## What crosses, and in which direction

The boundary carries metadata and control, never sovereign payload. Traffic is
asymmetric by design.

**Downward (controlplane → enclave).** Versioned, per-enclave-scoped desired-state
snapshots: policy, config, and attestation reference values. The enclave **pulls**
them over the authenticated metadata channel and reconciles locally — nothing is pushed into the customer's
cluster from outside. A controlplane outage never stalls the data plane; the enclave
serves from its last-known snapshot.

**Upward (enclave → controlplane).** Enclave health and snapshot acknowledgements —
enough to tell the operator an enclave is live and which snapshot version it converged
to — plus two **credential-class** crossings (bd_2_0-bvw): each node's *public*
agent-identity CA root, published for controlplane pinning so relayed agent SVIDs can
be verified, and the broker-relayed agent-SVID mint requests through which the enclave
gateway obtains a 60s agent-operator token it presents itself (the agent never holds
a controlplane credential). Both ride the broker's bound identity; neither is
sovereign data.

**Never (in either direction).** Sovereign payloads, audit bodies, and decrypted
material. The sovereign audit stream stays in the enclave's own store; the enclave's
KMS and attestation signing key are dialed only by the enclave. There is no path for
plaintext or key material to reach the controlplane.

{{< planenote plane="controlplane" >}}
The controlplane authors and publishes desired state, and stores only platform-owned
metadata (identity, policy references, operator audit) — never sovereign data. It is
the only party that mints controlplane-trusted identities, and it mints exactly one
per enclave: that enclave's broker. It also issues its own short-lived (60s)
agent-operator *token* class — a credential for one caller kind, never a principal
identity, and never minted enclave-side.
{{< /planenote >}}

## Why it is drawn here

The boundary is **lint-enforced**, not merely a convention. `internal/controlplane`
and `internal/enclave` share the `dvx` binary for packaging only; a `depguard` rule in
`.golangci.yml` forbids either package from importing the other, so `make lint` fails
if the boundary erodes. The controlplane cannot import the enclave (sovereign data
lives only in the data plane), and the enclave cannot import the controlplane (identity
minting, policy authoring, and audit aggregation are controlplane-only authorities).
This deterministic fence pairs with the `drift-review` judgment layer, so the drawn
boundary and the compiled boundary can never diverge.