Cloud

Tarski Cloud is the default semantic authority for public development: your files and terminal loop stay local, while protected semantic work — package admission, fixed-point evaluation, provenance construction, deterministic provider execution, signed evidence — runs in managed Cloud (or an accepted BYOC, enterprise, or entitled full-local authority). The management API lives at https://cloud.tarski.run; Studio lives at https://app.tarski.run. The hosted runtime temporarily retains the explicitly legacy https://runtime.cloud.jacqos.io hostname until the separate cell migration lands.

The workflow

tarski cloud login --email you@company.com   # code-only email login
tarski cloud select --project my-project     # fail-closed scope selection
tarski cloud deploy
tarski cloud status
tarski cloud observe --kind example.created --payload '{"id":"example-1"}'
tarski cloud replay-export --output hosted-evidence.json

tarski dev prepares a digest-addressed source bundle, uploads or reuses it, submits admission, and streams backend-owned diagnostics. tarski test and tarski verify keep local ergonomics while the authority produces the evidence; local output not backed by an authority receipt is labeled preflight or cached — never a fake current pass.

Selecting or publishing an existing workspace tuple is re-selection, not creation — repeated verification consumes no extra quota. Sessions record their subject, organization, bound authority, and origin; fixture-born sessions cannot reach managed Cloud.

Deploys you can audit

Every workspace activation pins its runtime contract, package digest, evaluator digest, and activation epoch. Upgrades and rollbacks are explicit operations with receipts — a platform upgrade never silently reinterprets an existing activation. Deployment configures end-user identity on the runtime before activation promotes, and a rejected configuration fails the whole deployment.

Admission before observation: a runtime cell validates that the frozen package actually loads — ontology, mappers, helpers, standard-library pin, identity compatibility — before becoming an active hosted evaluator. Refusal happens at deploy time, not as a time bomb on the first user event.

Honest hosted health

Hosted lineage health separates “observation accepted” from “projection committed”: committed (lag 0), pending (projected head behind, true lag reported), or trapped (evaluation failed; typed diagnostic; partial progress preserved). The exit-code contract mirrors this — exit 2 means “recorded; do not re-append.”

A trapped lineage never loses data: the observation log is immutable. The healing path is deploy-corrected-package as a non-authoritative candidate → prove load and parity → replay the immutable lineage → compare → promote explicitly, retaining the original trap evidence for audit.

Hosted publishes are verified end to end by receipts: hosted observation acceptance, hosted export digest capture, and local replay verification of the hosted export — the recurring proof that hosted state replays locally.

Hosted queries

tarski cloud query executes declared queries against the hosted authority with certified local/hosted digest parity — parity receipts compare canonical rows, ordering, digests, support witnesses, typed denials, and redaction state before capability discovery reports the operation available. When hosted queries are unavailable, you get a typed state — never a silent local fallback presented as cloud truth.

Provider bindings per environment

tarski.toml stays environment-neutral; provider behavior binds per target:

[targets.test.providers.searchapi]
mode = "deterministic"            # fixtures and CI: no network, no credential

[targets.prod.providers.searchapi]
credential_ref = "SEARCHAPI_KEY"  # hosted production: live managed binding

Deterministic bindings can never satisfy live production provider evidence, and a missing live credential blocks typed before any network I/O.

Multi-tenant read models

The scale pattern is lineage-per-tenant: each tenant writes to its own lineage for isolation and write parallelism, and a global read surface composes from authorized projection imports — each import a reduct of another lineage’s worldview, admitted by the source projection’s own row policy. Composition never widens what a source allows.

• Import rows enter composed queries under their canonical relation names with per-import fact identity; live imports record observed lag, and every composed read carries per-import freshness receipts (current, stale_warning, pinned).
• A projection can declare freshness.block_effects_on_stale = true to gate model-call admission while any live import lags — recorded with a typed reason.
• Impossible compositions fail closed at load: a single-writer exclusivity invariant over a multi-source union is rejected with E2811, naming the projection, relation, sources, and invariant.

Tenant isolation guarantees — session-chosen tenancy, collision-resistant record identity, org-scoped listings — are covered in Identity & tenancy.

Usage and plans

Studio’s Cloud and Billing surfaces show usage meters (observation ingest, effect executions by capability class, storage), plan state, and entitlements. During the current preview, organizations resolve to the built-in free plan; entitlement quotas (such as workspace counts) return typed, audited denials naming the axis and plan state.