open-loam 0.1.1 → 0.3.0

data/lib/generators/{loam → open_loam}/install/templates/admin/api_tokens_index.html.erb

@@ -37,3 +37,26 @@ audit trail. Send it as <code>Authorization: Bearer &lt;token&gt;</code>.</p>
     <%% end %>
   </tbody>
 </table>
+
+<%% if @tenant_records.any? %>
+  <h2>Everyone else's tokens</h2>
+  <p>Manager view. Removing someone's membership already stops their tokens
+  working; revoking is the clean end of it.</p>
+
+  <table>
+    <thead>
+      <tr><th>Owner</th><th>Label</th><th>Created</th><th>Last used</th><th></th></tr>
+    </thead>
+    <tbody>
+      <%% @tenant_records.each do |record| %>
+        <tr>
+          <td><%%= record.user.name %></td>
+          <td><%%= record.label %></td>
+          <td><%%= record.created_at.to_fs(:short) %></td>
+          <td><%%= record.last_used_at&.to_fs(:short) || "never" %></td>
+          <td><%%= button_to "Revoke", admin_api_token_path(record), method: :delete, form: { style: "display:inline" } %></td>
+        </tr>
+      <%% end %>
+    </tbody>
+  </table>
+<%% end %>

data/lib/generators/{loam → open_loam}/install/templates/admin/base_controller.rb

@@ -4,22 +4,42 @@ module Admin
 
     layout "admin"
 
-    before_action :set_loam_context
+    before_action :set_open_loam_context
+    before_action :require_mfa_enrollment!
     before_action :set_locale
 
-    rescue_from Loam::NotAuthorizedError do
+    # Fails an action that never authorized anything. Forgetting `authorize!` is
+    # otherwise silent — the screen renders, and nothing says the policy was
+    # never consulted.
+    #
+    # It runs AFTER the action, so it catches the omission in development and in
+    # tests; it is not a runtime access-control layer. A `destroy` that forgot to
+    # authorize has already destroyed the record by the time this raises.
+    after_action :verify_authorized!
+
+    # For screens that are authorized STRUCTURALLY rather than by a policy call —
+    # a list scoped to current_actor, a pre-auth screen. The reason is required
+    # and shows up in the source, so every exemption is a documented claim rather
+    # than a silent opt-out.
+    def self.skip_authorization!(reason, **options)
+      raise ArgumentError, "skip_authorization! needs a reason" if reason.to_s.strip.empty?
+
+      skip_after_action :verify_authorized!, **options
+    end
+
+    rescue_from OpenLoam::NotAuthorizedError do
       render plain: "403 Forbidden — your role does not permit this action.", status: :forbidden
     end
 
     # A disabled feature is "not here" for this tenant, so it 404s — unlike a
     # policy refusal (403), which is "you may not". Capability vs. person.
-    rescue_from Loam::FeatureDisabledError do
+    rescue_from OpenLoam::FeatureDisabledError do
       render plain: "404 Not Found — this feature is not enabled for your tenant.", status: :not_found
     end
 
     # A business rule (or any code) can veto a workflow transition from
-    # `loam_perform_transition!`. Surface it as a clean 422, never a 500.
-    rescue_from Loam::TransitionVetoedError do |error|
+    # `open_loam_perform_transition!`. Surface it as a clean 422, never a 500.
+    rescue_from OpenLoam::TransitionVetoedError do |error|
       render plain: "422 — #{error.message}", status: :unprocessable_entity
     end
 
@@ -41,49 +61,65 @@ module Admin
     end
 
     # Locale is request state like the tenant: from the switcher (param),
-    # remembered in the session, defaulting to Loam.default_locale. Content
-    # translations (Loam::Translatable) overlay onto it.
+    # remembered in the session, defaulting to OpenLoam.default_locale. Content
+    # translations (OpenLoam::Translatable) overlay onto it.
     def set_locale
-      session[:locale] = params[:locale] if params[:locale].present? && Loam.locales.include?(params[:locale])
-      Loam::Current.locale = session[:locale] || Loam.default_locale
+      session[:locale] = params[:locale] if params[:locale].present? && OpenLoam.locales.include?(params[:locale])
+      OpenLoam::Current.locale = session[:locale] || OpenLoam.default_locale
       # Drive Rails i18n (UI strings) off the same choice, so the switcher moves
       # both the chrome and the content — but only to a locale that actually has
       # translations, so an unlisted locale keeps English UI (data still overlays).
-      chosen = Loam::Current.locale.to_s
+      chosen = OpenLoam::Current.locale.to_s
       I18n.locale = chosen if I18n.available_locales.map(&:to_s).include?(chosen)
     end
 
-    def current_locale = Loam::Current.locale
+    def current_locale = OpenLoam::Current.locale
 
-    def current_tenant = Loam::Current.tenant
-    def current_actor = Loam::Current.actor
+    def current_tenant = OpenLoam::Current.tenant
+    def current_actor = OpenLoam::Current.actor
 
-    # Establishes Loam::Current from the session, then proves the actor is
+    # Establishes OpenLoam::Current from the session, then proves the actor is
     # allowed to be here.
     #
-    # The order is load-bearing. Loam::Membership is itself tenant-scoped, so
+    # The order is load-bearing. OpenLoam::Membership is itself tenant-scoped, so
     # "is this actor a member?" is a question you can only ask from inside a
-    # tenant — the tenant has to be in Loam::Current first, or the check raises
-    # Loam::MissingTenantError instead of answering. The `&&` chain below
+    # tenant — the tenant has to be in OpenLoam::Current first, or the check raises
+    # OpenLoam::MissingTenantError instead of answering. The `&&` chain below
     # guarantees that: membership is only consulted once both are set.
     #
     # If anything fails, BOTH halves of the context are cleared before the
     # redirect, so a half-established context can never leak into the next
     # request or into a job enqueued from it.
-    def set_loam_context
-      Loam::Current.tenant = Loam::Tenant.find_by(id: session[:tenant_id])
-      Loam::Current.actor = User.find_by(id: session[:user_id])
+    def set_open_loam_context
+      OpenLoam::Current.tenant = OpenLoam::Tenant.find_by(id: session[:tenant_id])
+      OpenLoam::Current.actor = User.find_by(id: session[:user_id])
 
       return if current_tenant && current_actor && member_of_current_tenant?
 
-      Loam::Current.reset
+      OpenLoam::Current.reset
       redirect_to new_admin_session_path
     end
 
-    # Scoped to the current tenant by Loam::TenantRecord, which is the whole
+    # Scoped to the current tenant by OpenLoam::TenantRecord, which is the whole
     # point: a membership in some other tenant is not membership here.
     def member_of_current_tenant?
-      Loam::Membership.exists?(user_id: current_actor.id)
+      OpenLoam::Membership.exists?(user_id: current_actor.id)
+    end
+
+    # security.mfa_required_roles has to hold on EVERY request, not just as a
+    # redirect at the end of login — otherwise typing any other admin URL walks
+    # straight past enrollment and the requirement means nothing.
+    def require_mfa_enrollment!
+      return if OpenLoam::MfaCredential.active_for(current_actor)
+      return unless mfa_required_role?
+
+      redirect_to new_admin_mfa_path,
+                  alert: "Your role requires two-factor authentication — set it up to continue."
+    end
+
+    def mfa_required_role?
+      required = Array(OpenLoam::Configs.get("security.mfa_required_roles", default: []))
+      required.map(&:to_s).include?(current_role.to_s)
     end
 
     # Drives the bell in the admin layout. One COUNT per admin page render,
@@ -91,54 +127,77 @@ module Admin
     def unread_notification_count
       return 0 unless current_actor
 
-      Loam::Notification.unread.where(user_id: current_actor.id).count
+      OpenLoam::Notification.unread.where(user_id: current_actor.id).count
     end
 
     # Staged changes awaiting review, for the "Approvals (N)" nav badge.
     def pending_approval_count
       return 0 unless current_tenant
 
-      Loam::PendingAction.pending.count
+      OpenLoam::PendingAction.pending.count
     end
 
     def policy_for(record)
-      Loam::Policy.for(record)
+      OpenLoam::Policy.for(record)
     end
 
     def authorize!(policy, action)
-      raise Loam::NotAuthorizedError unless policy.public_send(action)
+      authorized!
+      raise OpenLoam::NotAuthorizedError unless policy.public_send(action)
+    end
+
+    # Records that this action asked a person-authorization question — marked
+    # whether the answer was yes or no, since a refusal is still a check.
+    #
+    # Call it directly only where the check is an inline `raise` rather than one
+    # of the helpers below (see Admin::PerspectivesController). Deliberately NOT
+    # called by require_feature! (a capability gate, not a person gate) or
+    # require_sudo! (step-up, orthogonal to role) — either marking the action
+    # would let a feature-gated screen skip authorization silently.
+    def authorized!
+      @open_loam_authorized = true
+    end
+
+    def verify_authorized!
+      return if @open_loam_authorized
+
+      raise OpenLoam::AuthorizationNotPerformedError,
+            "#{self.class.name}##{action_name} finished without authorizing. Call authorize!/require_role!/" \
+            "require_permission!, or declare `skip_authorization! \"<why>\"` if it is authorized structurally."
     end
 
     # For admin screens with no per-record policy (e.g. field definitions,
     # which apply to a whole entity_type rather than one record).
     def current_role
-      Loam::Membership.find_by(user_id: current_actor&.id)&.role&.to_sym
+      OpenLoam::Membership.find_by(user_id: current_actor&.id)&.role&.to_sym
     end
 
     def require_role!(*roles)
-      raise Loam::NotAuthorizedError unless roles.include?(current_role)
+      authorized!
+      raise OpenLoam::NotAuthorizedError unless roles.include?(current_role)
     end
 
-    # Feature-string permission gate (Loam::Permissions) — a finer capability
+    # Feature-string permission gate (OpenLoam::Permissions) — a finer capability
     # check than require_role!. `can?` is a helper_method so views hide UI a role
     # lacks; require_permission! enforces it (403) server-side.
     def can?(permission)
-      Loam.can?(permission)
+      OpenLoam.can?(permission)
     end
 
     def require_permission!(permission)
-      raise Loam::NotAuthorizedError unless Loam.can?(permission)
+      authorized!
+      raise OpenLoam::NotAuthorizedError unless OpenLoam.can?(permission)
     end
 
     # Feature guards. These gate a CAPABILITY (is the feature on for this
     # tenant), orthogonal to require_role! / policies, which gate a PERSON.
     # `feature_on?` is a helper_method, so views can hide UI a flag turns off.
     def feature_on?(name)
-      Loam::Features.on?(name)
+      OpenLoam::Features.on?(name)
     end
 
     def require_feature!(name)
-      raise Loam::FeatureDisabledError unless Loam::Features.on?(name)
+      raise OpenLoam::FeatureDisabledError unless OpenLoam::Features.on?(name)
     end
 
     # Optimistic-locking conflict handling: someone saved this record between the
@@ -146,13 +205,17 @@ module Admin
     # StaleObjectError). Build a field-level diff of what the user tried to write
     # vs the current saved values, then RELOAD to fresh data so the retry carries
     # the new lock_version — never a 500, never a silent clobber. lock_version is
-    # the guarantee; the advisory Loam::RecordLock is only a courtesy warning.
+    # the guarantee; the advisory OpenLoam::RecordLock is only a courtesy warning.
     #
     # Encrypted fields are compared and shown via the reader (decrypted); the raw
     # column is ciphertext that never matches (random IV), so a byte compare would
     # be a false conflict every time.
     def stale_conflict!(record, fields)
-      encrypted = record.class.respond_to?(:loam_encrypted_attributes) ? record.class.loam_encrypted_attributes.map(&:to_s) : []
+      encrypted = record.class.respond_to?(:open_loam_encrypted_attributes) ? record.class.open_loam_encrypted_attributes.map(&:to_s) : []
+      # The diff shows the OTHER person's saved values, so it obeys the same field
+      # rules as any other read. Anything not writable was never submitted anyway.
+      policy = policy_for(record)
+      fields = fields.select { |field| policy.writable?(field) && policy.readable?(field) }
       attempted = fields.map(&:to_s).index_with { |field| conflict_value(record, field, encrypted) }
 
       record.reload
@@ -199,12 +262,12 @@ module Admin
       submitted = Array(params.dig(record.model_name.param_key, :files)).reject(&:blank?)
       return if submitted.empty?
 
-      raise Loam::NotAuthorizedError unless policy.update?
+      raise OpenLoam::NotAuthorizedError unless policy.update?
 
       record.files.attach(submitted)
     end
 
-    # Runtime custom fields (see Loam::CustomFields) go through the same
+    # Runtime custom fields (see OpenLoam::CustomFields) go through the same
     # field-level enforcement as real columns: only a writable definition's
     # value is ever assigned.
     def assign_custom_fields!(record, params, policy)

data/lib/generators/{loam → open_loam}/install/templates/admin/business_rules_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Managing business rules (Loam::BusinessRule) — manager-only, since a rule can
+  # Managing business rules (OpenLoam::BusinessRule) — manager-only, since a rule can
   # notify, emit events, and set fields across the tenant. The condition and
   # actions are edited as JSON for the prototype (a visual builder is a future
   # increment). The recent execution log shows WHY rules fired.
@@ -9,21 +9,21 @@ module Admin
 
     rescue_from JSON::ParserError do |error|
       flash.now[:alert] = "Condition and actions must be valid JSON: #{error.message}"
-      @rule ||= Loam::BusinessRule.new
+      @rule ||= OpenLoam::BusinessRule.new
       render(@rule.persisted? ? :edit : :new, status: :unprocessable_entity)
     end
 
     def index
-      @rules = Loam::BusinessRule.by_priority
-      @recent_runs = Loam::BusinessRuleRun.recent.limit(20)
+      @rules = OpenLoam::BusinessRule.by_priority
+      @recent_runs = OpenLoam::BusinessRuleRun.recent.limit(20)
     end
 
     def new
-      @rule = Loam::BusinessRule.new(active: true, condition: {}, actions: [])
+      @rule = OpenLoam::BusinessRule.new(active: true, condition: {}, actions: [])
     end
 
     def create
-      @rule = Loam::BusinessRule.new(rule_params)
+      @rule = OpenLoam::BusinessRule.new(rule_params)
       if @rule.save
         redirect_to admin_business_rules_path, notice: "Rule created."
       else
@@ -49,7 +49,7 @@ module Admin
     private
 
     def set_rule
-      @rule = Loam::BusinessRule.find(params[:id])
+      @rule = OpenLoam::BusinessRule.find(params[:id])
     end
 
     # Parse the JSON textareas here; a malformed value raises JSON::ParserError,

data/lib/generators/{loam → open_loam}/install/templates/admin/business_rules_form.html.erb

@@ -2,8 +2,8 @@
   <p style="color:#b00"><%%= @error || flash[:alert] %></p>
 <%% end %>
 
-<%# The model is namespaced (Loam::BusinessRule), so an inferred URL/param-scope
-    would be admin_loam_business_rule_path / loam_business_rule[...]. Pin both to
+<%# The model is namespaced (OpenLoam::BusinessRule), so an inferred URL/param-scope
+    would be admin_open_loam_business_rule_path / open_loam_business_rule[...]. Pin both to
     the un-namespaced route and the "business_rule" key the controller permits. %>
 <%%= form_with model: @rule, scope: :business_rule,
       url: (@rule.persisted? ? admin_business_rule_path(@rule) : admin_business_rules_path) do |f| %>

data/lib/generators/{loam → open_loam}/install/templates/admin/comments_controller.rb

@@ -14,7 +14,7 @@ module Admin
       # discussion too.
       authorize!(policy_for(record), :read?)
 
-      comment = record.loam_comments.new(body: params[:body], author: current_actor)
+      comment = record.open_loam_comments.new(body: params[:body], author: current_actor)
       flash[:alert] = comment.errors.full_messages.to_sentence unless comment.save
 
       redirect_back fallback_location: [ :admin, record ]
@@ -24,13 +24,13 @@ module Admin
 
     # The type arrives from the browser, so it is never constantized blindly.
     # `safe_constantize` returns nil for anything that is not a real constant,
-    # and the class then has to prove it is a Loam entity that opted into
+    # and the class then has to prove it is a OpenLoam entity that opted into
     # comments — the allowlist is the contract, not a hand-kept list of names.
     def commentable
       klass = params[:commentable_type].to_s.safe_constantize
 
-      unless klass.is_a?(Class) && klass < Loam::TenantRecord && klass.include?(Loam::Commentable)
-        raise Loam::NotAuthorizedError, "#{params[:commentable_type].inspect} is not a commentable Loam entity"
+      unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord && klass.include?(OpenLoam::Commentable)
+        raise OpenLoam::NotAuthorizedError, "#{params[:commentable_type].inspect} is not a commentable OpenLoam entity"
       end
 
       klass.find(params[:commentable_id])

data/lib/generators/{loam → open_loam}/install/templates/admin/configs_controller.rb

@@ -1,33 +1,33 @@
 module Admin
-  # Per-tenant settings (Loam::Configs). Structural, not per-record, so it is
+  # Per-tenant settings (OpenLoam::Configs). Structural, not per-record, so it is
   # gated on the manager role rather than an entity policy — settings are
-  # privileged. Everything routes through Loam::Configs, never Loam::Config
+  # privileged. Everything routes through OpenLoam::Configs, never OpenLoam::Config
   # directly, so the cross-level resolution stays in vetted gem code.
   class ConfigsController < BaseController
     before_action { require_role!(:manager) }
 
     def index
-      # Feature flags share the loam_configs store but have their own screen
+      # Feature flags share the open_loam_configs store but have their own screen
       # (/admin/features), so hide their reserved-prefix keys from Settings.
-      keys = Loam::Configs.defined_keys.reject { |key| key.start_with?(Loam::Features::PREFIX) }
+      keys = OpenLoam::Configs.defined_keys.reject { |key| key.start_with?(OpenLoam::Features::PREFIX) }
       @settings = keys.map do |key|
-        { key: key, value: Loam::Configs.get(key), overridden: Loam::Configs.overridden?(key) }
+        { key: key, value: OpenLoam::Configs.get(key), overridden: OpenLoam::Configs.overridden?(key) }
       end
     end
 
     def edit
       @key = params[:key]
-      @value = Loam::Configs.get(@key)
-      @overridden = Loam::Configs.overridden?(@key)
+      @value = OpenLoam::Configs.get(@key)
+      @overridden = OpenLoam::Configs.overridden?(@key)
     end
 
     def update
-      Loam::Configs.set(params[:key], coerce(params[:value]))
+      OpenLoam::Configs.set(params[:key], coerce(params[:value]))
       redirect_to admin_configs_path, notice: "#{params[:key]} set for this tenant."
     end
 
     def reset
-      Loam::Configs.reset(params[:key])
+      OpenLoam::Configs.reset(params[:key])
       redirect_to admin_configs_path, notice: "#{params[:key]} reset to the default."
     end
 

data/lib/generators/open_loam/install/templates/admin/dashboard_controller.rb

@@ -0,0 +1,12 @@
+module Admin
+  class DashboardController < BaseController
+    skip_authorization! "Widgets are filtered by role in OpenLoam::Dashboard.for; there is no per-record subject."
+
+    def index
+      # Configurable, role-visible widgets (OpenLoam::Dashboard) — a raising widget
+      # is isolated into an error tile, never breaking the page. Register your
+      # own with OpenLoam::Widgets.register; arrange them under Dashboard settings.
+      @widgets = OpenLoam::Dashboard.for(actor: current_actor, role: current_role)
+    end
+  end
+end

data/lib/generators/{loam → open_loam}/install/templates/admin/dashboard_widgets_controller.rb

@@ -1,18 +1,18 @@
 module Admin
-  # Dashboard settings (Loam::DashboardWidget) — manager-only. Choose which
+  # Dashboard settings (OpenLoam::DashboardWidget) — manager-only. Choose which
   # registered widgets appear and in what order for this tenant.
   class DashboardWidgetsController < BaseController
     before_action { require_role!(:manager) }
 
     def index
-      @registered = Loam::Widgets.registered
-      @config = Loam::DashboardWidget.all.index_by(&:widget_key)
+      @registered = OpenLoam::Widgets.registered
+      @config = OpenLoam::DashboardWidget.all.index_by(&:widget_key)
     end
 
     def update
-      Loam::Widgets.keys.each do |key|
+      OpenLoam::Widgets.keys.each do |key|
         attrs = params.dig(:widgets, key) || {}
-        row = Loam::DashboardWidget.find_or_initialize_by(widget_key: key)
+        row = OpenLoam::DashboardWidget.find_or_initialize_by(widget_key: key)
         row.active = attrs[:active] == "1"
         row.position = attrs[:position].to_i
         row.save!

data/lib/generators/{loam → open_loam}/install/templates/admin/dictionaries_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Managed lookup lists (Loam::Dictionary) — manager-only. The index lists a
+  # Managed lookup lists (OpenLoam::Dictionary) — manager-only. The index lists a
   # tenant's dictionaries; the edit screen curates a dictionary's entries
   # (Admin::DictionaryEntriesController). Tenant-scoped by the model's default
   # scope, so a manager only ever sees their own tenant's lists.
@@ -8,15 +8,15 @@ module Admin
     before_action :set_dictionary, only: %i[edit update destroy]
 
     def index
-      @dictionaries = Loam::Dictionary.order(:key)
+      @dictionaries = OpenLoam::Dictionary.order(:key)
     end
 
     def new
-      @dictionary = Loam::Dictionary.new
+      @dictionary = OpenLoam::Dictionary.new
     end
 
     def create
-      @dictionary = Loam::Dictionary.new(dictionary_params)
+      @dictionary = OpenLoam::Dictionary.new(dictionary_params)
       if @dictionary.save
         redirect_to edit_admin_dictionary_path(@dictionary), notice: "Dictionary created — add its entries below."
       else
@@ -45,7 +45,7 @@ module Admin
     private
 
     def set_dictionary
-      @dictionary = Loam::Dictionary.find(params[:id])
+      @dictionary = OpenLoam::Dictionary.find(params[:id])
     end
 
     def dictionary_params

data/lib/generators/{loam → open_loam}/install/templates/admin/dictionaries_form.html.erb

@@ -1,4 +1,4 @@
-<%%# Loam::Dictionary is namespaced, so pin the URL + param scope. %>
+<%%# OpenLoam::Dictionary is namespaced, so pin the URL + param scope. %>
 <%%= form_with model: @dictionary, scope: :dictionary,
       url: (@dictionary.persisted? ? admin_dictionary_path(@dictionary) : admin_dictionaries_path) do |f| %>
   <%% if @dictionary.errors.any? %>

data/lib/generators/{loam → open_loam}/install/templates/admin/dictionary_entries_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Entries of a Loam::Dictionary — manager-only, nested under a dictionary.
+  # Entries of a OpenLoam::Dictionary — manager-only, nested under a dictionary.
   # Add / edit (value, label, color, icon, position, default, active) / delete;
   # reordering is by editing `position`.
   class DictionaryEntriesController < BaseController
@@ -33,7 +33,7 @@ module Admin
     private
 
     def set_dictionary
-      @dictionary = Loam::Dictionary.find(params[:dictionary_id])
+      @dictionary = OpenLoam::Dictionary.find(params[:dictionary_id])
     end
 
     def set_entry

data/lib/generators/{loam → open_loam}/install/templates/admin/event_deliveries_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  # Durable event deliveries (Loam::EventDelivery) — the dead-letter view.
+  # Durable event deliveries (OpenLoam::EventDelivery) — the dead-letter view.
   # Manager-only. Lists deliveries parked as `dead` (handler removed, or retries
   # exhausted) and lets an operator requeue one after fixing the handler. Pending
   # deliveries drain on their own; a small sample is shown for visibility.
@@ -7,16 +7,16 @@ module Admin
     before_action { require_role!(:manager) }
 
     def index
-      @dead = Loam::EventDelivery.dead.order(updated_at: :desc).limit(200)
-      @pending = Loam::EventDelivery.pending.order(Arel.sql("next_attempt_at IS NULL DESC, next_attempt_at ASC")).limit(50)
+      @dead = OpenLoam::EventDelivery.dead.order(updated_at: :desc).limit(200)
+      @pending = OpenLoam::EventDelivery.pending.order(Arel.sql("next_attempt_at IS NULL DESC, next_attempt_at ASC")).limit(50)
     end
 
     # Re-arm one delivery: back to pending with a clean slate, and nudge a job.
     # The sweep would eventually pick it up anyway; this is the "try now" button.
     def redeliver
-      delivery = Loam::EventDelivery.find(params[:id])
+      delivery = OpenLoam::EventDelivery.find(params[:id])
       delivery.update!(status: "pending", attempts: 0, next_attempt_at: nil, last_error: nil)
-      Loam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
+      OpenLoam::EventDeliveryJob.perform_later(delivery.tenant_id, delivery.id)
       redirect_to admin_event_deliveries_path, notice: "Delivery requeued."
     end
   end

data/lib/generators/{loam → open_loam}/install/templates/admin/event_deliveries_index.html.erb

@@ -1,6 +1,6 @@
 <h1>Event deliveries</h1>
 
-<p>Durable subscribers (<code>Loam::DurableEvents</code>). Delivery is at-least-once
+<p>Durable subscribers (<code>OpenLoam::DurableEvents</code>). Delivery is at-least-once
 with retry; a delivery that exhausts its retries — or whose subscriber was removed —
 is parked here as <strong>dead</strong> for you to fix and requeue.</p>
 

data/lib/generators/{loam → open_loam}/install/templates/admin/events_controller.rb

@@ -1,12 +1,14 @@
 module Admin
-  # Server-Sent Events: a per-tenant push stream (Loam::EventStream) so the admin
+  # Server-Sent Events: a per-tenant push stream (OpenLoam::EventStream) so the admin
   # updates live instead of polling. Authentication runs in the normal
-  # before_action chain (set_loam_context) BEFORE any stream write — so an
+  # before_action chain (set_open_loam_context) BEFORE any stream write — so an
   # unauthenticated request redirects to login the ordinary way, since no headers
   # have been committed yet. Once the loop starts writing, the response is
   # committed and there is no going back; that ordering is the whole safety of a
   # Live action.
   class EventsController < BaseController
+    skip_authorization! "OpenLoam::EventStream gates every message: declared pattern, matching tenant, and audience."
+
     include ActionController::Live
 
     HEARTBEAT_SECONDS = 20
@@ -20,7 +22,7 @@ module Admin
       # Subscribe as the FIRST thing in the begin whose ensure unsubscribes: a
       # leaked AS::Notifications subscriber would fire on every future event in
       # the process, holding this dead stream's queue forever.
-      handle = Loam::EventStream.broadcaster.subscribe(tenant: current_tenant, actor: current_actor) do |sse|
+      handle = OpenLoam::EventStream.broadcaster.subscribe(tenant: current_tenant, actor: current_actor) do |sse|
         queue << sse
       end
 
@@ -34,9 +36,9 @@ module Admin
     rescue IOError, ActionController::Live::ClientDisconnected
       # The client went away — nothing to do but clean up in `ensure`.
     ensure
-      Loam::EventStream.broadcaster.unsubscribe(handle)
+      OpenLoam::EventStream.broadcaster.unsubscribe(handle)
       response.stream.close
-      Loam::Current.reset
+      OpenLoam::Current.reset
     end
   end
 end

data/lib/generators/{loam → open_loam}/install/templates/admin/features_controller.rb

@@ -1,34 +1,34 @@
 module Admin
-  # Feature flags (Loam::Features). Structural and privileged, so manager-only,
-  # like Settings. Everything routes through Loam::Features; the admin toggles
+  # Feature flags (OpenLoam::Features). Structural and privileged, so manager-only,
+  # like Settings. Everything routes through OpenLoam::Features; the admin toggles
   # the CURRENT tenant's override, and Reset drops it back to the declared /
   # global state. Global (app-wide) flips are a deploy concern, not this screen.
   class FeaturesController < BaseController
     before_action { require_role!(:manager) }
 
     def index
-      @flags = Loam::Features.declared.map do |name|
+      @flags = OpenLoam::Features.declared.map do |name|
         {
           name: name,
-          on: Loam::Features.on?(name),
-          overridden: Loam::Features.overridden?(name),
-          description: Loam::Features.description(name)
+          on: OpenLoam::Features.on?(name),
+          overridden: OpenLoam::Features.overridden?(name),
+          description: OpenLoam::Features.description(name)
         }
       end
     end
 
     def enable
-      Loam::Features.enable(params[:name])
+      OpenLoam::Features.enable(params[:name])
       redirect_to admin_features_path, notice: "#{params[:name]} enabled for this tenant."
     end
 
     def disable
-      Loam::Features.disable(params[:name])
+      OpenLoam::Features.disable(params[:name])
       redirect_to admin_features_path, notice: "#{params[:name]} disabled for this tenant."
     end
 
     def reset
-      Loam::Features.reset(params[:name])
+      OpenLoam::Features.reset(params[:name])
       redirect_to admin_features_path, notice: "#{params[:name]} reset to the default."
     end
   end