## The local metadata service

An agent's only interface to the platform is its **local** enclave, reached over a
unix domain socket mounted into the agent's container. The socket presents an IMDS-like
metadata service (`internal/enclave/imds`), modeled on a cloud Instance Metadata
Service: the agent reads its identity, short-lived tokens, and credentials from this
host-local endpoint and nothing else. Agents hold no controlplane credential: egress
toward the controlplane is terminated at the enclave gateway (like all agent egress),
which carries the agent's attested identity on its behalf — and an agent never
reaches a remote enclave.

The agent authenticates nothing. It is arbitrary, untrusted code, so attribution comes
from **which socket** a request arrives on: the service runs one listener per agent
socket and resolves the caller's identity from the socket → identity registry, never
from anything the agent presents. A request on a socket with no registered agent fails
closed. Every credential- or token-issuing read is audited — in the sovereign data
plane, "which agent obtained which credential when" is exactly the evidence the audit
stream exists to carry.

## Sealed by default

The enclave forces all agent egress through a TLS-terminating network gateway
(`internal/enclave/gateway`) that MITM-terminates every redirected flow. Destination
governance is a **default-deny** allowlist: a flow whose destination matches no allow
rule is denied at the data plane. Egress the platform cannot attribute to an attested
agent is denied too — the gateway is fail-closed on identity.

A deny is absolute: the agent has no other route out. Every verdict, allow or deny,
is written to the sovereign audit stream as a structured decision carrying the scope,
machine-stable reason code (for example `not_allowlisted`), and matched rule, so an
operator sees not just that a flow was blocked but which rule blocked it.