Cloud enrollment and discovery

Cloud account enrollment creates a tenant-scoped account first. The API chooses MOCK mode for the current account route, validates the submitted credential shape through the provider adapter, encrypts the credential payload, and stores only masked validation metadata in normal responses.

Enrollment flow

operator                         API                         adapter / worker
   |                              |                                |
   | POST /cloud-accounts         |                                |
   |----------------------------->| org + permission + limit       |
   |                              | create account (MOCK)          |
   | POST /.../:id/credentials    |                                |
   |----------------------------->| encrypt + validate shape ------>|
   |                              | store masked result             |
   | POST /.../:id/sync           |                                |
   |----------------------------->| enqueue cloud.sync ------------>|
   |                              |                                | discover pages
   |                              |<-------------------------------| upsert resources
   |                              | audit + cost rollup             |

The account route accepts one of aws, azure, gcp, hetzner, digitalocean, ovh, oracle or onprem. The current mock implementation does not make provider calls. Live adapters are an explicit integration boundary and require the cloud.live entitlement plus policy approval at the API layer.

Discovery and reconciliation

The cloud.sync handler obtains the account in the organization, selects the adapter with an organization seed, consumes cursor-paginated discovery pages, and upserts resources by account and provider-native externalId. It records a provider sync, updates lastSyncedAt, estimates monthly cost and leaves an audit trail. Resource detail and health refresh use the separate resource.sync path.

provider pages -> normalized resource projection -> resource relations / metrics
       |                         |
       +--> cost estimate        +--> observed snapshot / drift comparison

The resource row is a mutable read model, not immutable evidence. Missing data is not silently treated as deletion. The Digital Twin page describes the snapshot rules and UNKNOWN comparison result.

Provider capability manifest

getCapabilityManifest() is the source of truth for what an adapter can describe and attempt. A manifest includes provider execution mode, regions, resource types, action mode, rate limit, concurrency ceiling, freshness TTLs and reconciliation strategy.

Provider	Mock region	Reconciliation	Discovery TTL	Resource TTL
AWS	us-east-1	incremental / 5 min	60 s	30 s
Azure	westeurope	incremental / 5 min	90 s	30 s
GCP	europe-west1	incremental / 5 min	90 s	30 s
Hetzner	fsn1	incremental / 3 min	60 s	30 s
DigitalOcean	nyc1	incremental / 5 min	90 s	30 s
OVHcloud	gra11	full / 10 min	120 s	60 s
Oracle Cloud	us-ashburn-1	full / 10 min	120 s	60 s
On-prem	dc-1	incremental / 1 min	15 s	5 s

These values describe the shipped deterministic adapters. An action labeled live-mutation is metadata, not authorization. Permission, entitlement, policy and approval remain authoritative.

Demo and live caveats

Mock data is seeded by provider + orgSeed, has stable IDs and order, simulates latency and rate limits, and keeps action state in memory. A CONNECTED mock account is not proof of an external account connection. Live credential storage and SDK calls are not shipped in this package; do not describe a mock sync as a live cloud operation.