Reduce reachability
No inbound manager.
Environments establish outbound connections so private hosts do not need a public management endpoint.
- HTTPS agent polling
- No public environment admin port
- Explicit public project ingress
Security model
Useful remote control without a remote shell.
Constellation is designed around the assumption that orchestration power must be narrow, observable, and recoverable.
- Remote shell
- Never exposed
- OCI identity
- SHA-256 pinned
- Destructive work
- Preflight + audit
Reduce authority
No arbitrary execution.
The privileged runner validates typed operations rather than accepting commands or scripts from the control plane.
- Allowlisted operation types
- No command or shell fields
- Local-only socket access
Reduce uncertainty
Recovery is part of safety.
Releases and destructive workflows need explicit trust, preflight checks, idempotency, recovery behavior, and durable history.
- First-class and OCI trust levels
- Server-only binding values
- Recorded outcomes and errors
The control plane
Bound the operation before it reaches root.
Security is expressed in the protocol, the process boundary, and the recovery path—not as a promise layered on top.