Glossary¶

Every CloudSlash-specific term, alphabetically ordered.

AIMD (Additive-Increase / Multiplicative-Decrease) The concurrency control algorithm used by the Swarm scheduler. The worker pool grows by one on each successful API call and halves on a rate-limit (429) response.

Blast Radius The transitive set of cloud resources affected if a specific resource is deleted, stopped, or quarantined. s.a.u uses this to block remediations that cause cascading failures.

Break Glass Protocol An emergency override for s.a.u-blocked resources. Setting the sau:override GitHub label or tag bypasses the CEL policy block with a logged justification.

CEL (Common Expression Language) The expression language used for PolicyMesh governance rules. CloudSlash compiles expressions at load time to catch syntax errors immediately.

CRN (Cloud Resource Name) The universal resource identifier format used throughout CloudSlash. Example: crn:devi:aws:us-east-1:ec2:instance:123456789012:i-0abc123.

CRDT (Conflict-free Replicated Data Type) The state management primitive used by the s.a.u engine for remediation state. A Last-Write-Wins Map CRDT guarantees convergence under concurrent mutations from multiple goroutines.

DEVI The central topology engine of CloudSlash. Secondarily acts as the AI Copilot, a ReAct-style agent that uses MCP tools to query its own graph and take agentic actions.

Daemon The long-running background process (cs daemon) hosting the engine, Web UI, REST API, WebSocket server, and AI agent.

Ghost Linker The cross-provider edge discovery module (pkg/engine/linker/). It compares CIDR blocks across providers to find connectivity edges that no single plugin can see.

Heuristic A deterministic detection rule that evaluates resource signals to identify waste. Heuristics set is_waste=true and assign a waste_reason on matching nodes.

IntentLog The durable write-ahead log (WAL) used by the s.a.u quarantine manager. Before any side effect, a PENDING intent is written and marked COMPLETED upon success.

MCP (Model Context Protocol) The open standard connecting AI models to external tools and data sources. CloudSlash exposes 14 MCP tools for DEVI's graph queries and agentic actions.

s.a.u The saga-based autonomous remediation engine (pkg/engine/sau/). Handles the full remediation lifecycle: TOCTOU concurrency guard, reversibility calculus, CEL DAG interceptor, blast radius guardrail, quarantine isolation, and CRDT state surgery.

Oracle The formal verification engine (pkg/engine/oracle/). Computes risk scores using network reachability analysis, HMM-based spot instance termination prediction, and API error rate correlation.

Phase The lifecycle stage of a resource as it moves through the remediation pipeline. Can be Active, Quarantined, or Justified.

PolicyMesh The CEL-based governance engine (pkg/engine/policy/). Maintains a hot-reloadable ruleset and evaluates rules against every graph node using an inverted index for O(1) lookup.

Quarantine A reversible soft-isolation action. Removes security groups, restricts IAM roles, and snapshots the pre-quarantine state for reversibility.

Rosetta The Git blame provenance engine. Traces a resource CRN back to the Terraform source file, commit hash, author email, and line number that created it.

Saga An ordered sequence of (forward_action, compensating_action) step pairs used for transactional cloud mutations. If any step fails, the saga unwinds by executing compensating actions in reverse order.

Slashfile The project-level configuration file .cloudslash.yaml. Settings override the global ~/.cloudslash/config.yaml and are typically committed to the repository root.

Swarm The AIMD concurrency orchestrator (pkg/engine/swarm/). Manages the worker pool dispatching plugin scan RPCs.

Verdict The engine-computed classification assigned to each resource after the full pipeline runs. Values include PURGED, BLOCK, CRITICAL, DELETE, FLAG, RISK, or --.

WL-Hash (Weisfeiler-Leman Hash) A graph isomorphism hash computed over a resource's subgraph. Used by s.a.u as a Merkle root for the pre-quarantine state snapshot to verify immutability.