open-loam 0.1.1 → 0.2.0

data/lib/{loam → open_loam}/mcp.rb

@@ -1,17 +1,17 @@
-module Loam
-  # An MCP (Model Context Protocol) server surface exposing Loam to an AI agent —
+module OpenLoam
+  # An MCP (Model Context Protocol) server surface exposing OpenLoam to an AI agent —
   # tools-only v1 (L-302). It lets an agent DISCOVER the domain (entities, schema,
   # policy, workflow) and READ tenant-scoped records, and PROPOSE writes that are
   # STAGED for human approval — never committed. Everything runs inside the
   # tenant + actor of the API token the server authenticated with; whatever that
   # user may do, no more. Approval authority stays with a human in the admin.
   #
-  # Two layers: the tool methods (pure, assume Loam::Current is established) and
+  # Two layers: the tool methods (pure, assume OpenLoam::Current is established) and
   # `handle_jsonrpc` (a pure JSON-RPC dispatcher for initialize / tools/list /
   # tools/call). The stdio transport (newline-delimited JSON-RPC) lives in
-  # Loam::Mcp::Server.
+  # OpenLoam::Mcp::Server.
   #
-  # SECURITY posture, reusing Loam's existing gates:
+  # SECURITY posture, reusing OpenLoam's existing gates:
   #   * entity names resolve against an allowlist (API-exposed TenantRecord
   #     descendants), never a bare constantize;
   #   * query filters/order are whitelisted to real columns (or a known custom
@@ -32,7 +32,7 @@ module Loam
     TOOLS = [
       {
         name: "list_entities",
-        description: "List the business entities available in this Loam tenant.",
+        description: "List the business entities available in this OpenLoam tenant.",
         inputSchema: { type: "object", properties: {}, additionalProperties: false }
       },
       {
@@ -72,7 +72,7 @@ module Loam
       },
       {
         name: "stage_write",
-        description: "PROPOSE an update to one record. It is staged as a Loam PendingAction for a human manager to approve — it does NOT take effect until approved. Only policy-writable columns are accepted; the workflow column is refused (use a transition).",
+        description: "PROPOSE an update to one record. It is staged as a OpenLoam PendingAction for a human manager to approve — it does NOT take effect until approved. Only policy-writable columns are accepted; the workflow column is refused (use a transition).",
         inputSchema: {
           type: "object",
           properties: {
@@ -91,9 +91,9 @@ module Loam
 
     def entities
       # Models are lazy-loaded (Zeitwerk), so `descendants` is only complete after
-      # an eager load — same as Loam::OpenApi's discovery.
+      # an eager load — same as OpenLoam::OpenApi's discovery.
       Rails.application.eager_load! if defined?(Rails) && Rails.respond_to?(:application)
-      Loam::TenantRecord.descendants
+      OpenLoam::TenantRecord.descendants
                         .reject { |model| model.name.blank? }
                         .select { |model| api_exposed?(model) }
                         .sort_by(&:name)
@@ -117,7 +117,7 @@ module Loam
 
     def describe_entity(entity:)
       model = resolve!(entity)
-      policy = Loam::Policy.for(model.new)
+      policy = OpenLoam::Policy.for(model.new)
 
       columns = model.columns.reject { |c| c.name.end_with?("_hash") }.map do |col|
         { name: col.name, type: col.sql_type_metadata.type.to_s,
@@ -134,8 +134,8 @@ module Loam
         []
       end
 
-      workflow = if model.respond_to?(:loam_workflow) && model.loam_workflow
-        wf = model.loam_workflow
+      workflow = if model.respond_to?(:open_loam_workflow) && model.open_loam_workflow
+        wf = model.open_loam_workflow
         { column: wf.column, states: wf.states,
           transitions: wf.transitions.values.map { |t| { name: t.name.to_s, from: t.from, to: t.to, roles: Array(t.roles).map(&:to_s) } } }
       end
@@ -145,7 +145,7 @@ module Loam
 
     def query_entity(entity:, filters: [], order: nil, dir: "asc", limit: MAX_LIMIT)
       model = resolve!(entity)
-      policy = Loam::Policy.for(model.new)
+      policy = OpenLoam::Policy.for(model.new)
       scope = apply_filters(model, model.all, filters, policy)
       scope = apply_order(model, scope, order, dir)
       capped = [ [ limit.to_i, 1 ].max, MAX_LIMIT ].min
@@ -157,8 +157,8 @@ module Loam
     def stage_write(entity:, id:, changes:)
       model = resolve!(entity)
       record = model.find(id) # tenant-scoped
-      policy = Loam::Policy.for(record)
-      workflow_column = model.respond_to?(:loam_workflow) ? model.loam_workflow&.column.to_s : nil
+      policy = OpenLoam::Policy.for(record)
+      workflow_column = model.respond_to?(:open_loam_workflow) ? model.open_loam_workflow&.column.to_s : nil
 
       clean = {}
       (changes || {}).each do |field, value|
@@ -177,7 +177,7 @@ module Loam
       end
       raise ToolError, "no writable changes" if clean.empty?
 
-      action = Loam::PendingActions.stage(
+      action = OpenLoam::PendingActions.stage(
         summary: "MCP proposal: update #{model.name}##{id}",
         on: record, action: :update, changes: clean
       )
@@ -206,14 +206,14 @@ module Loam
       when "initialize"
         ok(id, protocolVersion: request.dig("params", "protocolVersion") || PROTOCOL_VERSION,
                capabilities: { tools: {} },
-               serverInfo: { name: "loam", version: Loam::VERSION })
+               serverInfo: { name: "open_loam", version: OpenLoam::VERSION })
       when "tools/list"
         ok(id, tools: TOOLS)
       when "tools/call"
         begin
           data = call_tool(request.dig("params", "name"), request.dig("params", "arguments"))
           ok(id, content: [ { type: "text", text: JSON.generate(data) } ])
-        rescue ToolError, Loam::Error, ActiveRecord::RecordNotFound => error
+        rescue ToolError, OpenLoam::Error, ActiveRecord::RecordNotFound => error
           ok(id, isError: true, content: [ { type: "text", text: error.message } ])
         end
       when "notifications/initialized", "notifications/cancelled", nil
@@ -239,8 +239,8 @@ module Loam
           # CustomFieldIndex.filter carries its own L-711 read-ACL for the current
           # actor; surface its refusal as a clean tool error.
           begin
-            scope = scope.merge(Loam::CustomFieldIndex.filter(model, field, op, value))
-          rescue Loam::FieldAccessError => error
+            scope = scope.merge(OpenLoam::CustomFieldIndex.filter(model, field, op, value))
+          rescue OpenLoam::FieldAccessError => error
             raise ToolError, error.message
           end
         else
@@ -274,7 +274,7 @@ module Loam
 
     def serialize(record, policy)
       model = record.class
-      encrypted = model.respond_to?(:loam_encrypted_attributes) ? model.loam_encrypted_attributes.map(&:to_s) : []
+      encrypted = model.respond_to?(:open_loam_encrypted_attributes) ? model.open_loam_encrypted_attributes.map(&:to_s) : []
 
       json = {}
       policy.readable_fields(model.column_names).each do |col|

data/lib/{loam → open_loam}/notifications.rb

@@ -1,14 +1,14 @@
-module Loam
+module OpenLoam
   # The one way to tell someone something inside the app.
   #
-  #   Loam::Notifications.notify(user, title: "Order approved", source: order)
-  #   Loam::Notifications.notify_role(:manager, title: "New damage report")
+  #   OpenLoam::Notifications.notify(user, title: "Order approved", source: order)
+  #   OpenLoam::Notifications.notify_role(:manager, title: "New damage report")
   #
-  # Records land in the CURRENT tenant (Loam::Notification is tenant-scoped),
+  # Records land in the CURRENT tenant (OpenLoam::Notification is tenant-scoped),
   # so a notification can never be delivered across a tenant boundary.
   #
   # The intended pattern is event -> notification: subscribe to a domain event
-  # in config/initializers/loam.rb and notify from there, instead of scattering
+  # in config/initializers/open_loam.rb and notify from there, instead of scattering
   # delivery calls through models and controllers.
   module Notifications
     # Returns the created notifications. Accepts one user or many; `source` is

data/lib/{loam → open_loam}/open_api.rb

@@ -1,17 +1,17 @@
 require "json"
 
-module Loam
+module OpenLoam
   # Auto-generates an OpenAPI 3.1 document for the app's JSON API by
-  # INTROSPECTING what Loam already knows — the generated `Api::<Plural>Controller`s,
+  # INTROSPECTING what OpenLoam already knows — the generated `Api::<Plural>Controller`s,
   # each entity's columns/types, its exposed `FIELDS`, its custom fields, and that
   # every endpoint is bearer-authenticated and tenant-scoped. No hand-written
   # annotations, no external gem.
   #
-  #   Loam::OpenApi.document   # => a Hash conforming to OpenAPI 3.1
-  #   Loam::OpenApi.markdown   # => a Markdown rendering
+  #   OpenLoam::OpenApi.document   # => a Hash conforming to OpenAPI 3.1
+  #   OpenLoam::OpenApi.markdown   # => a Markdown rendering
   #
   # The document describes the SHAPE of the API only — never tenant data. It is
-  # served at /admin/api_docs and exported by `bin/rails loam:openapi:export`.
+  # served at /admin/api_docs and exported by `bin/rails open_loam:openapi:export`.
   module OpenApi
     TYPE_MAP = {
       "string" => { "type" => "string" }, "text" => { "type" => "string" },
@@ -40,13 +40,13 @@ module Loam
       }
     end
 
-    # The Loam entities that have a generated JSON API controller. Anonymous
-    # subclasses (Class.new(Loam::TenantRecord), common in tests) have no name,
+    # The OpenLoam entities that have a generated JSON API controller. Anonymous
+    # subclasses (Class.new(OpenLoam::TenantRecord), common in tests) have no name,
     # so model_name would raise "Class name cannot be blank" — skip them: a
     # nameless class has no controller or route to document anyway.
     def api_entities
       Rails.application.eager_load! if defined?(Rails) && Rails.respond_to?(:application)
-      Loam::TenantRecord.descendants
+      OpenLoam::TenantRecord.descendants
                         .reject { |model| model.name.blank? }
                         .select { |model| controller_for(model) }
                         .sort_by(&:name)
@@ -59,17 +59,17 @@ module Loam
     end
 
     def info
-      name = defined?(Rails) ? Rails.application.class.module_parent_name : "Loam"
+      name = defined?(Rails) ? Rails.application.class.module_parent_name : "OpenLoam"
       {
         "title" => "#{name} API",
         "version" => "1.0.0",
-        "description" => "Auto-generated from the Loam entities. Bearer-token authenticated. #{TENANCY_NOTE}"
+        "description" => "Auto-generated from the OpenLoam entities. Bearer-token authenticated. #{TENANCY_NOTE}"
       }
     end
 
     def security_schemes
       { "bearerAuth" => { "type" => "http", "scheme" => "bearer",
-                          "description" => "A Loam::ApiToken — identifies one user in one tenant." } }
+                          "description" => "A OpenLoam::ApiToken — identifies one user in one tenant." } }
     end
 
     def schemas
@@ -89,7 +89,7 @@ module Loam
 
     # Request body: the writable, declared fields only — never id/tenant_id/
     # timestamps. Field-level write access is enforced per the token's role at
-    # runtime (Loam::Policy), which a structural schema can't express per-role;
+    # runtime (OpenLoam::Policy), which a structural schema can't express per-role;
     # noted in the description rather than emitting a schema per role.
     def input_schema(model)
       props = {}
@@ -143,9 +143,9 @@ module Loam
       return controller::FIELDS.map(&:to_s) if controller.const_defined?(:FIELDS)
 
       # No declared FIELDS: fall back to columns, but NEVER surface an encrypted
-      # column or its blind-index `_hash` (same exclusion as Loam::Export).
-      encrypted = model.respond_to?(:loam_encrypted_attributes) ? model.loam_encrypted_attributes : []
-      blind = model.respond_to?(:loam_searchable_encrypted_attributes) ? model.loam_searchable_encrypted_attributes.map { |a| "#{a}_hash" } : []
+      # column or its blind-index `_hash` (same exclusion as OpenLoam::Export).
+      encrypted = model.respond_to?(:open_loam_encrypted_attributes) ? model.open_loam_encrypted_attributes : []
+      blind = model.respond_to?(:open_loam_searchable_encrypted_attributes) ? model.open_loam_searchable_encrypted_attributes.map { |a| "#{a}_hash" } : []
       model.column_names - plumbing(model) - encrypted - blind
     end
 
@@ -161,7 +161,7 @@ module Loam
     end
 
     def custom_field_names(model)
-      return [] unless model.respond_to?(:custom_field_definitions) && Loam::Current.tenant
+      return [] unless model.respond_to?(:custom_field_definitions) && OpenLoam::Current.tenant
 
       model.custom_field_definitions.map(&:name)
     rescue StandardError

data/lib/{loam → open_loam}/overrides.rb

@@ -1,13 +1,13 @@
-module Loam
-  # Disable or replace an entry in one of Loam's OWN keyed registries from an
+module OpenLoam
+  # Disable or replace an entry in one of OpenLoam's OWN keyed registries from an
   # initializer — customization without forking the gem, and without
   # monkeypatching. This is deliberately SMALL: Rails already handles structural
   # overriding (shadow a view/controller by path, prepend a module). Overrides
   # only covers the in-gem keyed registries, where path-shadowing doesn't reach:
   #
-  #   Loam::Overrides.disable(:widgets, "open_progress")            # drop a built-in widget
-  #   Loam::Overrides.replace(:widgets, "audit_recent") { |actor| { kind: "count", value: 0 } }
-  #   Loam::Overrides.disable(:broadcast_events, "loam.progress.")  # stop pushing an event over SSE
+  #   OpenLoam::Overrides.disable(:widgets, "open_progress")            # drop a built-in widget
+  #   OpenLoam::Overrides.replace(:widgets, "audit_recent") { |actor| { kind: "count", value: 0 } }
+  #   OpenLoam::Overrides.disable(:broadcast_events, "open_loam.progress.")  # stop pushing an event over SSE
   #
   # THE VALUE-ADD over raw monkeypatching: a stale override (a typo, or an entry
   # that no longer exists) is caught at boot by `check!` and warned about, so a
@@ -19,7 +19,7 @@ module Loam
   # doesn't wrap those. Controllers/views/routes are NOT here — that's Rails'
   # path-shadowing job (see docs).
   module Overrides
-    DISABLED = :__loam_disabled__
+    DISABLED = :__open_loam_disabled__
 
     class << self
       def disable(registry, key)
@@ -81,7 +81,7 @@ module Loam
       def check!
         found = stale
         found.each do |registry, key|
-          message = "[loam] stale override: #{registry} has no entry #{key.inspect} to disable/replace — the override is doing nothing."
+          message = "[open_loam] stale override: #{registry} has no entry #{key.inspect} to disable/replace — the override is doing nothing."
           logger ? logger.warn(message) : warn(message)
         end
         found
@@ -96,9 +96,9 @@ module Loam
       # The live keys of an introspectable registry, or nil when we can't tell.
       def known_keys(registry)
         case registry.to_sym
-        when :widgets then Loam::Widgets.keys
-        when :broadcast_events then Loam.broadcast_events
-        when :scheduler then defined?(Loam::Scheduler) ? Loam::Scheduler.registered.map { |d| d[:key] } : nil
+        when :widgets then OpenLoam::Widgets.keys
+        when :broadcast_events then OpenLoam.broadcast_events
+        when :scheduler then defined?(OpenLoam::Scheduler) ? OpenLoam::Scheduler.registered.map { |d| d[:key] } : nil
         end
       end
 

data/lib/{loam → open_loam}/pending_actions.rb

@@ -1,19 +1,19 @@
-module Loam
-  # Staging and reviewing gated mutations (see Loam::PendingAction).
+module OpenLoam
+  # Staging and reviewing gated mutations (see OpenLoam::PendingAction).
   #
-  #   pending = Loam::PendingActions.stage(
+  #   pending = OpenLoam::PendingActions.stage(
   #     summary: "Raise the excavator's daily rate to 1100",
   #     on: equipment, action: :update, changes: { daily_rate: 1100 }
   #   )
   #   pending.preview            # => { "daily_rate" => { "from" => 950, "to" => 1100 } }
   #   pending.approve!(by: manager)   # role-gated; executes the change
   #
-  # `stage` NEVER touches the target — it only records the intent. Loam does not
+  # `stage` NEVER touches the target — it only records the intent. OpenLoam does not
   # intercept Active Record globally (that would be fragile and out of scope);
   # this is the primitive a confirm-mode write path calls instead of saving.
   module PendingActions
     class << self
-      def stage(summary:, on:, action:, changes: {}, idempotency_key: nil, actor: Loam::Current.actor)
+      def stage(summary:, on:, action:, changes: {}, idempotency_key: nil, actor: OpenLoam::Current.actor)
         target_type, target_id = resolve_target(on)
         changes = changes.transform_keys(&:to_s)
         key = idempotency_key || compute_key(target_type, target_id, action, changes)
@@ -21,10 +21,10 @@ module Loam
         # The same proposal staged twice collapses to one row — but only a still
         # PENDING one. A rejected or executed proposal with this key may be
         # re-staged as a fresh pending row (the partial index allows the coexist).
-        existing = Loam::PendingAction.pending.find_by(idempotency_key: key)
+        existing = OpenLoam::PendingAction.pending.find_by(idempotency_key: key)
         return existing if existing
 
-        Loam::PendingAction.create!(
+        OpenLoam::PendingAction.create!(
           actor_id: actor&.id,
           action_type: action.to_s,
           target_type: target_type,
@@ -35,7 +35,7 @@ module Loam
         )
       rescue ActiveRecord::RecordNotUnique
         # Lost a concurrent double-stage race — return the pending row that won.
-        Loam::PendingAction.pending.find_by!(idempotency_key: key)
+        OpenLoam::PendingAction.pending.find_by!(idempotency_key: key)
       end
 
       private
@@ -53,7 +53,7 @@ module Loam
       # the same key; a reordered hash is treated as a different proposal.
       def compute_key(target_type, target_id, action, changes)
         payload = [ target_type, target_id, action, changes.to_json ].join("|")
-        Loam::Encryption.blind_index_scoped(payload, "tenant/#{Loam.tenant!.id}")
+        OpenLoam::Encryption.blind_index_scoped(payload, "tenant/#{OpenLoam.tenant!.id}")
       end
     end
   end

data/lib/{loam → open_loam}/permissions.rb

@@ -1,21 +1,21 @@
-module Loam
+module OpenLoam
   # Feature-string permissions with wildcards (L-705) — a fine-grained capability
   # layer that sits UNDER the coarse role. Roles answer "manager or clerk";
   # permissions answer "may this role do `equipment.edit`" without inventing a new
-  # role for every distinction. Orthogonal to Loam::Policy (which gates field-level
-  # writes on a record) and to Loam::Features (a per-tenant capability switch).
+  # role for every distinction. Orthogonal to OpenLoam::Policy (which gates field-level
+  # writes on a record) and to OpenLoam::Features (a per-tenant capability switch).
   #
   # Declared once, in the initializer (like broadcast_events / scheduler defaults):
   #
-  #   Loam::Permissions.configure do
+  #   OpenLoam::Permissions.configure do
   #     role :admin,   allow: "*"                              # everything
   #     role :manager, allow: %w[equipment.* damage_report.* billing.read]
   #     role :clerk,   allow: %w[equipment.read damage_report.create]
   #   end
   #
-  #   Loam::Permissions.allow?(:clerk, "equipment.read")  # => true
-  #   Loam::Permissions.allow?(:clerk, "equipment.edit")  # => false
-  #   Loam.can?("equipment.edit")                          # for the current actor's role
+  #   OpenLoam::Permissions.allow?(:clerk, "equipment.read")  # => true
+  #   OpenLoam::Permissions.allow?(:clerk, "equipment.edit")  # => false
+  #   OpenLoam.can?("equipment.edit")                          # for the current actor's role
   #
   # DENY BY DEFAULT: a role with no matching grant (or no grants at all) is denied.
   #
@@ -72,7 +72,7 @@ module Loam
     # Tiny DSL so `configure { role ... }` reads well without a receiver.
     class DSL
       def role(name, allow:)
-        Loam::Permissions.role(name, allow: allow)
+        OpenLoam::Permissions.role(name, allow: allow)
       end
     end
   end

data/lib/{loam → open_loam}/perspectives.rb

@@ -1,20 +1,20 @@
-module Loam
-  # Reading the saved views (Loam::Perspective) a user may see for an entity.
+module OpenLoam
+  # Reading the saved views (OpenLoam::Perspective) a user may see for an entity.
   #
-  #   Loam::Perspectives.visible_to("Equipment", user: current_actor)   # pick list
-  #   Loam::Perspectives.default_for("Equipment", user: current_actor)  # the applicable default
-  #   Loam::Perspectives.resolve("Equipment", user:, id: params[:perspective_id])
+  #   OpenLoam::Perspectives.visible_to("Equipment", user: current_actor)   # pick list
+  #   OpenLoam::Perspectives.default_for("Equipment", user: current_actor)  # the applicable default
+  #   OpenLoam::Perspectives.resolve("Equipment", user:, id: params[:perspective_id])
   #
-  # Every query is tenant-scoped by Loam::Perspective. The membership role used
+  # Every query is tenant-scoped by OpenLoam::Perspective. The membership role used
   # for role-shared views is the user's role in the CURRENT tenant.
   module Perspectives
     class << self
       # The views this user may see for an entity: their own private ones, the
       # role-shared ones matching their membership role, and the tenant-wide
       # ones. Default(s) first, then by name. Named `visible_to` rather than
-      # `for` so it does not read like Loam::Policy.for (which builds a policy).
+      # `for` so it does not read like OpenLoam::Policy.for (which builds a policy).
       def visible_to(entity_type, user:)
-        base = Loam::Perspective.where(entity_type: entity_type.to_s)
+        base = OpenLoam::Perspective.where(entity_type: entity_type.to_s)
         role = membership_role(user)
 
         # Build the OR chain on UNORDERED relations — `.or` refuses to combine
@@ -55,7 +55,7 @@ module Loam
       def membership_role(user)
         return nil unless user
 
-        Loam::Membership.find_by(user_id: user.id)&.role
+        OpenLoam::Membership.find_by(user_id: user.id)&.role
       end
     end
   end

data/lib/{loam → open_loam}/policy.rb

@@ -1,13 +1,13 @@
-module Loam
+module OpenLoam
   # Base policy. One policy class per entity, one instance per (actor, record)
   # pair. Action checks (read?/create?/update?/destroy?) default to "any member
   # of the current tenant"; field-level write access is declared, not coded:
   #
-  #   class EquipmentPolicy < Loam::Policy
+  #   class EquipmentPolicy < OpenLoam::Policy
   #     field :daily_rate, writable: [:manager]
   #   end
   #
-  # Roles come from Loam::Membership (actor + current tenant -> role).
+  # Roles come from OpenLoam::Membership (actor + current tenant -> role).
   class Policy
     class << self
       def field_rules
@@ -22,7 +22,7 @@ module Loam
         policy_class = "#{record.class.name}Policy".safe_constantize
         raise Error, "No policy defined for #{record.class.name} (expected #{record.class.name}Policy)" unless policy_class
 
-        policy_class.new(Loam::Current.actor, record)
+        policy_class.new(OpenLoam::Current.actor, record)
       end
     end
 
@@ -36,7 +36,7 @@ module Loam
     def role
       return nil unless actor
 
-      @role ||= Loam::Membership.find_by(user_id: actor.id)&.role&.to_sym
+      @role ||= OpenLoam::Membership.find_by(user_id: actor.id)&.role&.to_sym
     end
 
     def member? = role.present?
@@ -73,7 +73,7 @@ module Loam
     end
 
     # Same semantics as the static `field writable:` declaration, but for a
-    # runtime Loam::FieldDefinition (see Loam::CustomFields): no
+    # runtime OpenLoam::FieldDefinition (see OpenLoam::CustomFields): no
     # writable_roles recorded means any member may write it.
     def custom_field_writable?(field_name)
       return false unless member?

data/lib/{loam → open_loam}/progress.rb

@@ -1,8 +1,8 @@
-module Loam
+module OpenLoam
   # Entry point for progress tracking. Start a job, then drive it through the
-  # returned Loam::ProgressJob:
+  # returned OpenLoam::ProgressJob:
   #
-  #   progress = Loam::Progress.start(name: "Reindex", total: equipment.count)
+  #   progress = OpenLoam::Progress.start(name: "Reindex", total: equipment.count)
   #   equipment.find_each do |record|
   #     break if progress.cancelled?   # cooperative cancel
   #     do_work(record)
@@ -12,18 +12,18 @@ module Loam
   #
   # The job is created in the current tenant (and stamped with the current
   # actor), so it is only visible and streamable there. In a background job,
-  # establish the tenant with Loam.as_tenant first, like the webhook/digest jobs.
+  # establish the tenant with OpenLoam.as_tenant first, like the webhook/digest jobs.
   module Progress
     module_function
 
     def start(name:, total:, key: nil)
-      Loam::ProgressJob.create!(
+      OpenLoam::ProgressJob.create!(
         key: key,
         name: name,
         total: total.to_i,
         completed: 0,
         status: "running",
-        actor_id: Loam.actor&.id,
+        actor_id: OpenLoam.actor&.id,
         started_at: Time.current
       )
     end

data/lib/{loam → open_loam}/record_locks.rb

@@ -1,15 +1,15 @@
-module Loam
-  # Advisory record locks (Loam::RecordLock) — a "who's editing this" courtesy
+module OpenLoam
+  # Advisory record locks (OpenLoam::RecordLock) — a "who's editing this" courtesy
   # for the multi-user admin.
   #
-  #   Loam::RecordLocks.acquire(record, by: current_actor)  # take/refresh, or nil if held
-  #   Loam::RecordLocks.holder(record)                      # the user holding it, or nil
-  #   Loam::RecordLocks.release(record, by: current_actor)  # give it up
-  #   Loam::RecordLocks.force_release(record)               # manager override
+  #   OpenLoam::RecordLocks.acquire(record, by: current_actor)  # take/refresh, or nil if held
+  #   OpenLoam::RecordLocks.holder(record)                      # the user holding it, or nil
+  #   OpenLoam::RecordLocks.release(record, by: current_actor)  # give it up
+  #   OpenLoam::RecordLocks.force_release(record)               # manager override
   #
   # THIS IS ADVISORY: a held lock warns, it does not hard-block — optimistic
   # locking (lock_version) is the actual guarantee that two edits can't clobber.
-  # Every query is tenant-scoped by Loam::RecordLock, so a lock is invisible and
+  # Every query is tenant-scoped by OpenLoam::RecordLock, so a lock is invisible and
   # unaffectable from another tenant.
   module RecordLocks
     DEFAULT_TTL = 5.minutes
@@ -25,7 +25,7 @@ module Loam
         lock = lock_row(record)
         return nil if lock && !lock.expired? && lock.locked_by_id != by.id
 
-        lock ||= Loam::RecordLock.new(lockable_type: type_of(record), lockable_id: record.id)
+        lock ||= OpenLoam::RecordLock.new(lockable_type: type_of(record), lockable_id: record.id)
         # A fresh session token when the lock is newly created or taken over from
         # an expired holder; kept as-is on a heartbeat by the same user.
         lock.token = SecureRandom.hex(16) if lock.new_record? || lock.locked_by_id != by.id
@@ -71,7 +71,7 @@ module Loam
       private
 
       def lock_row(record)
-        Loam::RecordLock.find_by(lockable_type: type_of(record), lockable_id: record.id)
+        OpenLoam::RecordLock.find_by(lockable_type: type_of(record), lockable_id: record.id)
       end
 
       def type_of(record)