Custody boundary

The Execution Plane handles typed facts and opaque references. It admits requests, evaluates policy, coordinates peers, records DVM state, and exports evidence, while secret material stays behind the boundary. Infrastructure teams scale, observe, and operate it independently.

The split places the service surface outside the boundary and the security surface inside it. Reviewers analyze each side separately because the contract between them is defined.

Policy admission happens in two stages, and the stages are different in kind. The Admission Plane builds an AdmissionDecision from normalized intent, approvals, limits, display binding, and policy roots — that is product policy. At each secret-dependent step, the Local Secret Kernel then runs its own local check. The kernel leaves policy evaluation to the Admission Plane and checks only local authorization: does this step permit match the current node, epoch, key, session, phase, and slot?

The kernel's job is to confine each operation permit to one context: the right node, epoch, key, session, phase, and slot, used once. Product policy evolves freely in the Admission Plane. The kernel's invariant stays narrow and stable: when the step permit matches the active context, proceed; otherwise reject with a stable reason code before any secret material is touched.

The boundary creates two distinct review targets. The Execution Plane covers admission logic, DVM trace correctness, transport validation, publication gating, and audit export. The Local Secret Kernel covers local context verification, permit lifecycle, one-time artifact consumption, and the secret log. Each review stands on its own side's contract rather than the other's internals.