node separate from production credentials and repositories. Start with a disposable repository whose failure has no external consequence.

cd runtime/cli/bernato
go test ./...
go vet ./...
go build ./cmd/bernato

Define authority before login

Create explicit project mappings and executable allowlists. Never use ambient PATH lookup, a free-form shell command, or a directory supplied by the broker. Validate that the configured repository and executable resolve to the intended regular files with the expected permissions.

Configure the absolute WSS endpoint and confirm outbound TLS validation. Do not open a firewall port for Bernato.

Exercise the local workflow

Run one task in the disposable repository, inspect the detached worktree, attach to its persistent terminal, stop it, and confirm teardown. Start the loopback IDE and verify it is unreachable from the LAN interface.

Search the generated receipt and shared Markdown memory for tokens, terminal transcripts, and executable instructions. Their presence is a failure, not useful observability.

Prove the denial paths

Attempt an unknown project, a path escape, an unapproved executable, a replayed message, an oversized frame, and an interrupted workspace creation. The node should reject or recover without leaving an ambiguous session.

Only after the exact operating system, provider, artifact, and broker rows are qualified should this evaluation be converted into a supported deployment claim.

Production checklist

← Engineering