open-loam 0.1.0 → 0.2.0

data/app/models/{loam → open_loam}/custom_field_value.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A read-model projection of ONE custom field of ONE record into typed,
   # INDEXED columns — so filtering/sorting/searching on a custom field is
   # index-backed instead of a per-row JSON extraction over the `custom_fields`
   # column (which can't be indexed and full-scans at scale). One row per
-  # (record, custom field); maintained by Loam::CustomFieldIndex from the
-  # Loam::CustomFields save/destroy hooks. Tenant-scoped.
+  # (record, custom field); maintained by OpenLoam::CustomFieldIndex from the
+  # OpenLoam::CustomFields save/destroy hooks. Tenant-scoped.
   #
   # The value is written into the column matching the field's declared type
   # (value_number / value_boolean / value_datetime) AND always into value_text
   # (its string form) for text ops (contains/present) and canonical equality.
-  class CustomFieldValue < Loam::TenantRecord
-    self.table_name = "loam_custom_field_values"
+  class CustomFieldValue < OpenLoam::TenantRecord
+    self.table_name = "open_loam_custom_field_values"
 
     validates :indexable_type, :indexable_id, :field_key, presence: true
     validates :field_key, uniqueness: { scope: %i[indexable_type indexable_id] }

data/app/models/{loam → open_loam}/dashboard_widget.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # A tenant's dashboard layout: which registered widgets appear, in what order.
   # A manager arranges these on the Dashboard settings screen; the dashboard
-  # renders the active ones by position (see Loam::Dashboard). Tenant-scoped and
+  # renders the active ones by position (see OpenLoam::Dashboard). Tenant-scoped and
   # audited.
-  class DashboardWidget < Loam::TenantRecord
-    self.table_name = "loam_dashboard_widgets"
+  class DashboardWidget < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dashboard_widgets"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     validates :widget_key, presence: true, uniqueness: { scope: :tenant_id }
 

data/app/models/open_loam/dictionary.rb

@@ -0,0 +1,20 @@
+module OpenLoam
+  # A per-tenant managed lookup list — a named set of entries (e.g.
+  # "damage_severity" → minor/major/critical). Admins curate the values without a
+  # code deploy, and a OpenLoam::FieldDefinition of type "dictionary" can point a
+  # custom field at one. Tenant-scoped and audited like every OpenLoam entity; see
+  # OpenLoam::Dictionaries for the read API.
+  class Dictionary < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dictionaries"
+
+    include OpenLoam::Auditable
+
+    has_many :entries, class_name: "OpenLoam::DictionaryEntry",
+             foreign_key: :dictionary_id, dependent: :delete_all
+
+    validates :key, presence: true, uniqueness: { scope: :tenant_id }
+    validates :name, presence: true
+
+    normalizes :key, with: ->(key) { key.to_s.strip.presence }
+  end
+end

data/app/models/{loam → open_loam}/dictionary_entry.rb

@@ -1,15 +1,15 @@
-module Loam
-  # One option in a Loam::Dictionary: a stored `value` (the code that lands in a
+module OpenLoam
+  # One option in a OpenLoam::Dictionary: a stored `value` (the code that lands in a
   # record) plus display metadata (label, color, icon), an ordering `position`,
   # a `is_default` flag, and an `active` switch (a retired option stops being
   # offered without deleting the historical values already stored). Tenant-scoped
   # and audited.
-  class DictionaryEntry < Loam::TenantRecord
-    self.table_name = "loam_dictionary_entries"
+  class DictionaryEntry < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dictionary_entries"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
-    belongs_to :dictionary, class_name: "Loam::Dictionary"
+    belongs_to :dictionary, class_name: "OpenLoam::Dictionary"
 
     validates :value, presence: true, uniqueness: { scope: :dictionary_id }
     validates :label, presence: true
@@ -25,7 +25,7 @@ module Loam
     # A within-request edit must not read a stale cached list (the cache also
     # resets per request, so this only matters when a write and a read share one).
     def clear_dictionary_cache
-      Loam::Dictionaries.clear_cache
+      OpenLoam::Dictionaries.clear_cache
     end
   end
 end

data/app/models/{loam → open_loam}/event_delivery.rb

@@ -1,14 +1,14 @@
-module Loam
+module OpenLoam
   # One durable delivery of one event to one persistent subscriber
-  # (see Loam::DurableEvents). The ROW is the durable record of intent: it is
+  # (see OpenLoam::DurableEvents). The ROW is the durable record of intent: it is
   # committed in the event's tenant at publish time, and the background job is
   # only an accelerator. If the job is lost, the sweep re-enqueues from this row.
   #
   # Lifecycle: pending -> delivered (handler ran) | dead (handler removed, or
   # MAX_ATTEMPTS exhausted). A pending row with next_attempt_at in the future is
   # simply waiting out its backoff.
-  class EventDelivery < Loam::TenantRecord
-    self.table_name = "loam_event_deliveries"
+  class EventDelivery < OpenLoam::TenantRecord
+    self.table_name = "open_loam_event_deliveries"
 
     STATUSES = %w[pending delivered dead].freeze
 

data/app/models/{loam → open_loam}/field_definition.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # Runtime declaration of a migration-free field on a tenant-scoped entity —
   # "entity_type Equipment gets a field called serial_number of type string,
   # writable by managers only." Tenant-scoped like everything else: a field
   # defined in one tenant is invisible to another's records of the same
   # entity_type, and definitions are the ONLY way values in an entity's
-  # `custom_fields` json column get read/written (see Loam::CustomFields).
-  class FieldDefinition < Loam::TenantRecord
-    self.table_name = "loam_field_definitions"
+  # `custom_fields` json column get read/written (see OpenLoam::CustomFields).
+  class FieldDefinition < OpenLoam::TenantRecord
+    self.table_name = "open_loam_field_definitions"
 
     FIELD_TYPES = %w[string text integer decimal boolean date datetime dictionary].freeze
 
@@ -17,15 +17,15 @@ module Loam
 
     # Field-level READ gate for the runtime field, mirroring writable_roles: an
     # empty readable_roles means any member may read it; otherwise only the listed
-    # roles. Used by Loam::CustomFieldIndex (so a filter can't be an oracle on a
-    # restricted field) and Loam::Policy#custom_field_readable?.
+    # roles. Used by OpenLoam::CustomFieldIndex (so a filter can't be an oracle on a
+    # restricted field) and OpenLoam::Policy#custom_field_readable?.
     def readable_by?(role)
       roles = readable_roles
       roles.blank? || (role.present? && roles.map(&:to_sym).include?(role.to_sym))
     end
 
     # The `config` json holds type-specific settings. For a "dictionary" field it
-    # carries the key of the Loam::Dictionary whose entries populate the select.
+    # carries the key of the OpenLoam::Dictionary whose entries populate the select.
     def dictionary_key
       config.is_a?(Hash) ? config["dictionary"] : nil
     end
@@ -40,7 +40,7 @@ module Loam
     def dictionary_key_resolves
       if dictionary_key.blank?
         errors.add(:dictionary_key, "is required for a dictionary field")
-      elsif Loam::Dictionaries.get(dictionary_key).nil?
+      elsif OpenLoam::Dictionaries.get(dictionary_key).nil?
         errors.add(:dictionary_key, "must name an existing dictionary in this tenant")
       end
     end

data/app/models/{loam → open_loam}/inbound_webhook_delivery.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # One received inbound webhook. Two jobs: an idempotency ledger (a unique
   # (source_id, external_id) index turns a replayed delivery into a no-op) and an
   # audit/payload store — the raw body is kept here so an event subscriber reads
   # it, keeping the published event payload scalar-clean (ids only).
-  class InboundWebhookDelivery < Loam::TenantRecord
-    self.table_name = "loam_inbound_webhook_deliveries"
+  class InboundWebhookDelivery < OpenLoam::TenantRecord
+    self.table_name = "open_loam_inbound_webhook_deliveries"
 
-    belongs_to :source, class_name: "Loam::InboundWebhookSource", inverse_of: :deliveries
+    belongs_to :source, class_name: "OpenLoam::InboundWebhookSource", inverse_of: :deliveries
 
     validates :external_id, presence: true
     # (source_id, external_id) uniqueness is enforced by a DB index — the ledger

data/app/models/{loam → open_loam}/inbound_webhook_source.rb

@@ -1,27 +1,27 @@
-module Loam
+module OpenLoam
   # A registered external system allowed to POST webhooks INTO this tenant — the
-  # inbound sibling of Loam::WebhookEndpoint (which delivers events OUT). The
+  # inbound sibling of OpenLoam::WebhookEndpoint (which delivers events OUT). The
   # `token` is the unguessable URL id (`/webhooks/:token`) that identifies the
   # source; the `secret` is the HMAC key that AUTHENTICATES each call. Identity is
   # not authority: rotating either is supported from the admin.
   #
-  # On a verified delivery, Loam publishes `event_name` onto the domain event bus
-  # with a reference to the stored Loam::InboundWebhookDelivery, so durable
-  # subscribers (Loam::DurableEvents) react — the payload itself lives on the row.
-  class InboundWebhookSource < Loam::TenantRecord
-    self.table_name = "loam_inbound_webhook_sources"
+  # On a verified delivery, OpenLoam publishes `event_name` onto the domain event bus
+  # with a reference to the stored OpenLoam::InboundWebhookDelivery, so durable
+  # subscribers (OpenLoam::DurableEvents) react — the payload itself lives on the row.
+  class InboundWebhookSource < OpenLoam::TenantRecord
+    self.table_name = "open_loam_inbound_webhook_sources"
 
-    DEFAULT_SIGNATURE_HEADER = "X-Loam-Signature".freeze
+    DEFAULT_SIGNATURE_HEADER = "X-OpenLoam-Signature".freeze
     DEFAULT_TOLERANCE = 300 # seconds
 
-    has_many :deliveries, class_name: "Loam::InboundWebhookDelivery",
+    has_many :deliveries, class_name: "OpenLoam::InboundWebhookDelivery",
                           foreign_key: :source_id, dependent: :destroy, inverse_of: :source
 
     validates :name, presence: true
     validates :token, presence: true, uniqueness: true
     validates :secret, presence: true
     validates :event_name, presence: true,
-              format: { with: Loam::Events::NAME_FORMAT, message: "must follow domain.thing.happened" }
+              format: { with: OpenLoam::Events::NAME_FORMAT, message: "must follow domain.thing.happened" }
 
     scope :active, -> { where(active: true) }
 
@@ -32,9 +32,9 @@ module Loam
       self.active = true if active.nil?
     end
 
-    # THE blessed cross-tenant lookup (see Loam::ApiToken.authenticate): a public
+    # THE blessed cross-tenant lookup (see OpenLoam::ApiToken.authenticate): a public
     # inbound request arrives with no tenant context — the token in the URL is how
-    # it discovers its tenant. Establishes Loam::Current.tenant (never an actor:
+    # it discovers its tenant. Establishes OpenLoam::Current.tenant (never an actor:
     # the sender is a machine, not a user) and returns the ACTIVE source, or nil.
     def self.resolve(raw_token)
       return nil if raw_token.blank?
@@ -42,7 +42,7 @@ module Loam
       source = unscoped.find_by(token: raw_token)
       return nil unless source&.active?
 
-      Loam::Current.tenant = source.tenant
+      OpenLoam::Current.tenant = source.tenant
       source
     end
 

data/app/models/{loam → open_loam}/membership.rb

@@ -1,27 +1,27 @@
-module Loam
+module OpenLoam
   # Connects an actor (the host app's User) to a tenant with a role. Roles are
   # plain strings ("manager", "employee", ...) — policies interpret them.
   # Tenant-scoped like everything else: asking for someone's role always means
   # "their role in the CURRENT tenant".
-  class Membership < Loam::TenantRecord
-    self.table_name = "loam_memberships"
+  class Membership < OpenLoam::TenantRecord
+    self.table_name = "open_loam_memberships"
 
     belongs_to :user
 
     validates :role, presence: true
     validates :user_id, uniqueness: { scope: :tenant_id }
 
-    # The other blessed cross-tenant lookup (see Loam::ApiToken.authenticate).
+    # The other blessed cross-tenant lookup (see OpenLoam::ApiToken.authenticate).
     # "Which tenants may this person enter?" is asked at login, before any
     # tenant is chosen, so it cannot be answered from inside one — which is why
     # it lives in the gem rather than in host app code, where reaching across
     # tenants is a guardrail failure.
     #
-    # Returns a Loam::Tenant relation, so callers can order/filter it further.
+    # Returns a OpenLoam::Tenant relation, so callers can order/filter it further.
     def self.tenants_for(user)
       user_id = user.respond_to?(:id) ? user.id : user
 
-      Loam::Tenant.where(id: unscoped.where(user_id: user_id).select(:tenant_id)).order(:name)
+      OpenLoam::Tenant.where(id: unscoped.where(user_id: user_id).select(:tenant_id)).order(:name)
     end
   end
 end

data/app/models/{loam → open_loam}/mfa_credential.rb

@@ -1,21 +1,21 @@
 require "bcrypt"
 
-module Loam
+module OpenLoam
   # A user's multi-factor credential: a TOTP secret plus single-use recovery
   # codes. Deliberately NOT tenant-scoped — MFA belongs to the PERSON, who spans
   # tenants, and the second-factor challenge runs at login BEFORE any tenant is
-  # chosen. So the secret is encrypted under a USER-scoped key (Loam::Encryptable
+  # chosen. So the secret is encrypted under a USER-scoped key (OpenLoam::Encryptable
   # `scope:`), which decrypts in any tenant and with no tenant at all — the whole
   # reason a per-tenant key would be a lockout bug here.
   class MfaCredential < ApplicationRecord
-    include Loam::GeneratedKey
-    self.table_name = "loam_mfa_credentials"
+    include OpenLoam::GeneratedKey
+    self.table_name = "open_loam_mfa_credentials"
 
     RECOVERY_CODE_COUNT = 10
 
     belongs_to :user
 
-    include Loam::Encryptable
+    include OpenLoam::Encryptable
     encrypts :totp_secret, scope: ->(credential) { "user/#{credential.user_id}" }
 
     # Recovery codes are stored HASHED (BCrypt), never in the clear: [{ "digest",
@@ -46,7 +46,7 @@ module Loam
     # if the code is wrong. The old secret stays valid until this succeeds, so a
     # half-finished re-enrollment never downgrades an active credential.
     def activate_with!(candidate_secret, code)
-      step = Loam::Totp.matching_step(candidate_secret, code)
+      step = OpenLoam::Totp.matching_step(candidate_secret, code)
       return nil unless step
 
       self.totp_secret = candidate_secret
@@ -66,7 +66,7 @@ module Loam
       return false unless activated?
 
       with_lock do
-        step = Loam::Totp.matching_step(totp_secret, code)
+        step = OpenLoam::Totp.matching_step(totp_secret, code)
         if step && (last_totp_step.nil? || step > last_totp_step)
           update!(last_totp_step: step)
           true
@@ -100,7 +100,7 @@ module Loam
     end
 
     def provisioning_uri(issuer:)
-      Loam::Totp.provisioning_uri(totp_secret, account: user.email, issuer: issuer)
+      OpenLoam::Totp.provisioning_uri(totp_secret, account: user.email, issuer: issuer)
     end
 
     private

data/app/models/{loam → open_loam}/notification.rb

@@ -1,15 +1,15 @@
-module Loam
+module OpenLoam
   # One in-app message for one recipient (`user`) in one tenant. The same
   # person in two tenants has two separate inboxes — like everything else in
-  # Loam, "your notifications" always means "in the current tenant".
+  # OpenLoam, "your notifications" always means "in the current tenant".
   #
-  # Plumbing, not business data: not audited, the same way Loam::AuditRecord
-  # isn't. It IS evented, though — creating one publishes "loam.notification.created"
-  # (carrying the recipient's user_id) so Loam::EventStream can push it to that
+  # Plumbing, not business data: not audited, the same way OpenLoam::AuditRecord
+  # isn't. It IS evented, though — creating one publishes "open_loam.notification.created"
+  # (carrying the recipient's user_id) so OpenLoam::EventStream can push it to that
   # user's browser and the bell updates live. Created through
-  # Loam::Notifications.notify, read through the admin bell.
-  class Notification < Loam::TenantRecord
-    self.table_name = "loam_notifications"
+  # OpenLoam::Notifications.notify, read through the admin bell.
+  class Notification < OpenLoam::TenantRecord
+    self.table_name = "open_loam_notifications"
 
     belongs_to :user
 
@@ -18,9 +18,9 @@ module Loam
     scope :unread, -> { where(read_at: nil) }
 
     # The one signal the real-time bell listens for. Only id + recipient ride the
-    # event (Loam::Events also stamps tenant_id); no message content is broadcast.
+    # event (OpenLoam::Events also stamps tenant_id); no message content is broadcast.
     after_create_commit do
-      Loam::Events.publish("loam.notification.created", id: id, user_id: user_id)
+      OpenLoam::Events.publish("open_loam.notification.created", id: id, user_id: user_id)
     end
 
     # What the notification is about, if anything (source_type/source_id) —

data/app/models/{loam → open_loam}/pending_action.rb

@@ -1,21 +1,21 @@
-module Loam
+module OpenLoam
   # A staged mutation awaiting human approval. When a caller runs under
-  # confirm-mode (an MCP tool acting for an AI agent — see Loam.mutation_mode), a
+  # confirm-mode (an MCP tool acting for an AI agent — see OpenLoam.mutation_mode), a
   # write is staged HERE as a preview instead of committing; a manager approves
-  # or rejects, and only approval executes it. This is Loam's thesis made
+  # or rejects, and only approval executes it. This is OpenLoam's thesis made
   # concrete: agent-triggered writes are gate-able.
   #
-  # The approval gate IS a workflow (Loam::Workflow): pending → (manager) approve
+  # The approval gate IS a workflow (OpenLoam::Workflow): pending → (manager) approve
   # / reject → executed / failed. "Who may approve" lives in one declarative,
-  # role-gated place. The proposed changes are encrypted at rest (Loam::Encryptable),
+  # role-gated place. The proposed changes are encrypted at rest (OpenLoam::Encryptable),
   # because a staged change to an encrypted target field would otherwise sit here
   # — and in this row's own audit — as plaintext, reopening the leak L-901 closed.
-  class PendingAction < Loam::TenantRecord
-    self.table_name = "loam_pending_actions"
+  class PendingAction < OpenLoam::TenantRecord
+    self.table_name = "open_loam_pending_actions"
 
-    include Loam::Auditable
-    include Loam::Encryptable
-    include Loam::Workflow
+    include OpenLoam::Auditable
+    include OpenLoam::Encryptable
+    include OpenLoam::Workflow
 
     belongs_to :actor, class_name: "User", optional: true
     belongs_to :reviewer, class_name: "User", foreign_key: :reviewed_by_id, optional: true
@@ -96,7 +96,7 @@ module Loam
     # write; the record ends "executed" or "failed". Executes as `by`, so the
     # TARGET's audit names the approving human — the person owns the change.
     def approve!(by:)
-      Loam.as_tenant(tenant, actor: by) do
+      OpenLoam.as_tenant(tenant, actor: by) do
         reject_self_approval!(by)
         self.reviewed_by_id = by.id
         self.reviewed_at = Time.current
@@ -107,7 +107,7 @@ module Loam
     end
 
     def reject!(by:, reason: nil)
-      Loam.as_tenant(tenant, actor: by) do
+      OpenLoam.as_tenant(tenant, actor: by) do
         self.reviewed_by_id = by.id
         self.reviewed_at = Time.current
         self.result = [ "rejected", reason.presence ].compact.join(": ")
@@ -126,9 +126,9 @@ module Loam
     # withdrawal, not a segregation-of-duties concern.)
     def reject_self_approval!(by)
       return unless by.id == actor_id
-      return if Loam::Configs.get("approvals.allow_self_approve", default: false)
+      return if OpenLoam::Configs.get("approvals.allow_self_approve", default: false)
 
-      raise Loam::NotAuthorizedError, "self-approval is not permitted; a different person must approve this change"
+      raise OpenLoam::NotAuthorizedError, "self-approval is not permitted; a different person must approve this change"
     end
 
     # Execution AND its status/result recording share ONE transaction with the
@@ -163,7 +163,7 @@ module Loam
         target.respond_to?(:soft_delete!) ? target.soft_delete! : target.destroy!
         "deleted #{target_type}##{target_id}"
       else
-        raise Loam::Error, "unknown action_type #{action_type.inspect}"
+        raise OpenLoam::Error, "unknown action_type #{action_type.inspect}"
       end
     end
 
@@ -178,31 +178,31 @@ module Loam
     end
 
     def encrypted_target_fields
-      return [] unless target_class.respond_to?(:loam_encrypted_attributes)
+      return [] unless target_class.respond_to?(:open_loam_encrypted_attributes)
 
-      target_class.loam_encrypted_attributes.map(&:to_s)
+      target_class.open_loam_encrypted_attributes.map(&:to_s)
     end
 
     # Set while a workflow transition is performing its save, so the validation
     # below can tell a legitimate status move from a direct assignment.
-    def loam_perform_transition!(transition)
-      @loam_status_via_transition = true
+    def open_loam_perform_transition!(transition)
+      @open_loam_status_via_transition = true
       super
     ensure
-      @loam_status_via_transition = false
+      @open_loam_status_via_transition = false
     end
 
     def status_changes_only_through_a_transition
       return unless will_save_change_to_status?
-      return if @loam_status_via_transition
+      return if @open_loam_status_via_transition
 
       errors.add(:status, "may only change through an approval transition (approve!/reject!), not a direct write")
     end
 
     def status_starts_at_the_initial_state
-      return if status == self.class.loam_workflow.initial
+      return if status == self.class.open_loam_workflow.initial
 
-      errors.add(:status, "must start at #{self.class.loam_workflow.initial.inspect} — a staged action begins pending")
+      errors.add(:status, "must start at #{self.class.open_loam_workflow.initial.inspect} — a staged action begins pending")
     end
   end
 end

data/app/models/{loam → open_loam}/perspective.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # A saved view of an entity's admin index — which columns show, active filters,
   # sort, and page size — that a user can name, make their default, or share.
   #
@@ -7,15 +7,15 @@ module Loam
   #   * "role"    — everyone with the named membership role in the tenant.
   #   * "tenant"  — everyone in the tenant.
   # A private view is invisible to others by construction (see
-  # Loam::Perspectives.visible_to), not merely by a permission check.
+  # OpenLoam::Perspectives.visible_to), not merely by a permission check.
   #
   # Tenant-scoped like everything else, and audited. Optimistic-locked
   # (lock_version) so two people editing a shared view don't silently clobber
   # each other — the admin controller rescues ActiveRecord::StaleObjectError.
-  class Perspective < Loam::TenantRecord
-    self.table_name = "loam_perspectives"
+  class Perspective < OpenLoam::TenantRecord
+    self.table_name = "open_loam_perspectives"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     VISIBILITIES = %w[private role tenant].freeze
 

data/app/models/{loam → open_loam}/progress_job.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # Progress of a long-running job (a bulk import, a reindex, a report) so the
   # admin can watch it live instead of guessing. Tenant-scoped; a job started in
   # one tenant is only visible and streamable there.
@@ -7,11 +7,11 @@ module Loam
   # ticks) and the audit trail would fill with noise. The terminal status and
   # any error are captured on the row itself, which is the summary that matters.
   #
-  # Each meaningful change publishes `loam.progress.updated` (broadcastable → SSE)
-  # carrying only id/percent/status — no record contents. See Loam::Progress for
+  # Each meaningful change publishes `open_loam.progress.updated` (broadcastable → SSE)
+  # carrying only id/percent/status — no record contents. See OpenLoam::Progress for
   # the entry point.
-  class ProgressJob < Loam::TenantRecord
-    self.table_name = "loam_progress_jobs"
+  class ProgressJob < OpenLoam::TenantRecord
+    self.table_name = "open_loam_progress_jobs"
 
     STATUSES = %w[running completed failed cancelled].freeze
     STALE_AFTER = 5.minutes
@@ -93,11 +93,11 @@ module Loam
       self
     end
 
-    # Only ever id/percent/status leave the server (Loam::Events stamps tenant_id
+    # Only ever id/percent/status leave the server (OpenLoam::Events stamps tenant_id
     # for the SSE deliverable filter; the frame's safe_payload drops everything
     # else).
     def broadcast
-      Loam::Events.publish("loam.progress.updated", id: id, percent: percent, status: status)
+      OpenLoam::Events.publish("open_loam.progress.updated", id: id, percent: percent, status: status)
     end
   end
 end

data/app/models/{loam → open_loam}/record_lock.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # An advisory "someone is editing this" lock on a record — the COURTESY layer.
   # The real guarantee against a silent clobber is optimistic locking
-  # (lock_version, see Loam::RecordLocks docs); this only warns the second
+  # (lock_version, see OpenLoam::RecordLocks docs); this only warns the second
   # editor. One lock per record, with a TTL: an expired lock is treated as free,
   # and re-acquiring as the same holder extends it (a heartbeat). Plumbing, so
-  # not audited — like Loam::ApiToken.
-  class RecordLock < Loam::TenantRecord
-    self.table_name = "loam_record_locks"
+  # not audited — like OpenLoam::ApiToken.
+  class RecordLock < OpenLoam::TenantRecord
+    self.table_name = "open_loam_record_locks"
 
     belongs_to :locked_by, class_name: "User"
 

data/app/models/{loam → open_loam}/scheduled_job.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A recurring job that runs on a schedule (cron or interval). Tenant-scoped:
   # a "tenant"-scope schedule enqueues its job in this tenant on schedule; a
   # "system"-scope schedule enqueues once with no tenant context. Audited on
   # config changes (not per run — runs are tracked by last_run_at/next_run_at).
   #
   # SECURITY: job_class is validated to be a known ActiveJob (see
-  # Loam::Scheduler.resolve_job_class) at save AND at enqueue — a scheduler that
+  # OpenLoam::Scheduler.resolve_job_class) at save AND at enqueue — a scheduler that
   # constantized and ran arbitrary user input would be a code-execution hole.
-  class ScheduledJob < Loam::TenantRecord
-    self.table_name = "loam_scheduled_jobs"
+  class ScheduledJob < OpenLoam::TenantRecord
+    self.table_name = "open_loam_scheduled_jobs"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     SCOPES = %w[tenant system].freeze
     LOCK_TTL = 5.minutes    # how long a claim holds a due job before another tick may retry it
@@ -26,11 +26,11 @@ module Loam
     # The next fire time strictly after `from`, in this job's timezone (UTC when
     # unset). Stored in next_run_at as UTC.
     def compute_next_run(from = Time.current)
-      Loam::Cron.next_after(schedule, from: from, zone: timezone.presence || "UTC")
+      OpenLoam::Cron.next_after(schedule, from: from, zone: timezone.presence || "UTC")
     end
 
     def job_class_constant
-      Loam::Scheduler.resolve_job_class(job_class)
+      OpenLoam::Scheduler.resolve_job_class(job_class)
     end
 
     private

data/app/models/open_loam/search_token.rb

@@ -0,0 +1,9 @@
+module OpenLoam
+  # The word-level search index maintained by OpenLoam::Search::TokenDriver: one row
+  # per (record, token), tenant-scoped like every OpenLoam entity. Plumbing — not
+  # audited, not soft-deletable. Only the TokenDriver reads or writes it; under
+  # the default LikeDriver this table simply stays empty.
+  class SearchToken < OpenLoam::TenantRecord
+    self.table_name = "open_loam_search_tokens"
+  end
+end

data/app/models/{loam → open_loam}/sso_identity.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # Links an external IdP identity (a provider's stable `sub`) to a local User.
   # The durable key SSO callbacks resolve on — an email can change at the IdP,
   # `sub` does not. Tenant-scoped (created and read inside the provider's tenant).
-  class SsoIdentity < Loam::TenantRecord
-    self.table_name = "loam_sso_identities"
+  class SsoIdentity < OpenLoam::TenantRecord
+    self.table_name = "open_loam_sso_identities"
 
     belongs_to :user
-    belongs_to :sso_provider, class_name: "Loam::SsoProvider"
+    belongs_to :sso_provider, class_name: "OpenLoam::SsoProvider"
 
     validates :sub, presence: true, uniqueness: { scope: :sso_provider_id }
   end