Triage-Cloud: Agentic, Event-Driven Multi-Signal Gating for Pre-Deployment Cloud Provisioning

Cloud cost governance tools today are reactive: they report overspending, recommend optimizations, or flag anomalies only after resources have already been provisioned. Deployment failure patterns are rarely checked against historical incident data before a new deployment is attempted, and architecture choices such as CPU instance family are often made by default rather than measured workload fit. This paper presents triage-cloud, an event-driven framework that evaluates cost, failure risk, and architecture fit together, at deployment time, before provisioning occurs. The framework combines a deterministic keyword-based check with an LLM-based semantic check for failure-pattern matching, and adds an agentic investigation layer that autonomously decides whether an unmatched message represents a novel failure pattern worth flagging for human review. The system produces three distinct decision outcomes – APPROVE, FLAG, and BLOCK – rather than a binary allow/deny. We evaluate the system across an initial 20 hand-crafted scenarios (100% correct after fixing seven real defects found during testing) and a subsequent large-scale evaluation of 580 real invocations of the live system, including 480 systematically template-generated messages. The large-scale evaluation revealed a substantial generalization gap not visible at smaller sample sizes: accuracy on novel sentence structures dropped to 56.2%, compared to 77–100% on hand-crafted phrasing. Two targeted fixes – an expanded negation guard and few-shot prompting – were applied and re-verified, recovering 11 percentage points of overall accuracy (62.4% to 73.4%). We additionally report a prompt-style ablation study (3 styles, 216 real model calls), a ROC/AUC analysis of the semantic layer's confidence scoring (AUC 0.67), a 5-case chaos/robustness test that found and fixed one real validation defect, a full unit test suite (39 tests), a cost-per-invocation analysis, and a comparison against a classical TF-IDF baseline the author did not design (AUC 0.599, underperforming the LLM layer). We report all results, including the generalization gap and the portion of it that fixes did not resolve, as an honest account of where a keyword-plus-LLM approach remains fragile at scale.