Architecture
Daevix is one dvx binary split into two planes. The controlplane handles
identity, policy, and audit and never sees sovereign data; the enclave is the
sovereign data plane that runs inside the customer’s Kubernetes — sovereign data
never flows to the controlplane, and the sovereign path never depends on it (the
broker pulls desired state; nothing is pushed in). A lint-enforced import fence
keeps the two from ever depending on each other. The published architecture docs
go deeper on the overall shape and on how agent identity is attributed rather
than held.