hacky constraints on means/covs