open-loam 0.1.0 → 0.2.0

data/lib/{loam → open_loam}/scheduler.rb

@@ -1,7 +1,7 @@
-module Loam
+module OpenLoam
   # Per-tenant recurring jobs. Modules self-register default schedules; an app
-  # also creates them from the admin. A runner calls Loam::Scheduler.tick
-  # periodically (wire `loam:scheduler:tick` to system cron — every minute) and
+  # also creates them from the admin. A runner calls OpenLoam::Scheduler.tick
+  # periodically (wire `open_loam:scheduler:tick` to system cron — every minute) and
   # each DUE schedule enqueues its ActiveJob.
   #
   # NO DOUBLE-FIRE — the whole correctness story. tick ATOMICALLY CLAIMS due
@@ -12,7 +12,7 @@ module Loam
   # The mechanism is behind `claim_due`, chosen per adapter. A claim also stamps
   # `locked_until` so a crashed worker's rows free themselves after LOCK_TTL.
   module Scheduler
-    class UnknownJobError < Loam::Error; end
+    class UnknownJobError < OpenLoam::Error; end
 
     class << self
       # --- declarative registry (like broadcast_events / feature_defaults) ---
@@ -31,14 +31,14 @@ module Loam
       end
 
       # Materialize the registered TENANT-scope schedules as rows in `tenant`
-      # (idempotent — safe from on_tenant_created and `loam:sync`). System-scope
+      # (idempotent — safe from on_tenant_created and `open_loam:sync`). System-scope
       # schedules are created explicitly by the app (they are not per-tenant).
       def sync_tenant(tenant)
-        Loam.as_tenant(tenant) do
+        OpenLoam.as_tenant(tenant) do
           registered.each do |default|
             next unless default[:scope] == "tenant"
 
-            job = Loam::ScheduledJob.find_or_initialize_by(key: default[:key])
+            job = OpenLoam::ScheduledJob.find_or_initialize_by(key: default[:key])
             job.name = default[:name]
             job.job_class = default[:job_class]
             job.schedule = default[:schedule]
@@ -56,7 +56,7 @@ module Loam
       # failure never blocks the others (its lock is released so a later tick
       # retries it).
       def tick(now: Time.current)
-        Loam::Telemetry.span("scheduler_tick") { run_tick(now) }
+        OpenLoam::Telemetry.span("scheduler_tick") { run_tick(now) }
       end
 
       def run_tick(now)
@@ -69,7 +69,7 @@ module Loam
             fired += 1
           rescue StandardError => error
             job.update_columns(locked_until: nil, updated_at: now)
-            logger&.error("[loam scheduler] #{job.key} failed: #{error.class}: #{error.message}")
+            logger&.error("[open_loam scheduler] #{job.key} failed: #{error.class}: #{error.message}")
           end
         end
         fired
@@ -83,7 +83,7 @@ module Loam
 
       # THE code-execution guard: a job_class must resolve to a real ActiveJob
       # subclass AND be ALLOWLISTED — either registered here or listed in
-      # Loam.schedulable_jobs. "Any ActiveJob" would let a tenant admin schedule
+      # OpenLoam.schedulable_jobs. "Any ActiveJob" would let a tenant admin schedule
       # ActiveStorage::PurgeJob, a mailer's delivery job, etc.
       def resolve_job_class(name)
         name = name.to_s
@@ -94,7 +94,7 @@ module Loam
       end
 
       def allowed_job_class?(name)
-        registered.any? { |default| default[:job_class] == name } || Loam.schedulable_jobs.include?(name)
+        registered.any? { |default| default[:job_class] == name } || OpenLoam.schedulable_jobs.include?(name)
       end
 
       def resolve_job_class!(name)
@@ -113,36 +113,36 @@ module Loam
         if job.scope == "system"
           klass.perform_later
         else
-          # Carry the tenant explicitly (ActiveJob doesn't serialize Loam::Current),
+          # Carry the tenant explicitly (ActiveJob doesn't serialize OpenLoam::Current),
           # and enqueue inside the tenant so any enqueue-time scoping is correct.
-          Loam.as_tenant(job.tenant) { klass.perform_later(tenant_id: job.tenant_id) }
+          OpenLoam.as_tenant(job.tenant) { klass.perform_later(tenant_id: job.tenant_id) }
         end
       end
 
       # Atomically claim due, unlocked schedules across ALL tenants (a blessed
       # cross-tenant scan — the runner has no tenant context, like
-      # Loam::Membership.tenants_for), stamping locked_until so a concurrent tick
+      # OpenLoam::Membership.tenants_for), stamping locked_until so a concurrent tick
       # skips them.
       def claim_due(now)
-        lock_until = now + Loam::ScheduledJob::LOCK_TTL
-        due = Loam::ScheduledJob.unscoped.active
+        lock_until = now + OpenLoam::ScheduledJob::LOCK_TTL
+        due = OpenLoam::ScheduledJob.unscoped.active
                                 .where("next_run_at <= ?", now)
                                 .where("locked_until IS NULL OR locked_until < ?", now)
 
         claimed = []
-        Loam::ScheduledJob.transaction do
+        OpenLoam::ScheduledJob.transaction do
           relation = postgres? ? due.lock("FOR UPDATE SKIP LOCKED") : due
           ids = relation.pluck(:id)
           break if ids.empty?
 
-          Loam::ScheduledJob.unscoped.where(id: ids).update_all(locked_until: lock_until)
-          claimed = Loam::ScheduledJob.unscoped.where(id: ids).to_a
+          OpenLoam::ScheduledJob.unscoped.where(id: ids).update_all(locked_until: lock_until)
+          claimed = OpenLoam::ScheduledJob.unscoped.where(id: ids).to_a
         end
         claimed
       end
 
       def postgres?
-        Loam::ScheduledJob.connection.adapter_name.to_s.downcase.include?("postgres")
+        OpenLoam::ScheduledJob.connection.adapter_name.to_s.downcase.include?("postgres")
       end
 
       def logger

data/lib/{loam → open_loam}/search/driver.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Search
     # The driver contract. Subclass and override the class methods.
     #
@@ -10,10 +10,10 @@ module Loam
     #
     #   index(record) / remove(record)
     #     Maintain the driver's index as records are saved and destroyed. Called
-    #     from Loam::Searchable's after_save / after_destroy.
+    #     from OpenLoam::Searchable's after_save / after_destroy.
     #
     #   reindex(model)
-    #     Rebuild the index for a model (used by `loam:search:reindex` and seeds).
+    #     Rebuild the index for a model (used by `open_loam:search:reindex` and seeds).
     #
     # A driver that needs no index (LIKE) leaves index/remove/reindex as no-ops.
     class Driver

data/lib/{loam → open_loam}/search/like_driver.rb

@@ -1,24 +1,24 @@
-module Loam
+module OpenLoam
   module Search
     # The default driver: a substring LIKE across the declared columns — exactly
-    # the original Loam::Searchable behavior, now behind the seam. Portable
+    # the original OpenLoam::Searchable behavior, now behind the seam. Portable
     # (Arel's `matches` emits ILIKE on PostgreSQL, case-insensitive LIKE on
     # SQLite for ASCII) and needs no index, so index/remove/reindex are no-ops.
     #
     # What it does NOT do — ignore accents, split on words, rank — is the reason
-    # the seam exists: swap in Loam::Search::TokenDriver (or an external engine)
+    # the seam exists: swap in OpenLoam::Search::TokenDriver (or an external engine)
     # and every `Model.search(q)` call site keeps working unchanged.
     class LikeDriver < Driver
       class << self
         def search(model, query, scope:)
           query = query.to_s.strip
-          return scope if query.blank? || !model.loam_searchable?
+          return scope if query.blank? || !model.open_loam_searchable?
 
           # sanitize_sql_like escapes the LIKE wildcards so a literal % or _ in
           # the query stays literal; the second arg to `matches` declares that
           # escape character to the database (SQLite has none by default).
           pattern = "%#{model.sanitize_sql_like(query)}%"
-          conditions = model.loam_searchable_columns.map do |column|
+          conditions = model.open_loam_searchable_columns.map do |column|
             model.arel_table[column].matches(pattern, "\\")
           end
           scope.where(conditions.inject(:or))

data/lib/{loam → open_loam}/search/token_driver.rb

@@ -1,7 +1,7 @@
-module Loam
+module OpenLoam
   module Search
     # A portable, word-level index (the flagship second driver). Each record's
-    # searchable text is normalized into tokens stored in loam_search_tokens;
+    # searchable text is normalized into tokens stored in open_loam_search_tokens;
     # a query is tokenized the same way and matched with AND semantics — a record
     # must carry EVERY query token — so "excavator cat" finds "CAT 320 Excavator"
     # regardless of word order or position. Plain SQL: works on SQLite and
@@ -9,18 +9,18 @@ module Loam
     # order-independent). When an app outgrows even this, the same seam takes a
     # Meilisearch/Elasticsearch driver with no call-site change.
     #
-    # Tenant isolation is free: Loam::SearchToken is a TenantRecord, so both the
+    # Tenant isolation is free: OpenLoam::SearchToken is a TenantRecord, so both the
     # match subquery and every write are scoped to the current tenant.
     class TokenDriver < Driver
       class << self
         def search(model, query, scope:)
           tokens = tokenize(query)
-          return scope if tokens.empty? || !model.loam_searchable?
+          return scope if tokens.empty? || !model.open_loam_searchable?
 
           # AND semantics: keep only records carrying all N distinct query
           # tokens. Under AND every hit has the full match count, so ranking is
           # degenerate — ordering is left to the caller.
-          matches = Loam::SearchToken
+          matches = OpenLoam::SearchToken
             .where(searchable_type: type_for(model), token: tokens)
             .group(:searchable_id)
             .having("COUNT(DISTINCT token) = #{tokens.size}")
@@ -33,10 +33,10 @@ module Loam
         # the record's tenant, so the token rows land in the right tenant.
         def index(record)
           model = record.class
-          return unless model.loam_searchable?
+          return unless model.open_loam_searchable?
 
           type = type_for(model)
-          Loam::SearchToken.where(searchable_type: type, searchable_id: record.id).delete_all
+          OpenLoam::SearchToken.where(searchable_type: type, searchable_id: record.id).delete_all
 
           tokens = tokenize(searchable_text(record))
           return if tokens.empty?
@@ -44,17 +44,17 @@ module Loam
           rows = tokens.map do |token|
             { tenant_id: record.tenant_id, searchable_type: type, searchable_id: record.id, token: token }
           end
-          Loam::SearchToken.insert_all(rows)
+          OpenLoam::SearchToken.insert_all(rows)
         end
 
         def remove(record)
-          Loam::SearchToken.where(searchable_type: type_for(record.class), searchable_id: record.id).delete_all
+          OpenLoam::SearchToken.where(searchable_type: type_for(record.class), searchable_id: record.id).delete_all
         end
 
         # Rebuild every current-tenant record of a model — run inside
-        # Loam.as_tenant per tenant (the loam:search:reindex task does that).
+        # OpenLoam.as_tenant per tenant (the open_loam:search:reindex task does that).
         def reindex(model)
-          Loam::SearchToken.where(searchable_type: type_for(model)).delete_all
+          OpenLoam::SearchToken.where(searchable_type: type_for(model)).delete_all
           model.find_each { |record| index(record) }
         end
 
@@ -65,13 +65,13 @@ module Loam
         # THE SAFETY BOUNDARY: an encrypted column is skipped. Its stored value
         # is ciphertext (meaningless to tokenize), and tokenizing the PLAINTEXT
         # into a searchable table would recreate exactly the leak
-        # Loam::Encryptable closes — an encrypted field stays exact-match-only via
+        # OpenLoam::Encryptable closes — an encrypted field stays exact-match-only via
         # its blind index. `searchable_by` already refuses to declare an
         # encrypted column; this subtraction is the second line of that defense.
         def searchable_text(record)
-          columns = record.class.loam_searchable_columns
-          if record.class.respond_to?(:loam_encrypted_attributes)
-            columns -= record.class.loam_encrypted_attributes
+          columns = record.class.open_loam_searchable_columns
+          if record.class.respond_to?(:open_loam_encrypted_attributes)
+            columns -= record.class.open_loam_encrypted_attributes
           end
           columns.map { |column| record.public_send(column) }.join(" ")
         end

data/lib/{loam → open_loam}/search.rb

@@ -1,21 +1,21 @@
-module Loam
+module OpenLoam
   # The search seam. `Model.search(q)` and the `searchable_by` declaration never
   # change; the STRATEGY behind them is a swappable driver:
   #
-  #   Loam::Search.driver = Loam::Search::TokenDriver   # in an initializer
+  #   OpenLoam::Search.driver = OpenLoam::Search::TokenDriver   # in an initializer
   #
   # The default is the LIKE driver — portable and zero-setup — so nothing
   # changes out of the box. A driver turns a text query into a subset of an
   # already-tenant-scoped relation and maintains whatever index it needs; see
-  # Loam::Search::Driver for the contract. This is the same shape as
-  # Loam::EventStream.broadcaster and Loam::Enrichers: one seam, drivers behind
+  # OpenLoam::Search::Driver for the contract. This is the same shape as
+  # OpenLoam::EventStream.broadcaster and OpenLoam::Enrichers: one seam, drivers behind
   # it, callers untouched.
   module Search
     class << self
       attr_writer :driver
 
       def driver
-        @driver ||= Loam::Search::LikeDriver
+        @driver ||= OpenLoam::Search::LikeDriver
       end
 
       def search(model, query, scope:) = driver.search(model, query, scope: scope)

data/lib/{loam → open_loam}/searchable.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   # Text search over an entity's own columns:
   #
-  #   class Equipment < Loam::TenantRecord
-  #     include Loam::Searchable
+  #   class Equipment < OpenLoam::TenantRecord
+  #     include OpenLoam::Searchable
   #     searchable_by :name, :status
   #   end
   #
@@ -12,19 +12,19 @@ module Loam
   # to remember: the default scope is already on it, and the result composes
   # with ordering, pagination and anything else.
   #
-  # HOW a query matches is a swappable driver (Loam::Search.driver): the default
+  # HOW a query matches is a swappable driver (OpenLoam::Search.driver): the default
   # LikeDriver is a substring LIKE; the TokenDriver is a portable word-level
   # index; an external engine is a third. This concern is only the DECLARATION
   # (`searchable_by`) and the untouched call site (`Model.search(q)`) — swapping
-  # the driver changes neither. See Loam::Search.
+  # the driver changes neither. See OpenLoam::Search.
   module Searchable
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :loam_searchable_columns, default: [].freeze, instance_writer: false
+      class_attribute :open_loam_searchable_columns, default: [].freeze, instance_writer: false
 
       # Keep the active driver's index current. A no-op under the default
-      # LikeDriver; the TokenDriver maintains loam_search_tokens here. Guarded so
+      # LikeDriver; the TokenDriver maintains open_loam_search_tokens here. Guarded so
       # non-searchable models pay nothing, and skipped when no searchable column
       # actually changed — so a soft-delete (which touches only deleted_at)
       # leaves the tokens in place, and the base scope hides the row anyway.
@@ -33,8 +33,8 @@ module Loam
       # exercise the `searchable_by` DSL (its encrypted-field check), with no
       # ActiveRecord underneath — only a real model gets the callbacks.
       if respond_to?(:after_save)
-        after_save    :loam_update_search_index,     if: :loam_search_index_stale?
-        after_destroy :loam_remove_from_search_index, if: -> { self.class.loam_searchable? }
+        after_save    :open_loam_update_search_index,     if: :open_loam_search_index_stale?
+        after_destroy :open_loam_remove_from_search_index, if: -> { self.class.open_loam_searchable? }
       end
     end
 
@@ -45,24 +45,24 @@ module Loam
       def searchable_by(*columns)
         columns = columns.map(&:to_s)
 
-        # The mirror of Loam::Encryptable's check: an encrypted column is
+        # The mirror of OpenLoam::Encryptable's check: an encrypted column is
         # ciphertext at rest, which LIKE cannot match. Caught here when
         # `searchable_by` is the later declaration (encrypts catches the reverse).
-        if respond_to?(:loam_encrypted_attributes)
-          conflict = columns & loam_encrypted_attributes
+        if respond_to?(:open_loam_encrypted_attributes)
+          conflict = columns & open_loam_encrypted_attributes
           if conflict.any?
-            raise Loam::Error,
+            raise OpenLoam::Error,
                   "#{name}: cannot `searchable_by` encrypted field(s) #{conflict.join(', ')} — " \
                   "ciphertext cannot be LIKE-searched. Use `encrypts :field, searchable: true` " \
                   "for exact-match lookup instead."
           end
         end
 
-        self.loam_searchable_columns = columns.freeze
+        self.open_loam_searchable_columns = columns.freeze
       end
 
-      def loam_searchable?
-        loam_searchable_columns.any?
+      def open_loam_searchable?
+        open_loam_searchable_columns.any?
       end
 
       # Delegates to the active driver, handing it the current relation as the
@@ -70,21 +70,21 @@ module Loam
       # (a class method called on a relation runs with `all` == that relation).
       # A blank query returns everything: an empty search box means "no filter".
       def search(query)
-        Loam::Search.search(self, query, scope: all)
+        OpenLoam::Search.search(self, query, scope: all)
       end
     end
 
     private
 
-    def loam_update_search_index     = Loam::Search.index(self)
-    def loam_remove_from_search_index = Loam::Search.remove(self)
+    def open_loam_update_search_index     = OpenLoam::Search.index(self)
+    def open_loam_remove_from_search_index = OpenLoam::Search.remove(self)
 
     # On create every column counts as changed, so a new record is always
     # indexed; on update, reindex only when a searchable column actually moved.
-    def loam_search_index_stale?
-      return false unless self.class.loam_searchable?
+    def open_loam_search_index_stale?
+      return false unless self.class.open_loam_searchable?
 
-      saved_changes.keys.intersect?(self.class.loam_searchable_columns)
+      saved_changes.keys.intersect?(self.class.open_loam_searchable_columns)
     end
   end
 end

data/lib/{loam → open_loam}/soft_deletable.rb

@@ -1,7 +1,7 @@
-module Loam
+module OpenLoam
   # Soft-delete: destroying a business record hides it instead of erasing it.
   # A recycle bin — for GDPR retention, for undo, for audits that still read
-  # cleanly after the fact. Loam is "safe by default", so a soft-deleted record
+  # cleanly after the fact. OpenLoam is "safe by default", so a soft-deleted record
   # is EXCLUDED from every ordinary query; seeing it is something you opt INTO,
   # never a filter you must remember to add.
   #
@@ -34,19 +34,19 @@ module Loam
     end
 
     def soft_delete
-      loam_toggle_deleted(deleted: true, bang: false)
+      open_loam_toggle_deleted(deleted: true, bang: false)
     end
 
     def soft_delete!
-      loam_toggle_deleted(deleted: true, bang: true)
+      open_loam_toggle_deleted(deleted: true, bang: true)
     end
 
     def restore
-      loam_toggle_deleted(deleted: false, bang: false)
+      open_loam_toggle_deleted(deleted: false, bang: false)
     end
 
     def restore!
-      loam_toggle_deleted(deleted: false, bang: true)
+      open_loam_toggle_deleted(deleted: false, bang: true)
     end
 
     private
@@ -55,18 +55,18 @@ module Loam
     # record to the state it is already in (a double-clicked button) is a no-op,
     # so the trail never fills with deleted_at -> deleted_at noise.
     #
-    # A soft-delete is an UPDATE, so Loam::Auditable's after_destroy never fires
+    # A soft-delete is an UPDATE, so OpenLoam::Auditable's after_destroy never fires
     # for it. Rather than write our own audit row we borrow Auditable's single
-    # audit path via `loam_audit_as`, which relabels this save's audit
+    # audit path via `open_loam_audit_as`, which relabels this save's audit
     # "soft_delete"/"restore" instead of the "update" it would otherwise record.
-    def loam_toggle_deleted(deleted:, bang:)
+    def open_loam_toggle_deleted(deleted:, bang:)
       return true if deleted == deleted?
 
       self.deleted_at = deleted ? Time.current : nil
       action = deleted ? "soft_delete" : "restore"
       write = -> { bang ? save! : save }
 
-      respond_to?(:loam_audit_as, true) ? loam_audit_as(action, &write) : write.call
+      respond_to?(:open_loam_audit_as, true) ? open_loam_audit_as(action, &write) : write.call
     end
   end
 end

data/lib/{loam → open_loam}/sso/claims.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Sso
     # Normalized identity claims, protocol-independent. Every provider's
     # `exchange` returns one of these so the rest of the flow never knows whether

data/lib/{loam → open_loam}/sso/fake_provider.rb

@@ -1,6 +1,6 @@
 require "base64"
 
-module Loam
+module OpenLoam
   module Sso
     # An OFFLINE stand-in for a real IdP — for the demo and the test suite ONLY,
     # NEVER production. `authorization_url` loops straight back to our own

data/lib/{loam → open_loam}/sso/http_client.rb

@@ -1,10 +1,10 @@
 require "net/http"
 require "json"
 
-module Loam
+module OpenLoam
   module Sso
     # The one place SSO talks to the network — kept tiny and isolated so the rest
-    # of the flow is pure. Only Loam::Sso::OidcProvider uses it, and the test
+    # of the flow is pure. Only OpenLoam::Sso::OidcProvider uses it, and the test
     # suite injects a FakeProvider instead, so this is never exercised offline.
     module HttpClient
       module_function
@@ -32,7 +32,7 @@ module Loam
 
       def parse(response)
         unless response.is_a?(Net::HTTPSuccess)
-          raise Loam::Sso::Error, "identity provider returned #{response.code}"
+          raise OpenLoam::Sso::Error, "identity provider returned #{response.code}"
         end
 
         JSON.parse(response.body)

data/lib/{loam → open_loam}/sso/oidc_provider.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   module Sso
     # The real OIDC Authorization Code provider. Discovers the issuer's endpoints
     # from its .well-known document, sends the user to the authorization endpoint,
@@ -13,7 +13,7 @@ module Loam
     # JWKS verification for the prototype. Roadmap: full id_token + JWKS.
     #
     # NOT exercised by the test suite (a FakeProvider is injected via
-    # Loam::Sso.builder); live OIDC against a real IdP is verified manually.
+    # OpenLoam::Sso.builder); live OIDC against a real IdP is verified manually.
     class OidcProvider
       SCOPE = "openid email profile".freeze
 

data/lib/{loam → open_loam}/sso.rb

@@ -1,25 +1,25 @@
-require "loam/sso/claims"
-require "loam/sso/http_client"
-require "loam/sso/oidc_provider"
-require "loam/sso/fake_provider"
+require "open_loam/sso/claims"
+require "open_loam/sso/http_client"
+require "open_loam/sso/oidc_provider"
+require "open_loam/sso/fake_provider"
 
-module Loam
+module OpenLoam
   # Single sign-on. SHIPPED: OIDC Authorization Code flow end-to-end —
   # home-realm discovery by email domain, just-in-time user provisioning, IdP
   # group -> role mapping, and account linking to an existing User. SEAMS
   # (documented, not built): SAML (another protocol behind the same interface,
   # raises NotImplementedError until implemented) and SCIM 2.0 provisioning
-  # (see docs/_foundation/overview.md). See Loam::SsoProvider for the per-tenant config.
+  # (see docs/_foundation/overview.md). See OpenLoam::SsoProvider for the per-tenant config.
   #
   # A protocol provider implements two methods:
   #   authorization_url(state:, login_hint: nil) -> the IdP URL to redirect to
-  #   exchange(code:)                             -> Loam::Sso::Claims
+  #   exchange(code:)                             -> OpenLoam::Sso::Claims
   #
   # The provider is built through a swappable `builder` so tests and the demo
-  # inject a FakeProvider and NOTHING touches the network. Loam::Sso::OidcProvider
+  # inject a FakeProvider and NOTHING touches the network. OpenLoam::Sso::OidcProvider
   # is the real one; it is never constructed in the test suite.
   module Sso
-    class Error < Loam::Error; end
+    class Error < OpenLoam::Error; end
 
     # The identity provider did not assert a verified email. Linking or creating
     # an account on an unverified email is an account-takeover vector, so the
@@ -39,7 +39,7 @@ module Loam
         @builder ||= method(:default_builder)
       end
 
-      # Wrap a Loam::SsoProvider record in its protocol provider.
+      # Wrap a OpenLoam::SsoProvider record in its protocol provider.
       def build(record, redirect_uri:)
         builder.call(record, redirect_uri)
       end
@@ -50,25 +50,25 @@ module Loam
           OidcProvider.new(record, redirect_uri: redirect_uri)
         when "saml"
           raise NotImplementedError,
-                "SAML SSO is a documented seam — implement Loam::Sso::SamlProvider behind this interface."
+                "SAML SSO is a documented seam — implement OpenLoam::Sso::SamlProvider behind this interface."
         else
           raise Error, "Unsupported SSO protocol: #{record.protocol.inspect}"
         end
       end
 
       # Home-realm discovery. THE blessed cross-tenant lookup for SSO (like
-      # Loam::Membership.tenants_for): "which tenant's IdP owns this email
+      # OpenLoam::Membership.tenants_for): "which tenant's IdP owns this email
       # domain?" is asked at the sign-in page, before any tenant is chosen, so it
       # reaches across tenants via `unscoped` — something host code must never do.
       def provider_for(email:)
         domain = email.to_s.split("@").last.to_s.strip.downcase
         return nil if domain.blank?
 
-        Loam::SsoProvider.unscoped.where(domain: domain, active: true).first
+        OpenLoam::SsoProvider.unscoped.where(domain: domain, active: true).first
       end
 
       # Resolve verified IdP claims to a signed-in User, in the provider's tenant.
-      # MUST be called inside Loam.as_tenant(provider.tenant). Order matters:
+      # MUST be called inside OpenLoam.as_tenant(provider.tenant). Order matters:
       # match the durable (provider, sub) identity first, then an existing User by
       # verified email (link), else just-in-time create — always with a tenant
       # membership at the mapped role.
@@ -86,13 +86,13 @@ module Loam
 
         # Resolve the user: the durable (provider, sub) identity first, then an
         # existing User by verified email (link), else just-in-time create.
-        identity = Loam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
+        identity = OpenLoam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
         user = identity&.user || User.find_by(email: claims.email) || jit_create_user(claims)
 
         # Re-map claims -> role on EVERY login (including a returning identity),
         # so an IdP role change takes effect.
         ensure_membership(provider, user, claims)
-        Loam::SsoIdentity.create!(user: user, sso_provider: provider, sub: claims.sub) unless identity
+        OpenLoam::SsoIdentity.create!(user: user, sso_provider: provider, sub: claims.sub) unless identity
         user
       end
 
@@ -120,7 +120,7 @@ module Loam
       # (a promotion reflects, a removed group downgrades) rather than freezing
       # at whatever the role was when the membership was first created.
       def ensure_membership(provider, user, claims)
-        membership = Loam::Membership.find_or_initialize_by(user_id: user.id)
+        membership = OpenLoam::Membership.find_or_initialize_by(user_id: user.id)
         membership.role = role_for(provider, claims)
         membership.save!
       end

data/lib/{loam → open_loam}/telemetry.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A dependency-free observability seam (L-712). Wrap a unit of work in a span;
   # by default it emits an `ActiveSupport::Notifications` event
-  # ("loam.span.<name>") carrying the attributes and duration, so ANY subscriber
+  # ("open_loam.span.<name>") carrying the attributes and duration, so ANY subscriber
   # — an OpenTelemetry bridge, StatsD, a log line — picks it up with no hard
-  # dependency on Loam's side. An app that wants real OTLP spans replaces the
+  # dependency on OpenLoam's side. An app that wants real OTLP spans replaces the
   # whole strategy:
   #
-  #   Loam::Telemetry.backend = ->(name, attributes, work) do
+  #   OpenLoam::Telemetry.backend = ->(name, attributes, work) do
   #     Tracer.in_span(name, attributes: attributes) { work.call }
   #   end
   #
-  # Loam instruments its async/background hot paths (scheduler tick, durable
+  # OpenLoam instruments its async/background hot paths (scheduler tick, durable
   # event delivery, inbound webhook ingest) so an operator sees them without
   # wiring anything per-call.
   module Telemetry
@@ -24,7 +24,7 @@ module Loam
       if backend
         backend.call(name.to_s, attributes, block)
       else
-        ActiveSupport::Notifications.instrument("loam.span.#{name}", **attributes, &block)
+        ActiveSupport::Notifications.instrument("open_loam.span.#{name}", **attributes, &block)
       end
     end