Horus Cloud

Horus Cloud is an optional shared layer for teams, at cloud.horus.sh. The Horus CLI runs locally and does all the work; Cloud is where a team browses and reuses the investigations, evidence, and agent runs the CLI produces. You can use the CLI entirely on its own and add Cloud whenever you want to share.

How it relates to the CLI

The CLI gathers evidence and runs agents on your machine; only the results sync to your cloud project. Cloud never connects to your runtime systems — it stores what the CLI sends, nothing more.

Organization, workspace, project

Horus Cloud organizes everything as Organization → Workspace → Project, with the core flow Project → Investigation → Evidence → Agent Run.

Connect the CLI to Cloud

1. Log in: horus login (stores a CLI token in ~/.horus/auth.json).
2. Link the repo: horus cloud link (or pass the target positionally: horus cloud link <org/workspace/project>).
3. Confirm the active context: horus context show.
4. Sync existing investigations: horus cloud sync (--dry-run to preview first).

horus login
horus cloud link
horus cloud sync --dry-run
horus cloud sync

horus login defaults to a browser device-login (prints a URL + code and polls until approved); CI can pass --token or HORUS_TOKEN to skip the browser. horus logout revokes the server-side token, then clears local credentials.

What syncs to Cloud

• Investigations and their evidence (summarized, not raw).
• Agent runs recorded during investigations.
• Knowledge snapshots, via horus knowledge push (content-hash deduped).
• Memory items (claims + links + audit), via horus memory sync (idempotent, best-effort; recall vectors never leave the machine).
• horus what-changed reports, via horus what-changed --push.
• horus watch headlines, when the notify sink has --cloud enabled (horus notify set --cloud).

Investigations, evidence, and provenance

Each synced investigation opens to its ranked report, evidence, timeline, and agent runs. Evidence is shown per item with the same honesty discipline as the CLI: each item carries its source (code, logs, metrics, state, queue, history), its subject (the service and environment it came from), and a provenance strip recording the engine query that produced it and when it was collected. When an item points at code, it links to the file and line range in your repository.

Every investigation also has a Provenance view: a citation graph that lays out the reasoning spine — investigation → suspected cause → hypothesis → finding → evidence → outcome — with edges typed by role (supports, derives, cites, contradicts, explains). It draws only the nodes and edges the engine actually produced; it never synthesizes a link that is not in the data. A contradicts edge is rendered as a red flag, and the contradicted node still appears. Note: contradicts edges and outcome nodes are part of the frozen vocabulary but are not emitted by the CLI writer yet.

Knowledge Graph

The Knowledge Graph visualizes a repository's synced knowledge as an interactive graph with two lenses: Explore (structure and clusters) and Timeline (the same knowledge ordered by when it was last updated).

The encoding is an honesty contract — it never inflates what Horus knows:

• Stale knowledge is faded rather than hidden, so age is visible at a glance.
• Confidence drives node size; when no confidence value exists, the node stays a neutral size and is marked unknown (a categorical confidence is shown verbatim, never coerced into a number).
• A contradiction is drawn as a red edge — a flag, not a deletion. The contradicted node still renders.
• Contradicted or superseded items are muted and badged, not removed.

Accuracy and Insights

Because confirmed outcomes and feedback verdicts sync alongside investigations, Cloud can show whether Horus actually helped. The project dashboard carries a per-repository accuracy trend — a strict and a weighted hit-rate over time — computed only from that repo's own outcome labels. It shows honest empty and "too few ratings" states instead of a misleading line, and gaps in the data stay gaps rather than being interpolated to zero.

The workspace Insights page aggregates investigation quality and activity over the last 30 days: strict hit-rate, resolved rate, the yes/partly/no feedback breakdown, and a calibration read (whether predicted confidence runs ahead of or behind real outcomes). Insights is anonymous aggregate telemetry and is restricted to administrators.

Switching between local and cloud

Each repo has a context — either local or a cloud project. Manage it with the context commands:

• horus context list — see the local context and available cloud contexts.
• horus context use local — keep everything on your machine.
• horus context use <org>/<workspace>/<project> — store investigations in a cloud project.
• horus context show — the active context plus project sync metadata.
• horus cloud status — context, linked project, sync metadata, and auth state.
• horus cloud unlink — remove the link and return to local mode.