The plane boundary
The single invariant the whole system is built around: sovereign data and its keys stay inside the enclave, and the controlplane never receives them.
What crosses, and in which direction
The boundary carries metadata and control, never sovereign payload. Traffic is asymmetric by design.
Downward (controlplane → enclave). Versioned, per-enclave-scoped desired-state snapshots: policy, config, and attestation reference values. The enclave pulls them over the authenticated metadata channel and reconciles locally — nothing is pushed into the customer’s cluster from outside. A controlplane outage never stalls the data plane; the enclave serves from its last-known snapshot.
Upward (enclave → controlplane). Enclave health and snapshot acknowledgements — enough to tell the operator an enclave is live and which snapshot version it converged to — plus two credential-class crossings (bd_2_0-bvw): each node’s public agent-identity CA root, published for controlplane pinning so relayed agent SVIDs can be verified, and the broker-relayed agent-SVID mint requests through which the enclave gateway obtains a 60s agent-operator token it presents itself (the agent never holds a controlplane credential). Both ride the broker’s bound identity; neither is sovereign data.
Never (in either direction). Sovereign payloads, audit bodies, and decrypted material. The sovereign audit stream stays in the enclave’s own store; the enclave’s KMS and attestation signing key are dialed only by the enclave. There is no path for plaintext or key material to reach the controlplane.
Why it is drawn here
The boundary is lint-enforced, not merely a convention. internal/controlplane
and internal/enclave share the dvx binary for packaging only; a depguard rule in
.golangci.yml forbids either package from importing the other, so make lint fails
if the boundary erodes. The controlplane cannot import the enclave (sovereign data
lives only in the data plane), and the enclave cannot import the controlplane (identity
minting, policy authoring, and audit aggregation are controlplane-only authorities).
This deterministic fence pairs with the drift-review judgment layer, so the drawn
boundary and the compiled boundary can never diverge.