Since you're doing research in this area, have you taken a look at something like https://www.dyadicsec.com/ at all? I looked at the whitepaper a while ago, and it seemed to make sense, though I was way out of my depth.
Being able to rebuild critical infrastructure from source, and know that you'll be able to reliably deploy it, is a _huge_ win for security.
In that case, you might be interested in bosh: http://bosh.io/docs/problems.html (the tool that enables the workflow jacques_chester was describing). It embraces the idea of reliably building from source for the exact reasons you've mentioned.
You should take a look at https://bosh.io/ . It does what you want wrt devs being responsible for defining how the software runs, environment reproducibility, etc. Unfortunately, the learning curve is pretty steep.
As Titanous said, BOSH operates at a lower level than Flynn. You could use BOSH to deploy Flynn, hypothetically. A more direct comparison would be Cloud Foundry.
Terraform's model (local state files) is not something that works well, in my opinion. Since AWS doesn't know that you want some operations done "transactionally" (like with CloudFormation), you can easily end up with a half built env that needs to be cleaned up. PaaSTa is more of a CF competitor, as far as I know, not really at the same abstraction level. I think that it would be a lot easier to clean up the UX/marketing of BOSH than doing the opposite.
I'd love to hear more about your use case and what I could do to improve the situation. You can contact me with the email address in my profile if you're interested. Thanks!
> Hell, you need a separate VM just to install it.
I'm not sure why that's a problem. If you want something that's actually like heroku like in terms of uptime and what not, you need something that can manage the health of the cluster. Dokku's cool, but it doesn't make sense for anything you actually need to depend on. If it doesn't make sense to pay for the overhead of running your own paas, just use Heroku instead.