Skip to content

Execution Boundary

Horizon SaaS is read-only. It collects inventory, analyzes it, and generates and signs remediation plans. It never changes customer infrastructure. Execution — apply and revert — belongs to the local CloudSlash core and is triggered from the CLI or the terminal dashboard. This is a product and legal boundary, not a configuration default.

What each surface may do

Surface Reads Generates plans Signs plans Mutates infrastructure
Horizon SaaS (web/API) yes yes yes no
Hosted core worker yes yes — no
Local core (cs CLI / TUI) yes yes verifies yes, after review

Enforcement points

The boundary is enforced at six independent layers:

  1. Hosted job allowlist. The worker's consumer executes only scan.analyze, snapshot.analyze, plan.generate, snapshot.compare, and outcome.verify. Any other command is failed as unsupported_command without execution.
  2. Read-only attestation. Every connection method in an approved hosted release must declare read_only: true; the attestation is bound into the connection-schema digest. A catalog entry without it is rejected at load, so a mutating connection form cannot be approved.
  3. Hosted plugin admission. A hosted capability must declare role: source, effect: read, and include the hosted environment; its manifest digest must match the published digest, and the release must be in the operator-owned approval catalog. Collection runs against a scoped SecretLease, never raw credentials.
  4. Manifest validation. Capability effects are limited to read and compute. effect: mutate is rejected, and so is any permissions.*.mutate declaration. A plugin cannot ask the platform for mutation rights.
  5. No SaaS execution route. The API exposes plan read/list, plan creation (signing), and the public verification key. It has no execute endpoint. POST /v1/recommendations/rightsizing/{id}/apply returns 405 with "hosted execution is disabled; create a signed plan and execute it with the CloudSlash CLI". Legacy audit upload returns 410. CLI-uploaded remediation events (POST /api/v1/cli/remediations) are records, not commands.
  6. Local execution only. Mutation lives in the local core executor (pkg/ops plus the journaled planexec runner): per-target locks, preflight of every action before the first change, an append-only journal, drift rechecks, and automatic compensation. The TUI and CLI are views over that core path; they do not implement execution themselves.

Residual risk and the control that closes it

A hosted plugin is third-party code. Even with effect: read pinned and an approved release, the process holds a leased credential while it collects. The control is the credential itself: hosted connections must use read-only provider credentials (the least-privilege policy rendered by cs permissions). Combined with digest pinning, the operator approval catalog, and short-lived leases, a hosted collection run cannot mutate even if plugin code misbehaves.

Why this shape

Customers keep custody of execution. Plans are reviewable artifacts; the customer's own operator, on their own machine, applies them. Auditors get an immutable record of what was planned and what was executed locally, while the SaaS remains a system of record and analysis rather than a remote control plane.