Constellations · drawn policy

acme/launch-gate@2

Ship a release through gates, repair loop, and fan-in

What to pass

secret-scan → license → html-to-pdf → human-approve fan-in

bundle* object · Doc Bundle: pages, links, examples
targets array

What you get

chain signed-envelope-chain

Dispositions: ready, not-ready, stale, blocked

gate (must verify) repair loop (bounded · ≤ 3) fan-in

Composite receipt

constellation: acme/launch-gate@2policy_digest: sha256:c0ffee…
chain:
  1. secret-scan     Envelope ✓  pay_01
  2. license     Envelope ✓  (internal)
  3. html-to-pdf     Envelope ✓  pay_02
  4. human-approve     Envelope ✓  witness
release: sha256:aa11…  signed acme-release-1

Why this isn't CI YAML

Same graph from any harness. Stars can live in different namespaces. Edges require verified Envelopes — not green checkmarks in one repo.

Run under acme/* Reliability console