open-loam 0.1.0 → 0.2.0

data/lib/{loam → open_loam}/durable_events.rb

@@ -1,15 +1,15 @@
-module Loam
-  # Durable (persistent) event subscribers — the twin of Loam::Events.subscribe,
+module OpenLoam
+  # Durable (persistent) event subscribers — the twin of OpenLoam::Events.subscribe,
   # and the formal contract L-706 pins down.
   #
   # THE CONTRACT
-  #   * Ephemeral — Loam::Events.subscribe(&block): runs INLINE in the publisher's
+  #   * Ephemeral — OpenLoam::Events.subscribe(&block): runs INLINE in the publisher's
   #     thread, synchronously, best-effort. An exception in the block PROPAGATES
   #     into whatever published the event. No persistence, no retry. Right for
   #     cheap in-process fan-out (the webhook dispatcher enqueues its own jobs
   #     this way).
-  #   * Persistent — Loam::DurableEvents.register(...): publishing commits a
-  #     Loam::EventDelivery row in the event's tenant, then hands the handler to a
+  #   * Persistent — OpenLoam::DurableEvents.register(...): publishing commits a
+  #     OpenLoam::EventDelivery row in the event's tenant, then hands the handler to a
   #     background job. The handler's exception is CONTAINED in the job; delivery
   #     is retried with backoff and, past MAX_ATTEMPTS, parked as `dead` for an
   #     operator (Admin::EventDeliveriesController).
@@ -29,10 +29,10 @@ module Loam
     MAX_ATTEMPTS = 5
     # Backoff (seconds) indexed by attempt number; the last value is the cap.
     BACKOFF = [ 0, 60, 300, 1800, 7200 ].freeze
-    SWEEP_KEY = "loam_event_redelivery_sweep".freeze
+    SWEEP_KEY = "open_loam_event_redelivery_sweep".freeze
 
     class << self
-      # --- declarative registry (mirrors Loam::Scheduler.register) ---
+      # --- declarative registry (mirrors OpenLoam::Scheduler.register) ---
 
       # key:  a stable identifier stored on every delivery row it produces.
       # to:   an event name ("billing.invoice.paid") or a domain prefix
@@ -51,7 +51,7 @@ module Loam
       end
 
       def subscribers_for(event_name)
-        registered.select { |entry| Loam::Events.pattern_matches?(entry[:pattern], event_name) }
+        registered.select { |entry| OpenLoam::Events.pattern_matches?(entry[:pattern], event_name) }
       end
 
       def handler_for(key)
@@ -59,19 +59,19 @@ module Loam
         entry && resolve(entry[:handler])
       end
 
-      # --- wiring (mirrors Loam::Webhooks.subscribe!) ---
+      # --- wiring (mirrors OpenLoam::Webhooks.subscribe!) ---
 
-      # Wired once from Loam::Engine. Idempotent: subscribing twice would persist
+      # Wired once from OpenLoam::Engine. Idempotent: subscribing twice would persist
       # every event twice.
       def subscribe!
-        @subscription ||= Loam::Events.subscribe_all { |event_name, payload| capture(event_name, payload) }
+        @subscription ||= OpenLoam::Events.subscribe_all { |event_name, payload| capture(event_name, payload) }
       end
 
       # Persist a delivery row per matching durable subscriber, in the event's
       # tenant, then nudge a job per row. The ROW is the durable record; the job
       # is only the accelerator (the sweep redelivers rows whose job was lost).
       def capture(event_name, payload)
-        tenant = Loam::Tenant.find_by(id: payload[:tenant_id])
+        tenant = OpenLoam::Tenant.find_by(id: payload[:tenant_id])
         return if tenant.nil? # nil-tenant events are not durably delivered (as Webhooks.dispatch)
 
         matches = subscribers_for(event_name)
@@ -81,18 +81,18 @@ module Loam
         # scalars by convention, never records (same rule as the webhook path).
         deliverable = payload.transform_keys(&:to_s)
 
-        Loam.as_tenant(tenant) do
+        OpenLoam.as_tenant(tenant) do
           matches.each do |sub|
-            delivery = Loam::EventDelivery.create!(
+            delivery = OpenLoam::EventDelivery.create!(
               subscriber_key: sub[:key], event_name: event_name.to_s,
               payload: deliverable, status: "pending", attempts: 0
             )
-            Loam::EventDeliveryJob.perform_later(tenant.id, delivery.id)
+            OpenLoam::EventDeliveryJob.perform_later(tenant.id, delivery.id)
           end
         end
       end
 
-      # --- delivery (called by Loam::EventDeliveryJob) ---
+      # --- delivery (called by OpenLoam::EventDeliveryJob) ---
 
       # Run one delivery and advance the row's state. Manual, ROW-STATE retries —
       # deliberately NOT ActiveJob retry_on, which keeps retry state in the queue
@@ -102,7 +102,7 @@ module Loam
         return unless delivery.status == "pending"
         return if delivery.next_attempt_at && delivery.next_attempt_at > now # duplicate nudge, backoff not elapsed
 
-        Loam::Telemetry.span("durable_event_delivery",
+        OpenLoam::Telemetry.span("durable_event_delivery",
                              subscriber_key: delivery.subscriber_key, event_name: delivery.event_name) do
           run_delivery(delivery, now)
         end
@@ -136,8 +136,8 @@ module Loam
       # no cross-tenant scan is needed.
       def redeliver_stuck(now: Time.current, limit: 500)
         count = 0
-        Loam::EventDelivery.due(now).limit(limit).find_each do |delivery|
-          Loam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
+        OpenLoam::EventDelivery.due(now).limit(limit).find_each do |delivery|
+          OpenLoam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
           count += 1
         end
         count

data/lib/{loam → open_loam}/encryptable.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   # Field-level encryption at rest, keyed per tenant. Declare it on a model:
   #
-  #   class Patient < Loam::TenantRecord
-  #     include Loam::Encryptable
+  #   class Patient < OpenLoam::TenantRecord
+  #     include OpenLoam::Encryptable
   #     encrypts :ssn                      # encrypted at rest, not searchable
   #     encrypts :email, searchable: true  # + a blind index for exact-match lookup
   #   end
@@ -11,7 +11,7 @@ module Loam
   #   patient.ssn                           # => "078-05-1120" (decrypted on read)
   #   Patient.find_by_email("a@b.com")      # exact match via the blind index
   #
-  # The value is sealed with the CURRENT tenant's key (Loam.tenant!), never the
+  # The value is sealed with the CURRENT tenant's key (OpenLoam.tenant!), never the
   # record's stored tenant_id — so a read in the wrong tenant's context fails the
   # GCM auth tag instead of quietly decrypting another tenant's data. Reading or
   # writing an encrypted field with no tenant in context raises
@@ -24,13 +24,13 @@ module Loam
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :loam_encrypted_attributes, default: [].freeze, instance_writer: false
-      class_attribute :loam_searchable_encrypted_attributes, default: [].freeze, instance_writer: false
+      class_attribute :open_loam_encrypted_attributes, default: [].freeze, instance_writer: false
+      class_attribute :open_loam_searchable_encrypted_attributes, default: [].freeze, instance_writer: false
     end
 
     class_methods do
       # `scope:` chooses whose key seals the field. `:tenant` (default) keys off
-      # Loam.tenant! — right for entity data. A Proc `->(record) { "user/#{...}" }`
+      # OpenLoam.tenant! — right for entity data. A Proc `->(record) { "user/#{...}" }`
       # keys off something else, for genuinely non-tenant data (an MFA secret
       # belongs to the person and must decrypt in any tenant, and at login before
       # a tenant is chosen). Non-tenant scopes cannot be `searchable`.
@@ -38,14 +38,14 @@ module Loam
         name = name.to_s
 
         if searchable && scope != :tenant
-          raise Loam::Error, "#{self.name}: `#{name}` cannot be both `searchable` and non-tenant-scoped."
+          raise OpenLoam::Error, "#{self.name}: `#{name}` cannot be both `searchable` and non-tenant-scoped."
         end
 
         # Encrypted ciphertext is meaningless to a LIKE scan, so the two are a
         # contradiction. Caught whichever declaration comes second (Searchable
         # runs the mirror check), so order in the model does not matter.
-        if respond_to?(:loam_searchable_columns) && loam_searchable_columns.include?(name)
-          raise Loam::Error,
+        if respond_to?(:open_loam_searchable_columns) && open_loam_searchable_columns.include?(name)
+          raise OpenLoam::Error,
                 "#{self.name}: `#{name}` is declared both `searchable_by` (LIKE) and `encrypts` — " \
                 "ciphertext cannot be LIKE-searched. Drop it from `searchable_by` and use " \
                 "`encrypts :#{name}, searchable: true` for exact-match lookup instead."
@@ -54,41 +54,41 @@ module Loam
         # A translation row would store the field's PLAINTEXT — recreating the
         # leak encryption closes. Caught whichever declaration comes second
         # (Translatable runs the mirror check), so model order does not matter.
-        if respond_to?(:loam_translatable_attributes) && loam_translatable_attributes.include?(name)
-          raise Loam::Error,
+        if respond_to?(:open_loam_translatable_attributes) && open_loam_translatable_attributes.include?(name)
+          raise OpenLoam::Error,
                 "#{self.name}: `#{name}` is declared both `translates` and `encrypts` — a translation " \
                 "would store plaintext. Encrypted data is not translatable."
         end
 
-        self.loam_encrypted_attributes = (loam_encrypted_attributes + [name]).freeze
-        self.loam_searchable_encrypted_attributes = (loam_searchable_encrypted_attributes + [name]).freeze if searchable
+        self.open_loam_encrypted_attributes = (open_loam_encrypted_attributes + [name]).freeze
+        self.open_loam_searchable_encrypted_attributes = (open_loam_searchable_encrypted_attributes + [name]).freeze if searchable
 
-        include loam_encryption_reader_writer(name, searchable, scope)
-        define_loam_blind_index_finder(name) if searchable
+        include open_loam_encryption_reader_writer(name, searchable, scope)
+        define_open_loam_blind_index_finder(name) if searchable
       end
 
-      # Reader/writer live in their own module (the Loam::Workflow precedent) so
+      # Reader/writer live in their own module (the OpenLoam::Workflow precedent) so
       # an app can override and still call `super`, and so they sit ABOVE Active
       # Record's generated attribute methods in the ancestor chain and win.
-      def loam_encryption_reader_writer(name, searchable, scope)
+      def open_loam_encryption_reader_writer(name, searchable, scope)
         hash_column = "#{name}_hash"
 
         Module.new do
           define_method(name) do
-            resolved = loam_encryption_scope(scope)
-            aad = Loam::Encryption.aad(resolved, self.class.table_name, name)
-            Loam::Encryption.decrypt_scoped(read_attribute(name), resolved, aad: aad)
+            resolved = open_loam_encryption_scope(scope)
+            aad = OpenLoam::Encryption.aad(resolved, self.class.table_name, name)
+            OpenLoam::Encryption.decrypt_scoped(read_attribute(name), resolved, aad: aad)
           end
 
           define_method("#{name}=") do |value|
-            resolved = loam_encryption_scope(scope)
+            resolved = open_loam_encryption_scope(scope)
             # Bind this ciphertext to its (scope, table, column) so it can't be
             # transplanted to another column/table/tenant (v2 AAD).
-            aad = Loam::Encryption.aad(resolved, self.class.table_name, name)
-            write_attribute(name, Loam::Encryption.encrypt_scoped(value, resolved, aad: aad))
+            aad = OpenLoam::Encryption.aad(resolved, self.class.table_name, name)
+            write_attribute(name, OpenLoam::Encryption.encrypt_scoped(value, resolved, aad: aad))
             # The blind index tracks the ciphertext column: rewrite it in the
             # same breath, so an exact-match lookup can never go stale.
-            write_attribute(hash_column, Loam::Encryption.blind_index_scoped(value, resolved)) if searchable
+            write_attribute(hash_column, OpenLoam::Encryption.blind_index_scoped(value, resolved)) if searchable
           end
         end
       end
@@ -97,11 +97,11 @@ module Loam
       # deliberately shadow Active Record's dynamic `find_by_<attr>`: the obvious
       # call must hash-and-compare, never match a plaintext query against the
       # ciphertext column (which would silently find nothing).
-      def define_loam_blind_index_finder(name)
+      def define_open_loam_blind_index_finder(name)
         hash_column = "#{name}_hash"
 
         define_singleton_method("where_#{name}") do |value|
-          where(hash_column => Loam::Encryption.blind_index(value, Loam.tenant!.id))
+          where(hash_column => OpenLoam::Encryption.blind_index(value, OpenLoam.tenant!.id))
         end
 
         define_singleton_method("find_by_#{name}") do |value|
@@ -117,11 +117,11 @@ module Loam
     # same safety property as an entity write); a Proc computes it from the
     # record. A blank or `.../`-terminated result (e.g. a nil user_id) raises
     # rather than deriving a degenerate shared key.
-    def loam_encryption_scope(scope)
-      resolved = scope == :tenant ? "tenant/#{Loam.tenant!.id}" : scope.call(self).to_s
+    def open_loam_encryption_scope(scope)
+      resolved = scope == :tenant ? "tenant/#{OpenLoam.tenant!.id}" : scope.call(self).to_s
 
       if resolved.strip.empty? || resolved.end_with?("/")
-        raise Loam::Encryption::Error, "#{self.class}: cannot derive an encryption key from a blank scope (#{resolved.inspect})"
+        raise OpenLoam::Encryption::Error, "#{self.class}: cannot derive an encryption key from a blank scope (#{resolved.inspect})"
       end
       resolved
     end
@@ -134,9 +134,9 @@ module Loam
     # version tag lets old and new ciphertext coexist while this runs across a
     # tenant's records, so rotation is a lazy re-encrypt, not a stop-the-world
     # migration. Writes an ordinary audited "[encrypted]" update — see
-    # lib/tasks/loam.rake (loam:encryption:rotate).
-    def loam_reencrypt!
-      self.class.loam_encrypted_attributes.each do |name|
+    # lib/tasks/open_loam.rake (open_loam:encryption:rotate).
+    def open_loam_reencrypt!
+      self.class.open_loam_encrypted_attributes.each do |name|
         public_send("#{name}=", public_send(name))
       end
       save!

data/lib/{loam → open_loam}/encryption/cipher.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Encryption
     # AES-256-GCM sealing. GCM is *authenticated* encryption: the 16-byte auth
     # tag turns tampering — or decrypting with the wrong key — into a loud
@@ -13,7 +13,7 @@ module Loam
     # v2 binds Additional Authenticated Data (the field's tenant+table+column) into
     # the auth tag, so a ciphertext moved to a DIFFERENT column/table/tenant fails
     # the tag on read — it can't be transplanted. Old "v1:" rows (no AAD) keep
-    # decrypting, so upgrading is a lazy re-encrypt (loam:encryption:rotate writes
+    # decrypting, so upgrading is a lazy re-encrypt (open_loam:encryption:rotate writes
     # v2), never a data migration. The AAD is authenticated but NOT secret — it
     # never conceals anything, it only pins WHERE the ciphertext is allowed to live.
     module Cipher
@@ -37,7 +37,7 @@ module Loam
         "#{version}:" + [iv + tag + ciphertext].pack("m0")
       end
 
-      # Decrypt, or raise Loam::Encryption::DecryptionError. The wrong tenant's
+      # Decrypt, or raise OpenLoam::Encryption::DecryptionError. The wrong tenant's
       # key, a tampered blob, a truncated tag, a v2 blob read with the WRONG (or
       # missing) AAD, or plain garbage all fail the same loud way — never a
       # partial or silently-wrong plaintext. A v1 blob carries no AAD, so the

data/lib/{loam → open_loam}/encryption/key_provider.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   module Encryption
     # The seam a real KMS plugs into. A provider turns (scope, purpose) into a
     # 32-byte data key; swap the default for a Vault/AWS-KMS-backed provider via
-    # `Loam::Encryption.key_provider = MyKmsProvider.new` and NO call site
+    # `OpenLoam::Encryption.key_provider = MyKmsProvider.new` and NO call site
     # changes — Cipher and Encryptable only ever ask for a key.
     #
     # `scope` is a namespaced owner string: "tenant/5" for an entity field,
@@ -29,7 +29,7 @@ module Loam
         raise ArgumentError, "scope is required to derive a key" if scope.nil? || scope.to_s.empty?
 
         OpenSSL::KDF.hkdf(
-          Loam::Encryption.master_key,
+          OpenLoam::Encryption.master_key,
           salt: SALT,
           # info binds the key to owner AND purpose. "tenant/5" here reproduces
           # the pre-scope format exactly, so existing ciphertext still decrypts.

data/lib/{loam → open_loam}/encryption.rb

@@ -1,22 +1,22 @@
 require "openssl"
-require "loam/encryption/key_provider"
-require "loam/encryption/cipher"
+require "open_loam/encryption/key_provider"
+require "open_loam/encryption/cipher"
 
-module Loam
+module OpenLoam
   # Field-level encryption at rest, keyed per tenant.
   #
-  # The facade the rest of Loam calls: `encrypt`/`decrypt` seal and open a value
+  # The facade the rest of OpenLoam calls: `encrypt`/`decrypt` seal and open a value
   # with the tenant's derived AES-256-GCM key, and `blind_index` computes the
   # per-tenant HMAC used to find an encrypted field by exact value. Key
   # derivation is delegated to a pluggable `key_provider` (HKDF by default, a
   # KMS in production), so this module holds the scheme, not the key material.
   module Encryption
-    class Error < Loam::Error; end
+    class Error < OpenLoam::Error; end
 
     # Raised when a crypto operation is attempted with no master key configured.
     class MissingMasterKeyError < Error
-      def initialize(msg = "Loam::Encryption has no master key. Set LOAM_MASTER_KEY (or " \
-                           "`Loam::Encryption.master_key = ...`) to a high-entropy secret, e.g. " \
+      def initialize(msg = "OpenLoam::Encryption has no master key. Set OPEN_LOAM_MASTER_KEY (or " \
+                           "`OpenLoam::Encryption.master_key = ...`) to a high-entropy secret, e.g. " \
                            "`SecureRandom.hex(32)`. NEVER commit it; use ENV or Rails credentials.")
         super
       end
@@ -42,18 +42,18 @@ module Loam
       end
 
       def master_key
-        key = @master_key || ENV["LOAM_MASTER_KEY"]
+        key = @master_key || ENV["OPEN_LOAM_MASTER_KEY"]
         raise MissingMasterKeyError if key.nil? || key.empty?
         if key.bytesize < MASTER_KEY_MIN_BYTES
           raise MissingMasterKeyError,
-                "LOAM_MASTER_KEY is too short (#{key.bytesize} bytes); use at least " \
+                "OPEN_LOAM_MASTER_KEY is too short (#{key.bytesize} bytes); use at least " \
                 "#{MASTER_KEY_MIN_BYTES}, e.g. `SecureRandom.hex(32)`."
         end
         key
       end
 
       # Tenant-scoped operations — the default for entity fields via
-      # Loam::Encryptable. nil stays nil (an unset field is not "the empty
+      # OpenLoam::Encryptable. nil stays nil (an unset field is not "the empty
       # string encrypted"); any other value is stringified and sealed.
       def encrypt(plaintext, tenant_id)
         encrypt_scoped(plaintext, tenant_scope(tenant_id))
@@ -89,7 +89,7 @@ module Loam
       # lives — the key scope (tenant/owner) + table + column. Reconstructed
       # identically on read and write, so a blob moved to a different column,
       # table, or tenant fails the auth tag. NOT the record id (see
-      # Loam::Encryptable): the id is unknown at INSERT time, and binding it would
+      # OpenLoam::Encryptable): the id is unknown at INSERT time, and binding it would
       # force an ugly post-insert double-write; record-swap within one
       # tenant+table+column stays a documented residual.
       def aad(scope, table, column)

data/lib/open_loam/engine.rb

@@ -0,0 +1,57 @@
+module OpenLoam
+  class Engine < ::Rails::Engine
+    # Not isolated on purpose: OpenLoam models live under the OpenLoam:: namespace but
+    # share the host app's routes/helpers, keeping the prototype surface small.
+
+    # Webhook dispatch listens to every OpenLoam event. Wired after initialization
+    # so the models it queries are loadable, and guarded against subscribing
+    # twice (see OpenLoam::Webhooks.subscribe!).
+    config.after_initialize do
+      OpenLoam::Webhooks.subscribe!
+      OpenLoam::DurableEvents.subscribe!    # persist + retry durable subscribers (L-706)
+      OpenLoam::BusinessRules.subscribe!
+      OpenLoam::Widgets.register_builtins!  # the default dashboard widgets
+      OpenLoam::Overrides.check!            # warn about any stale disable/replace overrides
+
+      # The durability sweep runs per-tenant on a schedule (materialized into
+      # each tenant by OpenLoam::Scheduler.sync_tenant). interval:300 = every 5 min.
+      OpenLoam::Scheduler.register(
+        key: OpenLoam::DurableEvents::SWEEP_KEY, name: "Event redelivery sweep",
+        job_class: "OpenLoam::EventRedeliverySweepJob", schedule: "interval:300", scope: "tenant"
+      )
+    end
+
+    # OpenLoam's Active Record layer — TenantRecord, Auditable, Eventful and the
+    # rest — is defined inside ActiveSupport.on_load(:active_record) in
+    # lib/open_loam.rb, so those constants exist only once something has referenced
+    # ActiveRecord::Base.
+    #
+    # Zeitwerk eager-loads app/models alphabetically. A host model that inherits
+    # from OpenLoam::TenantRecord and sorts ahead of application_record.rb reaches
+    # the constant before anything has touched Base, and eager load dies with
+    # "uninitialized constant OpenLoam::TenantRecord". Whether an app hits it
+    # depends on its model names, so it shows up on a rename rather than on the
+    # change that caused it.
+    #
+    # Referencing Base here fires the hook while load order is still the
+    # engine's to decide instead of each host app's. :eager_load! is late enough
+    # that every active_record.* initializer has applied its configuration, and
+    # it runs in every environment (in development it is a no-op that still
+    # executes), so lazily-loaded apps are settled by the same line.
+    initializer "open_loam.active_record_layer", before: :eager_load! do
+      ActiveRecord::Base
+    end
+
+    # OpenLoam's own UI strings ship under lib/ (the gemspec packages lib/**/*), so
+    # register them on the app's I18n load path explicitly rather than relying on
+    # the default config/locales path (which the gem does not ship). An app
+    # overrides any key with its own config/locales/open_loam.<locale>.yml.
+    initializer "open_loam.i18n" do |app|
+      app.config.i18n.load_path += Dir[File.expand_path("locales/*.yml", __dir__)]
+    end
+
+    # lib/tasks/open_loam.rake (bin/rails open_loam:sync) is picked up by Rails::Engine's
+    # own lib/tasks loading. Loading it again from a `rake_tasks` block here
+    # would define the task twice and run its body twice.
+  end
+end

data/lib/{loam → open_loam}/enrichers.rb

@@ -1,14 +1,14 @@
-module Loam
+module OpenLoam
   # Response enrichers: one module attaches a computed block onto ANOTHER
   # module's entity in admin/API responses, with no foreign-key coupling.
   #
   #   # billing knows about equipment; equipment knows nothing about billing:
-  #   Loam::Enrichers.register("Equipment", key: "outstanding_balance") do |equipment|
+  #   OpenLoam::Enrichers.register("Equipment", key: "outstanding_balance") do |equipment|
   #     Invoice.where(equipment_id: equipment.id).sum(:balance)
   #   end
   #
-  #   Loam::Enrichers.enrich(equipment)        # => { "outstanding_balance" => 1200 }
-  #   Loam::Enrichers.enrich_many(equipments)  # => { id => { key => value }, ... }
+  #   OpenLoam::Enrichers.enrich(equipment)        # => { "outstanding_balance" => 1200 }
+  #   OpenLoam::Enrichers.enrich_many(equipments)  # => { id => { key => value }, ... }
   #
   # Distinct from custom fields: a custom field is STORED on the record; an
   # enricher is COMPUTED at read time by different (possibly cross-module) code.
@@ -97,7 +97,7 @@ module Loam
 
       def warn_failure(enricher, error)
         Rails.logger&.warn(
-          "[Loam::Enrichers] #{enricher.entity_type}/#{enricher.key} raised #{error.class}: #{error.message} — key omitted"
+          "[OpenLoam::Enrichers] #{enricher.entity_type}/#{enricher.key} raised #{error.class}: #{error.message} — key omitted"
         )
       end
     end

data/lib/{loam → open_loam}/errors.rb

@@ -1,31 +1,31 @@
-module Loam
+module OpenLoam
   class Error < StandardError; end
 
   # Raised whenever a tenant-scoped model is touched with no tenant in
-  # Loam::Current. This is a structural guardrail, not a convention: forgetting
+  # OpenLoam::Current. This is a structural guardrail, not a convention: forgetting
   # the tenant context fails loudly (in tests, before it leaks) instead of
   # silently returning or writing cross-tenant data.
   class MissingTenantError < Error
-    def initialize(msg = "No tenant set in Loam::Current — wrap this call in Loam.as_tenant(tenant) { ... }")
+    def initialize(msg = "No tenant set in OpenLoam::Current — wrap this call in OpenLoam.as_tenant(tenant) { ... }")
       super
     end
   end
 
   # Raised by admin controllers / callers when a policy check fails, and by a
-  # Loam::Workflow transition the current actor's role may not perform.
+  # OpenLoam::Workflow transition the current actor's role may not perform.
   class NotAuthorizedError < Error; end
 
-  # Raised when a Loam::Workflow transition is attempted from a state it does
+  # Raised when a OpenLoam::Workflow transition is attempted from a state it does
   # not move from ("approve a report that was never submitted"). Like every
-  # Loam guardrail it fails at the call site rather than writing a state the
+  # OpenLoam guardrail it fails at the call site rather than writing a state the
   # machine says is impossible.
   class InvalidTransitionError < Error; end
 
   # Raised when an event name does not follow the `domain.thing.happened` convention.
   class InvalidEventNameError < Error; end
 
-  # Raised by Loam::CustomFields#custom_field/#set_custom_field when the name
-  # has no matching Loam::FieldDefinition for this tenant + entity. Fails
+  # Raised by OpenLoam::CustomFields#custom_field/#set_custom_field when the name
+  # has no matching OpenLoam::FieldDefinition for this tenant + entity. Fails
   # loudly at the access site rather than silently reading/writing nil.
   class UnknownCustomFieldError < Error; end
 
@@ -36,12 +36,12 @@ module Loam
   class FeatureDisabledError < Error; end
 
   # Raised when a filter/sort is attempted on a custom field the current role may
-  # not read (Loam::CustomFieldIndex) — otherwise a filter would be an inference
+  # not read (OpenLoam::CustomFieldIndex) — otherwise a filter would be an inference
   # oracle on a restricted field. A NotAuthorizedError so admin controllers render
   # it as 403, like any other field-access denial.
   class FieldAccessError < NotAuthorizedError; end
 
-  # Raised when a Loam::BusinessRule with a `block_transition` action vetoes a
+  # Raised when a OpenLoam::BusinessRule with a `block_transition` action vetoes a
   # workflow transition. Distinct from NotAuthorizedError (a role gate) and
   # InvalidTransitionError (an illegal move): the move is legal and permitted,
   # but a rule says "not under these conditions".

data/lib/{loam → open_loam}/eval.rb

@@ -1,6 +1,6 @@
-module Loam
+module OpenLoam
   # Scripted evaluation scoring for the golden tasks (L-303). An agent (or a
-  # human) implements a task against a fresh Loam app; this scores the RESULT
+  # human) implements a task against a fresh OpenLoam app; this scores the RESULT
   # consistently — the test outcome plus the structural invariants — into a
   # machine-readable scorecard, so runs are comparable over time
   # (ai/benchmark_runs/). Driving the agent is out of scope; consistent scoring

data/lib/{loam → open_loam}/event_stream.rb

@@ -1,14 +1,14 @@
-module Loam
-  # The real-time bridge: pushes selected Loam events to a browser over
+module OpenLoam
+  # The real-time bridge: pushes selected OpenLoam events to a browser over
   # Server-Sent Events, so the admin updates live instead of polling.
   #
   # SECURITY POSTURE — default OFF. An event reaches a browser only if ALL hold:
-  #   * its name matches a declared Loam.broadcast_events pattern (opt-in), AND
+  #   * its name matches a declared OpenLoam.broadcast_events pattern (opt-in), AND
   #   * its tenant matches the connected tenant (isolation), AND
   #   * its audience includes the connected actor (a payload `user_id`, if any,
   #     is the sole recipient; no `user_id` means tenant-wide).
   #
-  # FAN-OUT is behind a swappable broadcaster seam (Loam::EventStream.broadcaster).
+  # FAN-OUT is behind a swappable broadcaster seam (OpenLoam::EventStream.broadcaster).
   # The default in-process broadcaster only sees events published in THIS process
   # — fine for the single-process prototype; a multi-process deploy swaps in a
   # Redis/SolidCable-backed broadcaster with no controller change (see
@@ -24,10 +24,10 @@ module Loam
       # Is this event name allowed to reach browsers at all? Empty allow-list →
       # false, always (nothing leaks by default).
       def broadcastable?(event_name)
-        Loam.broadcast_events.any? do |pattern|
-          next false if Loam::Overrides.disabled?(:broadcast_events, pattern) # an app can turn a default pattern off
+        OpenLoam.broadcast_events.any? do |pattern|
+          next false if OpenLoam::Overrides.disabled?(:broadcast_events, pattern) # an app can turn a default pattern off
 
-          Loam::Events.pattern_matches?(pattern, event_name)
+          OpenLoam::Events.pattern_matches?(pattern, event_name)
         end
       end
 
@@ -42,9 +42,9 @@ module Loam
         recipient.nil? || recipient == actor&.id
       end
 
-      # One SSE message: an `event:` line (the Loam event name) and a `data:`
+      # One SSE message: an `event:` line (the OpenLoam event name) and a `data:`
       # line (JSON), ended by a blank line. Only small id-ish keys ride along —
-      # Loam events carry no attribute values, and this slices to a safe set as
+      # OpenLoam events carry no attribute values, and this slices to a safe set as
       # belt-and-suspenders (tenant_id is dropped; it is implied by the connection).
       def frame(event_name, payload)
         "event: #{event_name}\ndata: #{safe_payload(payload).to_json}\n\n"
@@ -54,21 +54,21 @@ module Loam
 
       def safe_payload(payload)
         # id-ish keys only — never attribute values. percent/status ride along for
-        # the progress bar (Loam::ProgressJob); both are non-sensitive.
+        # the progress bar (OpenLoam::ProgressJob); both are non-sensitive.
         payload.symbolize_keys.slice(:id, :type, :user_id, :from, :to, :percent, :status).compact
       end
     end
 
-    # The default fan-out: subscribe to Loam::Events in THIS process and forward
+    # The default fan-out: subscribe to OpenLoam::Events in THIS process and forward
     # the events deliverable to (tenant, actor) to a sink. A `sink` is anything
     # answering #call(sse_string) — the controller's is a Queue push.
     class InProcessBroadcaster
       # Returns an opaque handle to pass back to #unsubscribe.
       def subscribe(tenant:, actor:, &sink)
-        Loam::Events.subscribe_all do |event_name, payload|
-          next unless Loam::EventStream.deliverable?(event_name, payload, tenant: tenant, actor: actor)
+        OpenLoam::Events.subscribe_all do |event_name, payload|
+          next unless OpenLoam::EventStream.deliverable?(event_name, payload, tenant: tenant, actor: actor)
 
-          sink.call(Loam::EventStream.frame(event_name, payload))
+          sink.call(OpenLoam::EventStream.frame(event_name, payload))
         end
       end
 

data/lib/{loam → open_loam}/eventful.rb

@@ -1,18 +1,18 @@
-module Loam
+module OpenLoam
   # Lifecycle events by convention. Included in every generated entity:
   #
-  #   class Equipment < Loam::TenantRecord
-  #     include Loam::Eventful
+  #   class Equipment < OpenLoam::TenantRecord
+  #     include OpenLoam::Eventful
   #     event_domain :rental          # -> "rental.equipment.created" etc.
   #   end
   #
-  # Custom business events are published explicitly with Loam::Events.publish.
+  # Custom business events are published explicitly with OpenLoam::Events.publish.
   module Eventful
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :loam_event_domain, default: "app"
-      class_attribute :loam_event_entity, default: nil
+      class_attribute :open_loam_event_domain, default: "app"
+      class_attribute :open_loam_event_entity, default: nil
 
       after_create_commit  { publish_lifecycle_event("created") }
       after_update_commit  { publish_lifecycle_event("updated") }
@@ -21,23 +21,23 @@ module Loam
 
     class_methods do
       def event_domain(domain)
-        self.loam_event_domain = domain.to_s
+        self.open_loam_event_domain = domain.to_s
       end
 
       # The middle segment of the event name. It defaults to the model's param
       # key, which is right for app models but awkward for namespaced ones —
-      # Loam::Comment would publish "loam.loam_comment.created" rather than
-      # "loam.comment.created".
+      # OpenLoam::Comment would publish "open_loam.open_loam_comment.created" rather than
+      # "open_loam.comment.created".
       def event_entity(name)
-        self.loam_event_entity = name.to_s
+        self.open_loam_event_entity = name.to_s
       end
     end
 
     private
 
     def publish_lifecycle_event(happened)
-      Loam::Events.publish(
-        "#{loam_event_domain}.#{loam_event_entity || model_name.param_key}.#{happened}",
+      OpenLoam::Events.publish(
+        "#{open_loam_event_domain}.#{open_loam_event_entity || model_name.param_key}.#{happened}",
         { id: id, type: self.class.name }
       )
     end