Control plane
ENI6MA Control
AvailableControl is the control plane for one-shot proofs: a registry of active identities, a durable nonce ledger, and operator visibility. Gate consults it to reserve and burn nonces and to learn which handles are alive. Mechanism: registry lifecycle plus burn-before-validate on the ledger. Observable outcome: spent nonces cannot authorize a second call, and operators see burn/reject evidence in one place. Scope: managed Control ships with Team/Enterprise Gate subscriptions; self-hosted Control is the Sovereign path and is required for air-gapped estates.
- Registry
- Ledger
- Consult
- Visibility
Three pieces, one control plane
Registry, ledger, and visibility ship together because identity lifecycle, per-request spend, and audit evidence are the same problem seen from three sides.
Control plane triad
Control plane triad: registry, nonce ledger, and observability
Registry
AvailableActivate, deactivate, and resolve identity handles. Revocation is a single state change on the handle in the registry, not a rotation campaign across every workload that once trusted a shared secret.
Nonce ledger
AvailableReserve, respond, commit. The durable append-only ledger hands out single-use request tokens and records spend time. It burns the nonce before proof validation (burn-before-validate) with a configurable TTL, defaulting to 300 seconds.
Visibility
AvailableBurn events, reject reasons keyed to Gate stages, and access logs - surfaced for operators and auditors on channels a security team already uses.
What Control guarantees
Ledger burn flow
Reserve then burn then validate with duplicate reject at ledger
ENI6MA Control registry activates, deactivates, and resolves circuit handles for Gate checks.Shippingregistry-service at registry.eni6ma.net.
The Control ledger reserves and burns nonces before proof validation, so every submission spends the nonce.Shippingledger-service reserve/response/commit with NONCE_TTL_SECONDS 300.Holds under the reference architecture
Control visibility surfaces burn events and access logs from Gate for operational review.Shippingledger-visibility-service at ledger.eni6ma.net.
Burn-before-validate means the ledger records the nonce as spent before the cryptographic proof is checked, so a captured request cannot be re-submitted even if validation later rejects it. That property is why replay does not survive the Gate boundary under the reference architecture - and why the ledger must be durable, not a cache. This page describes the mechanism and observables.
Deployment shape, failure mode, observability
For a sysadmin or SRE who needs to run Control in production for Cloud or Sovereign stacks.
Managed or self-hosted
Managed Control ships with the Team and Enterprise Gate subscriptions and lives at registry.eni6ma.net and ledger.eni6ma.net. Self-hosted Control is the Sovereign path, and is required for air-gapped estates paired with Foundry.
Durable ledger
The nonce ledger is append-only and durable. It records τ (tau, the microsecond timestamp at reservation) bound into the proof so a captured envelope goes stale within the configured freshness window. Without durability, burn-before-validate cannot be trusted across Gate instances.
Failure mode
Gate is fail-closed against Control by default, so a Control outage becomes a reject storm rather than a silent-open estate. Break-glass paths are configured per route and are logged like any other traffic.
Visibility
Burn events, reject reasons, and access logs from every Gate deployment land in Control visibility, so an operator can see estate state in one place without stitching logs across services. Use Verify against Gate to generate the reject evidence you want to inspect here before production.
- Registry and ledger are separate services (registry.eni6ma.net and ledger.eni6ma.net on the managed path) so they can be scaled and secured independently.
- A durable ledger deployment is a reference-architecture requirement for absolute claims to hold; a cache-only ledger is explicitly not the shipping shape.
- Sovereign deployments run Control self-hosted and can be fully air-gapped against Foundry (minting appliance for per-identity circuit binaries in cohorts).
- Foundry hands cohorts to Control for activation; Gate and Pass+ consume the resulting handles at request time - Control does not mint binaries itself.