Provider adapters

Every provider implements one normalized interface:

validateCredentials(input)
getCapabilityManifest()
discoverResources({ cursor?, filter? })
getResource(externalId)
executeAction(resource, { action, parameters? })
estimateCosts({ resourceId? })
healthCheck()

The manifest, rather than a provider label, describes resource types, supported actions, regions, rate budget, concurrency, freshness and reconciliation. Read-only actions include health checks, logs and metrics. A capability marked live-mutation describes adapter behavior but does not authorize a caller.

Mock adapters exist for AWS, Azure, GCP, Hetzner, DigitalOcean, OVHcloud, Oracle Cloud and on-prem. They use deterministic seeded catalogs, cursor pagination, simulated latency, rate limiting, status transitions and cost estimates. On-prem monthly cost is a capacity estimate, not a cloud invoice.

Credentials are encrypted with AES-256-GCM, masked in API responses, redacted from errors and never sent to AI context. The current adapter package ships mock implementations only. A live provider adapter must map native status to normalized status, preserve rawStatus, use the same contract, and be instantiated only after server-side cloud.live entitlement and policy checks.