## Two planes, one boundary

Daevix is one Go binary, `dvx`, run as two planes. The controlplane
(`dvx serve controlplane`) and the sovereign-plane processes (`dvx serve broker`,
`dvx serve imds`, and the gateways) are all the same binary — the split is a
lint-enforced package boundary, not two products.

The **controlplane** holds identity, policy, audit metadata, and the operator
API. It never receives or stores sovereign data. The **enclave** is the
sovereign data plane — a collection of processes that runs in your Kubernetes and
does the mediated work. Sovereign data never flows to the controlplane, and the
sovereign path never depends on it.

{{< planenote plane="enclave" >}}
Convergence flows one way. The enclave's broker is its sole **identity, policy,
and metadata** egress: it **pulls** signed desired-state snapshots and reconciles
them. Nothing is pushed into the cluster from outside, and sovereign payloads,
decrypted material, and audit bodies never cross upward. (One bounded exception
exists for agent-as-operator calls: the enclave gateway dials the controlplane
directly on a single netpol-scoped hop to present a 60s operator token it minted
through the broker — a credential, never sovereign data.)
{{< /planenote >}}

Agents never hold a controlplane credential and never reach one directly. Egress
toward the controlplane is terminated at the enclave gateway like any other
egress; the gateway carries the agent's attested identity on its behalf and
presents any operator credential itself. Agents talk to their local enclave over
a mounted unix socket (an IMDS-like metadata service) for identity and
configuration.

## What you get

Observe what an agent did, audit it against the record, and contain it by
default. Egress is mediated by the enclave gateway; a destination outside policy
is denied. Refusal is the platform working: the denial is the feature.

Audit is first-class and kept separate from application logging — both go to
stdout, told apart by a top-level `stream` key, so the record of what an agent
did is never entangled with operational noise. Errors are RFC 9457 problem
documents; servers are TLS-only.

Daevix is alpha. It is self-hosted: you run both planes in your own
infrastructure. There is no hosted console.