Heuristics¶

Heuristics are deterministic detectors compiled into CloudSlash core. They read the graph, set a verdict, and attach a human reason. They are not plugins and they do not execute changes.

What a heuristic does¶

type Heuristic interface {
    Name() string
    Run(ctx context.Context, g *graph.Graph, sc *ScannerContext) (*HeuristicStats, error)
}

A run sets, per resource:

Field	Meaning
`is_waste`	Idle, orphaned, or unused capacity
`waste_reason`	Plain-language evidence for the user
`risk_score`	Instability, exposure, or blast-radius signal
verdict	`BLOCK`, `DELETE`, `RISK`, `ANCHOR`, `WASTE`

Built-in behaviour¶

Waste: sustained idle CPU, unattached volumes, unassociated addresses, orphaned snapshots, stopped workloads holding storage.
Protection: resources carrying data_classification: PII are BLOCK and are never proposed for automatic removal.
Risk: unstable error rates, spot lifecycle, missing ownership or policy evidence.
Anchors: network and egress dependencies that need review before removal.

Heuristics run in parallel over the graph and report counts and estimated monthly savings. They are provider-agnostic: they only read canonical CRNs and generic properties.

What plugins cannot do¶

A plugin collects and describes resources. It cannot define a verdict, invent a finding, or ship a heuristic. A manifest type: heuristic is catalog metadata, not a runtime detector. If you need new detection logic, contribute it to core or write a policy.

Policies are different¶

A heuristic says what condition the resource is in (core-owned, compiled).
A policy says what your organization requires (CEL, authored by you, data-only).

A policy can block a plan or add a finding, but it does not change a verdict and it cannot execute anything. See Concepts.

Where to look¶

pkg/engine/heuristics — detectors and registry.
pkg/graph — graph, verdict classification, topological sort.
cs policy — CEL authoring, validation, tests.