ZELC Developer Cheat Sheet

This reference defines the production visual syntax of ZelC, including symbolic operators, structural blocks, execution markers, and block-closure notation.

Build 168.0 // Haja Mo Sovereign

1. Core Syntax

Marker Keyword Description
📦 package Namespace: Declares the operational scope of the file.
🔌 use Import: Loads engines or providers like aina, edr, aws, and threat.
⚙️ keep Constant: Defines thresholds, modes, and fixed configuration values.
⭕️ define Open Circle Block: Starts a reusable helper function block.
🔥 check Entry Point: Starts an active monitoring or execution routine.
⚠️ when Conditional Gate: Opens a condition block.
🔹 set Assignment: Stores runtime values such as hostnames, users, processes, or scores.
🌀 change Mutation: Updates an existing value.
⚡ do Action Block: Opens the live execution zone.
⭕️ each Open Circle Block: Starts an iterator block.
↩️ return Output: Returns helper data or results.
☁️ provider action Execution Call: Invokes real cloud, EDR, Linux, IAM, or API actions.
🚨 alert Signal: Raises an alert for analysts or dashboards.
📣 notify Communication: Sends messages to Teams or other channels.
🧾 evidence Forensic Proof: Records artifacts, timestamps, and outcomes.
⛓️ rosecoin Immutable Provenance: Anchors evidence to Rosecoin.
✨ gui Visual Update: Pushes state into the visual interface layer.
🔴 close block Close Circle Block: Closes define, each, when, do, and check blocks.

2. Block Model

Open Circle Block starts structure. Full Red Circle closes structure.

⭕️ define

Open Circle Block for reusable helper logic.

⭕️ each

Open Circle Block for iterator logic.

⚠️ when

Conditional block opener.

⚡ do

Action block opener.

🔴

Close Circle Block.

⭕️ define assess_risk(event) ... 🔴
⭕️ each proc in suspicious_procs ... 🔴
⚠️ when confidence > 95 ... 🔴
⚡ do ... 🔴
🔥 check RansomwareOutbreakDefense ... 🔴

3. Sample Code for Each Marker

Every symbol below has a direct sample developers can read quickly.
📦 package
📦 package soc.endpoint
🔌 use
🔌 use aina, edr, aws, threat
⚙️ keep
⚙️ keep ENCRYPTION_VELOCITY_LIMIT = 50
⭕️ define ... 🔴
⭕️ define assess_risk(event)

  🔹 set score = event.risk_score
  ↩️ return score

🔴
🔥 check ... 🔴
🔥 check RansomwareOutbreakDefense

  ⚠️ when file_modifications_per_sec > 50
    🔹 set infected_host = event.hostname
  🔴

🔴
⚠️ when ... 🔴
⚠️ when confidence > 95
  🚨 alert critical message "Ransomware detected"
🔴
🔹 set
🔹 set infected_host = event.hostname
🌀 change
🌀 change confidence = confidence + 10
⚡ do ... 🔴
⚡ do
  ☁️ edr isolate host infected_host mode ISOLATION_MODE
🔴
⭕️ each ... 🔴
⭕️ each proc in suspicious_procs
  ☁️ edr kill process proc.pid on infected_host
🔴
↩️ return
↩️ return ai_verdict
☁️ provider action
☁️ edr isolate host infected_host mode ISOLATION_MODE
🚨 alert
🚨 alert critical message "RANSOMWARE VELOCITY DETECTED"
📣 notify
📣 notify teams channel "Incident Response" message "Containment started"
🧾 evidence
🧾 evidence record "Containment_Event" details {
  target_host: infected_host,
  confidence: threat_assessment.confidence
}
⛓️ rosecoin
⛓️ rosecoin anchor evidence_pack "latest"
✨ gui
✨ gui update panel "warroom" with {
  status: "containment_active",
  host: infected_host
}
🔴 close block
🔴
Copyright Haja Mo • ©