open-loam 0.1.0 → 0.2.0

data/lib/generators/{loam → open_loam}/install/templates/admin/sessions_controller.rb

@@ -1,12 +1,12 @@
 module Admin
   # Email + password login for the admin, then (if the user has MFA) a TOTP
-  # challenge, then the tenant pick. A Loam user can belong to several tenants,
+  # challenge, then the tenant pick. A OpenLoam user can belong to several tenants,
   # so: authenticate → second factor → choose a tenant where they hold a
   # membership. The second factor runs BEFORE any tenant is chosen, which is why
-  # the MFA secret is keyed to the user, not a tenant (Loam::MfaCredential).
+  # the MFA secret is keyed to the user, not a tenant (OpenLoam::MfaCredential).
   #
   # Not a BaseController subclass: everything there assumes an established
-  # Loam::Current, which is exactly what this controller is trying to build.
+  # OpenLoam::Current, which is exactly what this controller is trying to build.
   class SessionsController < ActionController::Base
     layout "admin"
 
@@ -14,17 +14,17 @@ module Admin
       return redirect_to mfa_challenge_admin_session_path if session[:mfa_pending]
 
       @user = authenticated_user
-      @tenants = @user ? Loam::Membership.tenants_for(@user) : Loam::Tenant.none
+      @tenants = @user ? OpenLoam::Membership.tenants_for(@user) : OpenLoam::Tenant.none
     end
 
     def create
       email = params[:email]
 
-      # Rate-limit BEFORE touching the password (Loam::AuthThrottle). Throttle by
+      # Rate-limit BEFORE touching the password (OpenLoam::AuthThrottle). Throttle by
       # the submitted identifier whether or not the account exists, and give the
       # SAME generic locked response either way — so a lockout can't become an
       # account-existence oracle.
-      if Loam::AuthThrottle.locked?(email)
+      if OpenLoam::AuthThrottle.locked?(email)
         @error = throttle_message(email)
         return render :new, status: :too_many_requests
       end
@@ -32,20 +32,20 @@ module Admin
       user = User.authenticate_by(email: email, password: params[:password])
 
       if user.nil?
-        Loam::AuthThrottle.record_failure(email, kind: "password", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(email, kind: "password", ip: request.remote_ip)
         # One message for both cases on purpose: saying which half was wrong
         # tells an attacker which emails exist.
         @error = "Wrong email or password."
         return render :new, status: :unauthorized
       end
 
-      Loam::AuthThrottle.clear(email) # a successful login resets the counter
+      OpenLoam::AuthThrottle.clear(email) # a successful login resets the counter
       reset_session # a fresh session id at login: no fixation
       session[:user_id] = user.id
 
       # Password is only the first factor when MFA is active — hold the login in
       # a "pending" state (no tenant, no access) until the code checks out.
-      if Loam::MfaCredential.active_for(user)
+      if OpenLoam::MfaCredential.active_for(user)
         session[:mfa_pending] = true
         redirect_to mfa_challenge_admin_session_path
       else
@@ -65,20 +65,20 @@ module Admin
 
       # A 6-digit TOTP (with drift, several codes valid) is the prime brute-force
       # target — lock it out on the user's identifier.
-      if Loam::AuthThrottle.locked?(user.email)
+      if OpenLoam::AuthThrottle.locked?(user.email)
         @user = user
         @error = throttle_message(user.email)
         return render :mfa_challenge, status: :too_many_requests
       end
 
-      credential = Loam::MfaCredential.active_for(user)
+      credential = OpenLoam::MfaCredential.active_for(user)
 
       if credential.verify_totp(params[:code]) || credential.consume_recovery_code(params[:code])
-        Loam::AuthThrottle.clear(user.email)
+        OpenLoam::AuthThrottle.clear(user.email)
         session.delete(:mfa_pending)
         complete_authentication(user)
       else
-        Loam::AuthThrottle.record_failure(user.email, kind: "totp", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(user.email, kind: "totp", ip: request.remote_ip)
         # One generic error — never reveal whether a code was close or a
         # recovery code was already spent.
         @user = user
@@ -92,7 +92,7 @@ module Admin
     # back to password login. The `state` is our CSRF token for the round-trip.
     def sso_start
       email = params[:email].to_s
-      provider = Loam::Sso.provider_for(email: email)
+      provider = OpenLoam::Sso.provider_for(email: email)
 
       if provider.nil?
         return redirect_to new_admin_session_path(email: email),
@@ -105,8 +105,8 @@ module Admin
       session[:sso_provider_id] = provider.id
       session[:sso_tenant_id] = provider.tenant_id
 
-      url = Loam.as_tenant(provider.tenant) do
-        Loam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url)
+      url = OpenLoam.as_tenant(provider.tenant) do
+        OpenLoam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url)
                  .authorization_url(state: state, login_hint: email)
       end
       redirect_to url, allow_other_host: true
@@ -124,15 +124,15 @@ module Admin
         return redirect_to new_admin_session_path, alert: "SSO sign-in could not be verified. Please try again."
       end
 
-      tenant = Loam::Tenant.find_by(id: tenant_id)
-      provider = tenant && Loam.as_tenant(tenant) { Loam::SsoProvider.find_by(id: provider_id) }
+      tenant = OpenLoam::Tenant.find_by(id: tenant_id)
+      provider = tenant && OpenLoam.as_tenant(tenant) { OpenLoam::SsoProvider.find_by(id: provider_id) }
       if provider.nil? || !provider.active?
         return redirect_to new_admin_session_path, alert: "That SSO provider is no longer available."
       end
 
-      user = Loam.as_tenant(tenant) do
-        claims = Loam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url).exchange(code: params[:code])
-        Loam::Sso.provision(provider, claims)
+      user = OpenLoam.as_tenant(tenant) do
+        claims = OpenLoam::Sso.build(provider, redirect_uri: sso_callback_admin_session_url).exchange(code: params[:code])
+        OpenLoam::Sso.provision(provider, claims)
       end
 
       reset_session
@@ -141,13 +141,13 @@ module Admin
 
       # SSO establishes primary auth; if the user also runs app-side MFA, still
       # require the second factor (the safe choice — SSO does not waive it).
-      if Loam::MfaCredential.active_for(user)
+      if OpenLoam::MfaCredential.active_for(user)
         session[:mfa_pending] = true
         redirect_to mfa_challenge_admin_session_path
       else
         complete_authentication(user)
       end
-    rescue Loam::Sso::Error
+    rescue OpenLoam::Sso::Error
       # An unverified email, a domain the provider does not own, or any other
       # provisioning refusal: no session, nothing linked, one generic message.
       reset_session
@@ -162,7 +162,7 @@ module Admin
       user = authenticated_user
       return redirect_to new_admin_session_path if user.nil?
 
-      tenant = Loam::Membership.tenants_for(user).find_by(id: params[:tenant_id])
+      tenant = OpenLoam::Membership.tenants_for(user).find_by(id: params[:tenant_id])
 
       # A tenant the user has no membership in is simply not in that list, so
       # picking one is impossible rather than merely forbidden.
@@ -173,7 +173,7 @@ module Admin
 
     def destroy
       reset_session
-      Loam::Current.reset
+      OpenLoam::Current.reset
       redirect_to new_admin_session_path
     end
 
@@ -184,7 +184,7 @@ module Admin
     end
 
     def throttle_message(identifier)
-      minutes = (Loam::AuthThrottle.remaining_lockout(identifier) / 60.0).ceil
+      minutes = (OpenLoam::AuthThrottle.remaining_lockout(identifier) / 60.0).ceil
       "Too many attempts. Try again in about #{[ minutes, 1 ].max} minute(s)."
     end
 
@@ -206,11 +206,11 @@ module Admin
       # SSO knows exactly which tenant to enter (the IdP's), so honor it even for
       # a multi-tenant user rather than showing the picker.
       if (sso_tenant_id = session.delete(:sso_tenant_id))
-        tenant = Loam::Membership.tenants_for(user).find_by(id: sso_tenant_id)
+        tenant = OpenLoam::Membership.tenants_for(user).find_by(id: sso_tenant_id)
         return enter(user, tenant) if tenant
       end
 
-      tenants = Loam::Membership.tenants_for(user)
+      tenants = OpenLoam::Membership.tenants_for(user)
 
       if tenants.one?
         enter(user, tenants.first)
@@ -237,11 +237,11 @@ module Admin
     # resolved in that tenant). If the user's role is on the list and they have
     # no active credential, they are sent to enrollment before they can work.
     def mfa_enrollment_required?(user, tenant)
-      return false if Loam::MfaCredential.active_for(user)
+      return false if OpenLoam::MfaCredential.active_for(user)
 
-      Loam.as_tenant(tenant) do
-        role = Loam::Membership.find_by(user_id: user.id)&.role
-        role.present? && Array(Loam::Configs.get("security.mfa_required_roles", default: [])).include?(role)
+      OpenLoam.as_tenant(tenant) do
+        role = OpenLoam::Membership.find_by(user_id: user.id)&.role
+        role.present? && Array(OpenLoam::Configs.get("security.mfa_required_roles", default: [])).include?(role)
       end
     end
   end

data/lib/generators/{loam → open_loam}/install/templates/admin/sso_providers_controller.rb

@@ -1,6 +1,6 @@
 module Admin
   # Configure this tenant's SSO (OIDC) provider — manager-only, since it governs
-  # who can sign in and at what role. Tenant-scoped by Loam::SsoProvider's default
+  # who can sign in and at what role. Tenant-scoped by OpenLoam::SsoProvider's default
   # scope, so a manager only ever sees and edits their own tenant's connection.
   # The client_secret is WRITE-ONLY: it is encrypted at rest and never rendered
   # back, so editing without retyping it leaves the stored secret untouched.
@@ -10,20 +10,20 @@ module Admin
 
     rescue_from JSON::ParserError do |error|
       flash.now[:alert] = "The group→role map must be valid JSON: #{error.message}"
-      @provider ||= Loam::SsoProvider.new
+      @provider ||= OpenLoam::SsoProvider.new
       render(@provider.persisted? ? :edit : :new, status: :unprocessable_entity)
     end
 
     def index
-      @providers = Loam::SsoProvider.order(:domain)
+      @providers = OpenLoam::SsoProvider.order(:domain)
     end
 
     def new
-      @provider = Loam::SsoProvider.new(protocol: "oidc", active: true, jit_role: "employee")
+      @provider = OpenLoam::SsoProvider.new(protocol: "oidc", active: true, jit_role: "employee")
     end
 
     def create
-      @provider = Loam::SsoProvider.new(provider_params)
+      @provider = OpenLoam::SsoProvider.new(provider_params)
       if @provider.save
         redirect_to admin_sso_providers_path, notice: "SSO provider created."
       else
@@ -49,7 +49,7 @@ module Admin
     private
 
     def set_provider
-      @provider = Loam::SsoProvider.find(params[:id])
+      @provider = OpenLoam::SsoProvider.find(params[:id])
     end
 
     def provider_params

data/lib/generators/{loam → open_loam}/install/templates/admin/sso_providers_form.html.erb

@@ -2,8 +2,8 @@
   <p style="color:#b00"><%%= @error || flash[:alert] %></p>
 <%% end %>
 
-<%# The model is namespaced (Loam::SsoProvider), so an inferred URL/param-scope
-    would be admin_loam_sso_provider_path / loam_sso_provider[...]. Pin both to
+<%# The model is namespaced (OpenLoam::SsoProvider), so an inferred URL/param-scope
+    would be admin_open_loam_sso_provider_path / open_loam_sso_provider[...]. Pin both to
     the un-namespaced route and the "sso_provider" key the controller permits. %>
 <%%= form_with model: @provider, scope: :sso_provider,
       url: (@provider.persisted? ? admin_sso_provider_path(@provider) : admin_sso_providers_path) do |f| %>

data/lib/generators/{loam → open_loam}/install/templates/admin/sudo_controller.rb

@@ -10,18 +10,18 @@ module Admin
     def create
       identifier = "#{current_actor.email}:sudo"  # a distinct throttle bucket from login
 
-      if Loam::AuthThrottle.locked?(identifier)
+      if OpenLoam::AuthThrottle.locked?(identifier)
         @error = "Too many attempts. Try again later."
         return render :new, status: :too_many_requests
       end
 
       if reauthenticated?
-        Loam::AuthThrottle.clear(identifier)
+        OpenLoam::AuthThrottle.clear(identifier)
         session[:sudo_at] = Time.now.to_i
         redirect_to(session.delete(:sudo_return_to).presence || admin_root_path,
                     notice: "Re-authenticated — you can complete the action now.")
       else
-        Loam::AuthThrottle.record_failure(identifier, kind: "sudo", ip: request.remote_ip)
+        OpenLoam::AuthThrottle.record_failure(identifier, kind: "sudo", ip: request.remote_ip)
         @error = "That did not verify. Try again."
         render :new, status: :unauthorized
       end
@@ -32,9 +32,9 @@ module Admin
     # If the user has MFA, step-up takes a TOTP code — NOT a recovery code:
     # recovery codes are single-use and reserved for LOGIN, so a routine sudo
     # must never silently burn one. Otherwise fall back to the password. Either
-    # way it is the SAME person in Loam::Current re-confirming.
+    # way it is the SAME person in OpenLoam::Current re-confirming.
     def reauthenticated?
-      credential = Loam::MfaCredential.active_for(current_actor)
+      credential = OpenLoam::MfaCredential.active_for(current_actor)
       if credential
         credential.verify_totp(params[:code])
       else

data/lib/generators/{loam → open_loam}/install/templates/admin/sudo_new.html.erb

@@ -7,7 +7,7 @@
 <p>This action is sensitive, so please re-authenticate.</p>
 
 <%%= form_with url: admin_sudo_path, method: :post do |f| %>
-  <%% if Loam::MfaCredential.active_for(current_actor) %>
+  <%% if OpenLoam::MfaCredential.active_for(current_actor) %>
     <p>
       <%%= label_tag :code, "Authenticator code" %><br>
       <%%= text_field_tag :code, nil, autofocus: true, autocomplete: "one-time-code", inputmode: "numeric" %>

data/lib/generators/{loam → open_loam}/install/templates/admin/translations_controller.rb

@@ -1,7 +1,7 @@
 module Admin
-  # Per-record content translations (Loam::Translatable) — manager-only, since
+  # Per-record content translations (OpenLoam::Translatable) — manager-only, since
   # translating content is a privileged edit. Scoped by translatable_type +
-  # translatable_id; edits each translatable field across Loam.locales. The base
+  # translatable_id; edits each translatable field across OpenLoam.locales. The base
   # (default-locale) value stays on the record itself and is shown read-only for
   # reference — translations are additive.
   class TranslationsController < BaseController
@@ -12,9 +12,9 @@ module Admin
 
     def update
       params.require(:translations).to_unsafe_h.each do |field, by_locale|
-        next unless @record.class.loam_translatable?(field)
+        next unless @record.class.open_loam_translatable?(field)
 
-        by_locale.each { |locale, value| @record.set_translation(field, locale, value) if Loam.locales.include?(locale) }
+        by_locale.each { |locale, value| @record.set_translation(field, locale, value) if OpenLoam.locales.include?(locale) }
       end
       redirect_to translate_path, notice: "Translations saved."
     end
@@ -22,11 +22,11 @@ module Admin
     private
 
     def set_record
-      model = Loam::Import.allowed_model(params[:translatable_type]) # whitelist: a Loam entity only
-      raise ActiveRecord::RecordNotFound unless model.include?(Loam::Translatable)
+      model = OpenLoam::Import.allowed_model(params[:translatable_type]) # whitelist: a OpenLoam entity only
+      raise ActiveRecord::RecordNotFound unless model.include?(OpenLoam::Translatable)
 
       @record = model.find(params[:translatable_id])
-      @fields = model.loam_translatable_attributes
+      @fields = model.open_loam_translatable_attributes
     end
 
     def translate_path

data/lib/generators/{loam → open_loam}/install/templates/admin/translations_index.html.erb

@@ -1,14 +1,14 @@
 <h1>Translations — <%%= @record.class.model_name.human %> #<%%= @record.id %></h1>
 
-<p>Translate content per locale. The base (<%%= Loam.default_locale.upcase %>) value
+<p>Translate content per locale. The base (<%%= OpenLoam.default_locale.upcase %>) value
 stays on the record; other locales overlay onto it, falling back to the base when
 empty.</p>
 
 <%%= form_with url: translate_path, method: :patch do %>
   <%% @fields.each do |field| %>
     <h3><%%= field.humanize %></h3>
-    <p><em>Base (<%%= Loam.default_locale.upcase %>):</em> <%%= @record.read_attribute(field) %></p>
-    <%% (Loam.locales - [Loam.default_locale]).each do |locale| %>
+    <p><em>Base (<%%= OpenLoam.default_locale.upcase %>):</em> <%%= @record.read_attribute(field) %></p>
+    <%% (OpenLoam.locales - [OpenLoam.default_locale]).each do |locale| %>
       <p>
         <%%= label_tag "translations[#{field}][#{locale}]", locale.upcase %><br>
         <%%= text_field_tag "translations[#{field}][#{locale}]", @record.translations_for(field)[locale] %>

data/lib/generators/{loam → open_loam}/install/templates/admin/webhook_endpoints_controller.rb

@@ -6,15 +6,15 @@ module Admin
     before_action { require_role!(:manager) }
 
     def index
-      @records = Loam::WebhookEndpoint.order(:event_pattern)
+      @records = OpenLoam::WebhookEndpoint.order(:event_pattern)
     end
 
     def new
-      @record = Loam::WebhookEndpoint.new(active: true)
+      @record = OpenLoam::WebhookEndpoint.new(active: true)
     end
 
     def create
-      @record = Loam::WebhookEndpoint.new(permitted_params)
+      @record = OpenLoam::WebhookEndpoint.new(permitted_params)
 
       if @record.save
         redirect_to admin_webhook_endpoints_path
@@ -24,7 +24,7 @@ module Admin
     end
 
     def destroy
-      Loam::WebhookEndpoint.find(params[:id]).destroy!
+      OpenLoam::WebhookEndpoint.find(params[:id]).destroy!
       redirect_to admin_webhook_endpoints_path
     end
 

data/lib/generators/{loam → open_loam}/install/templates/admin/webhook_endpoints_index.html.erb

@@ -28,5 +28,5 @@ domain ("rental."); anything else is one exact event name.</p>
   </tbody>
 </table>
 
-<p>Each delivery is signed: <code>X-Loam-Signature: sha256=HMAC-SHA256(secret, body)</code>.
+<p>Each delivery is signed: <code>X-OpenLoam-Signature: sha256=HMAC-SHA256(secret, body)</code>.
 Recompute it on your side and reject anything that does not match.</p>

data/lib/generators/{loam → open_loam}/install/templates/admin.css

@@ -1,4 +1,4 @@
-/* Loam admin console — shared styles (extracted from the layout, L-402). */
+/* OpenLoam admin console — shared styles (extracted from the layout, L-402). */
 body { font-family: system-ui, -apple-system, sans-serif; margin: 2rem; color: #1c1c1a; line-height: 1.5; }
 h1 { font-size: 1.55rem; margin: 0 0 0.75rem; }
 h2 { font-size: 1.2rem; margin: 1.25rem 0 0.5rem; }

data/lib/generators/{loam → open_loam}/install/templates/api_base_controller.rb

@@ -3,9 +3,9 @@ module Api
   #
   #   curl -H "Authorization: Bearer <token>" http://localhost:3000/api/equipment
   #
-  # A token identifies one user in one tenant, and `Loam::ApiToken.authenticate`
-  # establishes both in Loam::Current before any action runs. From that point
-  # on this is ordinary tenant-scoped Loam code: every query is filtered, every
+  # A token identifies one user in one tenant, and `OpenLoam::ApiToken.authenticate`
+  # establishes both in OpenLoam::Current before any action runs. From that point
+  # on this is ordinary tenant-scoped OpenLoam code: every query is filtered, every
   # write is audited, every policy applies — the API is not a side door.
   #
   # Finding a token is the one lookup that cannot start from a tenant (the
@@ -14,7 +14,7 @@ module Api
   class BaseController < ActionController::API
     before_action :authenticate_api_token!
 
-    rescue_from Loam::NotAuthorizedError do
+    rescue_from OpenLoam::NotAuthorizedError do
       render json: { error: "forbidden" }, status: :forbidden
     end
 
@@ -22,14 +22,14 @@ module Api
       render json: { error: "not_found" }, status: :not_found
     end
 
-    rescue_from Loam::UnknownCustomFieldError do |error|
+    rescue_from OpenLoam::UnknownCustomFieldError do |error|
       render json: { error: error.message }, status: :unprocessable_entity
     end
 
     private
 
     def authenticate_api_token!
-      @api_token = Loam::ApiToken.authenticate(bearer_token)
+      @api_token = OpenLoam::ApiToken.authenticate(bearer_token)
 
       render json: { error: "unauthorized" }, status: :unauthorized unless @api_token
     end
@@ -38,21 +38,21 @@ module Api
       request.headers["Authorization"].to_s[/\ABearer (.+)\z/, 1]
     end
 
-    def current_tenant = Loam::Current.tenant
-    def current_actor = Loam::Current.actor
+    def current_tenant = OpenLoam::Current.tenant
+    def current_actor = OpenLoam::Current.actor
 
     def policy_for(record)
-      Loam::Policy.for(record)
+      OpenLoam::Policy.for(record)
     end
 
     def authorize!(policy, action)
-      raise Loam::NotAuthorizedError unless policy.public_send(action)
+      raise OpenLoam::NotAuthorizedError unless policy.public_send(action)
     end
 
     # The JSON shape of an entity: its columns, custom fields included (they
     # live in the `custom_fields` column that every generated entity carries).
     #
-    # Encrypted fields (Loam::Encryptable) are returned DECRYPTED — the caller is
+    # Encrypted fields (OpenLoam::Encryptable) are returned DECRYPTED — the caller is
     # authenticated, tenant-scoped and policy-gated, exactly like the admin show
     # screen — and their blind-index `<field>_hash` column is dropped, so the
     # equality-leaking hash never goes over the wire. `record.attributes` alone
@@ -60,17 +60,17 @@ module Api
     def entity_json(record, enrichments: nil)
       json = record.attributes
 
-      if record.class.respond_to?(:loam_encrypted_attributes)
-        record.class.loam_encrypted_attributes.each do |name|
+      if record.class.respond_to?(:open_loam_encrypted_attributes)
+        record.class.open_loam_encrypted_attributes.each do |name|
           json[name] = record.public_send(name)
           json.delete("#{name}_hash")
         end
       end
 
-      # Computed cross-module blocks (Loam::Enrichers), under a separate key so
+      # Computed cross-module blocks (OpenLoam::Enrichers), under a separate key so
       # they're never confused with the record's own columns. An index passes the
       # batched result (avoiding N+1); a single show computes it here.
-      enrichments = Loam::Enrichers.enrich(record) if enrichments.nil?
+      enrichments = OpenLoam::Enrichers.enrich(record) if enrichments.nil?
       json["enrichments"] = enrichments if enrichments.present?
       json
     end

data/lib/generators/{loam → open_loam}/install/templates/guardrails_test.rb

@@ -1,21 +1,21 @@
 require "test_helper"
 
-# Structural guardrails. These are not feature tests — they enforce Loam's
+# Structural guardrails. These are not feature tests — they enforce OpenLoam's
 # invariants on the codebase itself. If one of these fails, an agent (or a
 # human) stepped outside the conventions.
-class LoamGuardrailsTest < ActiveSupport::TestCase
-  # Models that are legitimately not tenant-scoped. Loam::Config holds both
+class OpenLoamGuardrailsTest < ActiveSupport::TestCase
+  # Models that are legitimately not tenant-scoped. OpenLoam::Config holds both
   # global (tenant_id NULL) and per-tenant override rows, so tenancy is a
-  # nullable column and resolution lives in vetted gem code (Loam::Configs).
-  # Loam::MfaCredential belongs to the person, who spans tenants — MFA is
+  # nullable column and resolution lives in vetted gem code (OpenLoam::Configs).
+  # OpenLoam::MfaCredential belongs to the person, who spans tenants — MFA is
   # verified at login before any tenant is chosen.
-  TENANCY_ALLOWLIST = %w[ApplicationRecord User Loam::Tenant Loam::Config Loam::MfaCredential Loam::AuthAttempt].freeze
+  TENANCY_ALLOWLIST = %w[ApplicationRecord User OpenLoam::Tenant OpenLoam::Config OpenLoam::MfaCredential OpenLoam::AuthAttempt].freeze
 
   # Rails' own engine models (storage, rich text, jobs) are framework
   # plumbing, not business data — they are out of scope for tenant linting.
   FRAMEWORK_NAMESPACES = %w[ActiveStorage:: ActionText:: ActionMailbox:: SolidQueue:: SolidCache:: SolidCable::].freeze
 
-  test "every app model is tenant-scoped (inherits Loam::TenantRecord)" do
+  test "every app model is tenant-scoped (inherits OpenLoam::TenantRecord)" do
     Rails.application.eager_load!
 
     offenders = ActiveRecord::Base.descendants.reject do |model|
@@ -23,20 +23,20 @@ class LoamGuardrailsTest < ActiveSupport::TestCase
         model.name.nil? ||
         TENANCY_ALLOWLIST.include?(model.name) ||
         FRAMEWORK_NAMESPACES.any? { |ns| model.name.start_with?(ns) } ||
-        model <= Loam::TenantRecord
+        model <= OpenLoam::TenantRecord
     end
 
     assert_empty offenders,
       "These models are NOT tenant-scoped: #{offenders.map(&:name).join(', ')}. " \
-      "Business models must inherit Loam::TenantRecord (use `rails g loam:entity`). " \
+      "Business models must inherit OpenLoam::TenantRecord (use `rails g open_loam:entity`). " \
       "If a model is intentionally global, add it to TENANCY_ALLOWLIST here — in review, on purpose."
   end
 
   test "touching a tenant-scoped model with no tenant context raises" do
-    Loam::Current.reset
+    OpenLoam::Current.reset
 
-    assert_raises(Loam::MissingTenantError) { Loam::AuditRecord.count }
-    assert_raises(Loam::MissingTenantError) { Loam::Membership.first }
+    assert_raises(OpenLoam::MissingTenantError) { OpenLoam::AuditRecord.count }
+    assert_raises(OpenLoam::MissingTenantError) { OpenLoam::Membership.first }
   end
 
   test "nobody uses .unscoped outside vetted framework code" do
@@ -64,16 +64,16 @@ class LoamGuardrailsTest < ActiveSupport::TestCase
       "docs/ and link it, rather than raising the budget."
   end
 
-  test "every Loam::FieldDefinition entity_type resolves to a class that uses Loam::CustomFields" do
+  test "every OpenLoam::FieldDefinition entity_type resolves to a class that uses OpenLoam::CustomFields" do
     Rails.application.eager_load!
 
-    offenders = Loam::FieldDefinition.unscoped.distinct.pluck(:entity_type).reject do |entity_type|
+    offenders = OpenLoam::FieldDefinition.unscoped.distinct.pluck(:entity_type).reject do |entity_type|
       klass = entity_type.safe_constantize
-      klass && klass.include?(Loam::CustomFields)
+      klass && klass.include?(OpenLoam::CustomFields)
     end
 
     assert_empty offenders,
-      "These Loam::FieldDefinition entity_type values don't resolve to a class that " \
-      "`include Loam::CustomFields`: #{offenders.join(', ')}. Likely a typo when the field was created."
+      "These OpenLoam::FieldDefinition entity_type values don't resolve to a class that " \
+      "`include OpenLoam::CustomFields`: #{offenders.join(', ')}. Likely a typo when the field was created."
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/import_job.rb

@@ -1,20 +1,20 @@
-# Runs a CSV import in the background, advancing a Loam::ProgressJob so the admin
-# watches it live (L-915). Carries tenant + actor explicitly, like every Loam job.
+# Runs a CSV import in the background, advancing a OpenLoam::ProgressJob so the admin
+# watches it live (L-915). Carries tenant + actor explicitly, like every OpenLoam job.
 # The per-row summary (created/updated/failed + error rows) is stored on the
 # ProgressJob's `result` for the summary screen.
 class ImportJob < ApplicationJob
   queue_as :default
 
   def perform(entity_type:, csv:, mapping:, match_key:, tenant_id:, actor_id:)
-    tenant = Loam::Tenant.find(tenant_id)
+    tenant = OpenLoam::Tenant.find(tenant_id)
     actor = User.find_by(id: actor_id)
-    model = Loam::Import.allowed_model(entity_type)
+    model = OpenLoam::Import.allowed_model(entity_type)
 
-    Loam.as_tenant(tenant, actor: actor) do
+    OpenLoam.as_tenant(tenant, actor: actor) do
       total = [ CSV.parse(csv).size - 1, 0 ].max
-      progress = Loam::Progress.start(name: "Import #{entity_type}", total: total)
+      progress = OpenLoam::Progress.start(name: "Import #{entity_type}", total: total)
       begin
-        result = Loam::Import.run(csv, model: model, mapping: mapping, actor: actor, match_key: match_key, progress: progress)
+        result = OpenLoam::Import.run(csv, model: model, mapping: mapping, actor: actor, match_key: match_key, progress: progress)
         progress.update_columns(result: result.to_h)
         progress.complete!
       rescue StandardError => error

data/lib/generators/{loam → open_loam}/install/templates/inbound_webhooks_controller.rb

@@ -1,17 +1,17 @@
 # Public endpoint that receives webhooks FROM external systems at
 # /webhooks/:token. No session, no bearer token: the HMAC signature is the auth
 # (ActionController::API, so there is no CSRF to skip). All the verified,
-# replay-resistant work lives in Loam::InboundWebhooks.ingest; this controller
+# replay-resistant work lives in OpenLoam::InboundWebhooks.ingest; this controller
 # only maps its Result to an HTTP status and never leaks tenant context to the
 # next request on this thread.
 class InboundWebhooksController < ActionController::API
   def receive
-    result = Loam::InboundWebhooks.ingest(
+    result = OpenLoam::InboundWebhooks.ingest(
       token: params[:token], raw_body: request.raw_post, headers: request.headers
     )
-    Rails.logger.info("[loam inbound] #{result.status} #{result.reason}") if result.status >= 400
+    Rails.logger.info("[open_loam inbound] #{result.status} #{result.reason}") if result.status >= 400
     head result.status
   ensure
-    Loam::Current.reset
+    OpenLoam::Current.reset
   end
 end