Orrery.

Drawn policy · not a folder

acme/release-gate

A constellation is chalk lines across stars: gates, a repair loop, fan-in to a composite Envelope. Agents run the graph; humans read the receipt.

gate (must verify) repair loop (bounded · ≤ 3) fan-in

Composite receipt

constellation: acme/release-gatepolicy_digest: sha256:77d0…a19
chain:
  1. secret-scan     Envelope ✓  pay_01
  2. license     Envelope ✓  (internal)
  3. html-to-pdf     Envelope ✓  pay_02
  4. human-approve     Envelope ✓  witness
release: sha256:aa11…  signed acme-release-1

Why this isn't CI YAML

Same graph from any harness. Stars can live in different namespaces. Edges require verified Envelopes — not green checkmarks in one repo.

Run under acme/* Reliability console