CloudSealed Predictive-ML-Core ⚡ ARCHITECTURE RISK & BLAST-RADIUS ENGINE

The ultra-fast, deterministic architecture risk scoring engine and IaC dependency analyzer for high-reliability cloud systems.

In modern cloud-native engineering, microservices, complex cloud architectures, and distributed systems suffer from hidden points of failure, untraceable dependency cascades, and silent architectural drift.

Traditional tools either force manual compliance questionnaires (AWS Well-Architected Tool) or rely on black-box AI models that hallucinate risk scores without auditability.

CloudSealed.ML.Core solves this problem. It automatically ingests declared infrastructure (Terraform, Kubernetes, Docker Compose, Mermaid diagrams, or JSON inventories), computes dependency blast-radii in $O(V+E)$, and scores architecture risk across 3 core dimensions with 100% deterministic, auditable rules.

                           INPUT INGESTION
 ┌──────────────┐   ┌──────────────┐   ┌────────────────┐   ┌──────────────┐
 │  Terraform   │   │  Kubernetes  │   │ Docker Compose │   │ Mermaid DAG  │
 └──────┬───────┘   └──────┬───────┘   └──────┬─────────┘   └──────┬───────┘
        │                  │                  │                    │
        └──────────────────┴─────────┬────────┴────────────────────┘
                                     ▼
                      ┌─────────────────────────────┐
                      │ CloudSealed Predictive Core │
                      │   - AVX2 SIMD Telemetry     │
                      │   - DAG Blast Radius DFS    │
                      │   - Risk Scoring Rules      │
                      └──────────────┬──────────────┘
                                     ▼
                       AUDITABLE OUTPUT & REMEDIATION
 ┌────────────────┐   ┌────────────────┐   ┌────────────────┐   ┌──────────────┐
 │ GitHub PR Bot  │   │ Interactive    │   │  Slack / Teams │   │ GenAI Code   │
 │   Comment      │   │ HTML Dashboard │   │ Webhook Alerts │   │ Remediation  │
 └────────────────┘   └────────────────┘   └────────────────┘   └──────────────┘

Designed for real-time observability pipelines. Evaluates p99 latencies, mean ratios, and performance anomalies using AVX2 SIMD vectorization over ReadOnlySpan<float>, operating with exactly 0 bytes allocated per operation.

Zero-allocation Directed Acyclic Graph (DAG) depth-first traversal engine. Instantly calculates cascading risk factors, upstream/downstream dependency depth, and total blast radius when a specific service fails.

No need to build JSON inputs manually. Parse your infrastructure directly from:

• Terraform (.tf): Scans cloud resources, databases, and network bounds.
• Kubernetes Manifests (.yaml): Extracts deployments, ingress, and pod dependencies.
• Docker Compose (docker-compose.yml): Analyzes multi-container topology.
• Architecture Diagrams (Mermaid.js): Parses text-based architecture charts directly into scoring inventories.

Compliant with SOC 2, ISO 27001, and HIPAA audit requirements. Every single score comes with a strict mathematical breakdown: $$\text{riskScore} = \min\left(\sum \text{rulePoints}, 100\right)$$ The score and its explanation can never drift apart.

When an architectural vulnerability is flagged (e.g., Single Point of Failure or Auth Leakage), the engine automatically crafts exact prompt directives to query Claude, OpenAI, Gemini, or Ollama to output ready-to-apply C# and Terraform fix code.

Native integration with the Model Context Protocol (MCP). LLM Coding Agents (Claude Code, Cursor, Copilot, ChatGPT) can call cloudsealed_score_architecture_risk via cloudsealed-mcp to evaluate infrastructure safety during code generation.

Install via NuGet:

dotnet add package CloudSealed.ML.Core

Analyze your infrastructure in code:

using CloudSealed.ML.Engine.Scoring;
using CloudSealed.ML.Engine.Models;

var request = new PredictArchitectureRequest
{
    CompanyName = "Acme Global",
    Systems = new List<SystemInput>
    {
        new SystemInput
        {
            Name = "checkout-api",
            Type = "API",
            Criticality = "CRITICAL",
            PublicFacing = true,
            AuthMethod = null // Single point of failure + Unauthenticated Public API risk
        },
        new SystemInput
        {
            Name = "main-db",
            Type = "DATABASE",
            Criticality = "HIGH",
            PublicFacing = false
        }
    }
};

var analyzer = new ArchitectureAnalyzer();
PredictArchitectureResponse response = analyzer.Analyze(request);

Console.WriteLine($"Overall Architecture Score: {response.OverallArchitectureScore}/100");

foreach (var prediction in response.Predictions)
{
    Console.WriteLine($"System: {prediction.SystemName}");
    Console.WriteLine($"  SPOF Risk: {prediction.RiskScores.SinglePointOfFailure}");
    Console.WriteLine($"  Coupling Risk: {prediction.RiskScores.ExcessiveCoupling}");
    Console.WriteLine($"  Scalability Gap: {prediction.RiskScores.ScalabilityGap}");
}

Run audit scans directly against JSON inventory files, Terraform specs, or K8s manifests:

# Human-readable CLI summary
dotnet run --project src/CloudSealed.ML.CLI -- examples/inventory.json

# Raw JSON output for automation
dotnet run --project src/CloudSealed.ML.CLI -- examples/inventory.json --json

# Generate a self-contained interactive HTML Dashboard (Offline, Zero CDN dependencies)
dotnet run --project src/CloudSealed.ML.CLI -- examples/inventory.json --html audit-report.html

Automatically analyze infrastructure changes on every Pull Request and block critical architectural risk:

name: Architecture Audit CI

on:
  pull_request:
    branches: [ main ]

jobs:
  audit-architecture:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run CloudSealed Architecture Risk Audit
        uses: cloudsealed/Predictive-ML-Core@main
        with:
          inventory-json: examples/inventory.json
          fail-on-severity: CRITICAL # Fails workflow if CRITICAL risk is detected

The action automatically writes interactive, formatted PR comments and updates them on subsequent pushes.

Run as an enterprise microservice:

docker run -p 8092:8092 cloudsealed/predictive-ml-core

POST /v1/predict-architecture:

curl -X POST http://localhost:8092/v1/predict-architecture \
  -H 'Content-Type: application/json' \
  -d '{
        "companyName": "Acme Enterprise",
        "systems": [
          { 
            "name": "payment-gateway", 
            "type": "API", 
            "criticality": "CRITICAL",
            "publicFacing": true, 
            "authMethod": "OAuth2" 
          }
        ]
      }'

Send real-time alerts to Slack or operational channels whenever a HIGH or CRITICAL architectural flaw is introduced:

dotnet run --project src/CloudSealed.ML.CLI -- examples/inventory.json --webhook-url "$SLACK_WEBHOOK_URL"

CloudSealed.ML.Core evaluates infrastructure across 3 primary risk dimensions:

{
  "singlePointOfFailure": 60,
  "scoreBreakdown": {
    "singlePointOfFailure": [
      { 
        "rule": "criticality=CRITICAL", 
        "points": 55, 
        "rationale": "CRITICAL system without declared redundancy poses high business continuity risk." 
      },
      { 
        "rule": "type=API", 
        "points": 5, 
        "rationale": "API surface adds base protocol overhead and exposure point." 
      }
    ]
  }
}

Want to add custom FinOps policies or internal compliance rules? The engine is built to be hackable.

1. Fork this repository.
2. Open src/CloudSealed.ML.Engine/Scoring/RiskRules.cs.
3. Add your custom risk weight constants and rationales.
4. Run dotnet test to ensure rule-breakdown invariants are preserved!

We welcome pull requests, new IaC parsers, and custom risk rule additions!

• Check out our open issues: GitHub Issues
• Read our CONTRIBUTING.md and ARCHITECTURE.md guides.

What is CloudSealed.ML.Core for? Deterministic, auditable architecture risk scoring and SLA breach forecasting from OS telemetry. Zero-allocation inference and SIMD-accelerated feature extraction for .NET services that need ML inline without GC pressure.

How is it different from ML.NET alone? ML.NET gives you the primitives. CloudSealed.ML.Core adds: zero-allocation inference path (ReadOnlySpan<float> throughout), deterministic scoring (same inputs → same outputs), and prebuilt pipelines for risk/SLA use cases. Use raw ML.NET for generic models; use this for latency-sensitive services.

Does it support .NET Framework? No. .NET 6+ only — depends on Span<T> and modern SIMD intrinsics.

What does "zero-allocation inference" mean in practice? The hot path allocates nothing on the managed heap. No boxing, no LINQ, no new. Critical when running under GC pressure with strict p99 targets.

How do I integrate it into an ASP.NET Core service?

services.AddSingleton<RiskScorer>(sp =>
    RiskScorer.Load("models/arch-risk-v3.cml"));

app.MapGet("/score", (RiskScorer scorer, SystemInventory inv) =>
    scorer.Score(inv.AsSpan()));

Scorer is thread-safe — register as singleton.

This project is licensed under the MIT License.