Message Broker route and auth compatibility matrix.

Matrix Snapshot

Matrix rows

17

Status values

6

Auth modes

4

Audience

Use this matrix when deciding whether a Message Broker route family, auth mode, replication surface, queue behavior, CLI/SDK path, or Kafka compatibility statement is active private beta behavior, locally bounded, unsupported, preview-only, future-facing, or still waiting on product confirmation.

Readiness Notes

Compatibility Scope

Status Legend

Route And Auth Matrix

Message Broker route, auth, queue, replication, and protocol compatibility rows

Capability	Status	Maturity	Notes
Health readiness route	Supported	Private Beta	GET /health is public and reports readiness, storage, release metadata, and configured security posture without exposing credentials.
Runtime auth modes	Partial	Confirm First	insecure-local, api-key, mTLS trust-file, and trusted-header external modes are documented; mTLS and external modes rely on a trusted upstream.
Stream management routes	Supported	Private Beta	PUT /v1/streams/{stream}, GET /v1/streams, and GET /v1/streams/{stream} are implemented with create, list, and describe permissions.
Versioned publish and replay routes	Supported	Private Beta	POST and GET /v1/streams/{stream}/records support single-record publish and bounded replay by offset or time selectors.
Cursor and consumer-group inspection	Supported	Private Beta	Consumer group, cursor list, lease list, delayed retry, replay-consumer, cursor commit, and cursor rewind routes are implemented.
Shared queue claim and delivery mutation	Supported	Private Beta	Queue claim, ack, nack, renew, retry, and dead-letter routes persist delivery state and recover payloads from SegmentStorage.
Audit query/export and metrics scrape	Partial	Private Beta	Audit routes are administrator-only and tenant-filtered in protected modes. Metrics are available only when HTTP metrics exposure is enabled.
Storage administration inspection	Partial	Private Beta	Storage routes expose catalog, retention dry-run, tiering readiness, archive manifest, and quarantine inspection; they do not move, delete, upload, archive, or compact data.
Replication status and worker control	Partial	Confirm First	Status, poll, pause, and resume routes exist, but worker actions require configured bindings and do not by themselves prove cross-site outcomes.
Replication target apply	Partial	Confirm First	POST /v1/replication/target/apply accepts bounded target batches, but target-environment proof and accepted gaps are still required for stronger claims.
Tenant visibility, RBAC, and quota boundaries	Confirm First	Confirm First	Tenant-scoped stream visibility, auth policy, quota accounting, metrics labels, and audit filtering need security and operations acceptance before stronger wording.
Remote CLI management reads	Partial	Private Beta	Remote CLI can call HTTP health, management inspection, and diagnostics routes over http:// targets; remote data writes and mTLS credentials are outside current CLI transport.
Rust SDK HTTP workflows	Partial	Private Beta	HttpNativeClient covers publish, replay, cursor, and queue helpers for http:// targets but does not inject runtime credentials without caller-provided transport behavior.
Compatibility adapter harness	Preview	Preview	Native, HTTP, and Kafka-shaped scenario harnesses are contract and fixture evidence for produce, consume, cursor, offset, and unsupported-feature behavior.
Kafka-shaped migration prototype	Preview	Preview	KafkaCompatibilityAdapter maps typed produce, fetch, and offset commit requests to the native in-memory broker. It is not a network listener.
Kafka network listener and external Kafka clients	Unsupported	Confirm First	There is no current Kafka network listener, Kafka wire-protocol compatibility, or external Kafka client smoke evidence.
Future protocol compatibility expansion	Future	Future	Real Kafka protocol work or additional broker protocols remain future roadmap direction until a listener, client smoke evidence, and product confirmation exist.

Current Limits

Explicit Exclusions

General broker replacement wording, production support, performance, scale, security, availability, direct identity-provider validation, strict cross-site durability, failover, Kafka wire-protocol compatibility, and customer commitments are outside the active private beta route surface described by this matrix.

Source scope

Internal public documentation boundaries track this Message Broker compatibility matrix and the review note required to change row status.

Limits

This matrix covers current Message Broker route, auth, CLI, SDK, and compatibility-scope documentation only. It does not approve broad support, security, performance, scale, availability, direct identity-provider, strict replication, failover, or Kafka network listener claims.

See the HTTP reference for route behavior and the CLI and SDK reference for tooling boundaries.

Safe Next Steps

• 

  Available

  Run stream and queue quickstart

  Exercise stream create, publish, replay, queue claim, ack, inspection, and the local replication boundary.

• 

  Available

  Read HTTP reference

  Use route shapes, auth requirements, examples, errors, and limits behind each matrix row.

• 

  Available

  Read CLI and SDK reference

  Check lifecycle flags, diagnostics, remote CLI limits, SDK HTTP boundaries, and queue helper coverage.

• 

  Available

  Review Message Broker limits

  Check source records before expanding auth, tenant, replication, protocol, support, security, or operations wording.

• 

  Available

  Read known limits

  See unsupported Kafka listener behavior, replication outcome boundaries, auth posture, and remote CLI limits.

• 

  Available

  Compare compatibility model

  Use the workflow for stale-row checks, status-note refresh, owner review, and release-note updates.