Enclaves

The local metadata service

An agent’s only interface to the platform is its local enclave, reached over a unix domain socket mounted into the agent’s container. The socket presents an IMDS-like metadata service (internal/enclave/imds), modeled on a cloud Instance Metadata Service: the agent reads its identity, short-lived tokens, and credentials from this host-local endpoint and nothing else. Agents hold no controlplane credential: egress toward the controlplane is terminated at the enclave gateway (like all agent egress), which carries the agent’s attested identity on its behalf — and an agent never reaches a remote enclave.

The agent authenticates nothing. It is arbitrary, untrusted code, so attribution comes from which socket a request arrives on: the service runs one listener per agent socket and resolves the caller’s identity from the socket → identity registry, never from anything the agent presents. A request on a socket with no registered agent fails closed. Every credential- or token-issuing read is audited — in the sovereign data plane, “which agent obtained which credential when” is exactly the evidence the audit stream exists to carry.

Sealed by default

The enclave forces all agent egress through a TLS-terminating network gateway (internal/enclave/gateway) that MITM-terminates every redirected flow. Destination governance is a default-deny allowlist: a flow whose destination matches no allow rule is denied at the data plane. Egress the platform cannot attribute to an attested agent is denied too — the gateway is fail-closed on identity.

A deny is absolute: the agent has no other route out. Every verdict, allow or deny, is written to the sovereign audit stream as a structured decision carrying the scope, machine-stable reason code (for example not_allowlisted), and matched rule, so an operator sees not just that a flow was blocked but which rule blocked it.