Drawn policy · not a folder
acme/launch-gate@2
A constellation is chalk lines across stars: gates, a repair loop, fan-in to a composite Envelope. Agents run the graph; humans read the receipt.
gate (must verify)
repair loop (bounded · ≤ 3)
fan-in
Composite receipt
constellation: acme/launch-gate@2policy_digest: sha256:c0ffee… chain: 1. secret-scan Envelope ✓ pay_01 2. license Envelope ✓ (internal) 3. html-to-pdf Envelope ✓ pay_02 4. human-approve Envelope ✓ witness release: sha256:aa11… signed acme-release-1
Why this isn't CI YAML
Same graph from any harness. Stars can live in different namespaces. Edges require verified Envelopes — not green checkmarks in one repo.