Drawn policy · not a folder
acme/release-gate
A constellation is chalk lines across stars: gates, a repair loop, fan-in to a composite Envelope. Agents run the graph; humans read the receipt.
gate (must verify)
repair loop (bounded · ≤ 3)
fan-in
Composite receipt
constellation: acme/release-gatepolicy_digest: sha256:77d0…a19 chain: 1. secret-scan Envelope ✓ pay_01 2. license Envelope ✓ (internal) 3. html-to-pdf Envelope ✓ pay_02 4. human-approve Envelope ✓ witness release: sha256:aa11… signed acme-release-1
Why this isn't CI YAML
Same graph from any harness. Stars can live in different namespaces. Edges require verified Envelopes — not green checkmarks in one repo.