Cloud evidence snapshots

Hyperoru accepts cloud facts as typed evidence. It does not receive ambient cloud credentials, call a customer control plane from an agent, or infer that a missing resource has been deleted unless the compared snapshots cover the same source boundary.

Supported contract

One snapshot identifies a provider, account or project, collection time, optional region, resources, and relationships. The current contract supports:

• AWS, Azure, and Google Cloud source boundaries;
• compute, container, serverless, identity, network, data, storage, queue, secret, deployment, and policy resources;
• deployment, network, identity, data-access, containment, exposure, dependency, and ownership relationships;
• at most 500 resources and 1,000 relationships per submitted snapshot;
• allowlisted resource metadata such as region, environment, public exposure, encryption, account, project, subscription, and service.

Credentials, tokens, raw environment variables, customer payloads, and unrestricted provider metadata are not accepted as resource properties.

Submit through MCP

Create a workspace API key with the MCP preset, then call submit_cloud_snapshot. The token must include evidence:write and is bound to one workspace.

{
  "provider": "aws",
  "account_id": "123456789012",
  "collected_at": "2026-08-31T12:00:00Z",
  "region": "eu-west-1",
  "resources": [
    {"id": "api", "kind": "serverless", "name": "Payments API", "properties": {"public": true}},
    {"id": "db", "kind": "data", "name": "Payments database", "properties": {"encrypted": true}}
  ],
  "relationships": [
    {"source_id": "api", "target_id": "db", "kind": "reads", "properties": {}}
  ]
}

Hyperoru normalizes the snapshot into immutable entities, relationships, and evidence records. The source identifier includes a provider/account digest, so a later snapshot for the same boundary becomes the current source while earlier evidence remains traceable.

Coverage semantics

Cloud evidence contributes to the workspace context and architecture view. If the latest audit contains repository or delivery evidence but no cloud snapshot, Hyperoru reports that source as missing. Change intelligence distinguishes a verified removal from an item that was simply not re-observed when source coverage differs.