{
 "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.",
 "soma_version": "3.2.4",
 "count": 14,
 "domains": {
  "civic": 14
 },
 "features": [
  "agent",
  "cost",
  "fail",
  "guard",
  "http",
  "invariant",
  "lambda",
  "match",
  "multi_cell",
  "native",
  "pipeline",
  "service",
  "skeleton",
  "state_machine",
  "sum_type",
  "think",
  "tools",
  "try"
 ],
 "programs": [
  {
   "id": "civic/campaign_finance",
   "domain": "civic",
   "title": "CAMPAIGN FINANCE — the contribution limit lives in the ledger, not the law",
   "summary": "CAMPAIGN FINANCE — the contribution limit lives in the ledger, not the law In 2014 Dinesh D'Souza was convicted for funneling money past the federal per-donor limit through straw donors he reimbursed. Straw schemes work because the limit is checked at filing time, months after the money moved. Here the per-donor cap ($2,900, the 2022-cycle federal limit) is a memory invariant: the cumulative-total write for any donor name above the cap is refused at the instant of donation. The reporting lifecycle is one-way — once the committee files, `reported` is terminal: soma verify proves the books cannot be re-opened to massage totals.",
   "url": "https://soma-lang.dev/corpus/civic/campaign_finance.cell",
   "repo_path": "examples/corpus/civic/campaign_finance.cell",
   "lines": 106,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Committee",
    "CommitteeTests"
   ]
  },
  {
   "id": "civic/census",
   "domain": "civic",
   "title": "CENSUS — after certification, the count is history, not a database row",
   "summary": "CENSUS — after certification, the count is history, not a database row The decennial census count, once certified and delivered for apportionment (13 U.S.C. § 141), decides House seats and a decade of federal funding. The 2020 cycle showed why post-hoc edits are radioactive: any quiet change to a certified tract count would shift money and seats with no audit trail. Here certification is a terminal state — soma verify proves no transition leaves it — so amendment handlers go dead at that instant, and the count itself refuses impossible values (a negative population cannot be written, whatever a buggy import believes).",
   "url": "https://soma-lang.dev/corpus/civic/census.cell",
   "repo_path": "examples/corpus/civic/census.cell",
   "lines": 106,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Census",
    "CensusTests"
   ]
  },
  {
   "id": "civic/disaster_aid",
   "domain": "civic",
   "title": "DISASTER AID — one emergency grant per household, however many times asked",
   "summary": "DISASTER AID — one emergency grant per household, however many times asked After Katrina, GAO estimated roughly $1 billion of FEMA individual assistance was improper — much of it duplicate registrations: the same household applying through different names, addresses, or call centers, each application paid because the dedup ran AFTER the checks went out. Here the duplicate is unrepresentable: a household's grant count is a memory invariant capped at 1, so the second disbursement is refused at the write, whichever intake channel it arrived through. The aid program also has a one-way lifecycle — once the program is audited, soma verify proves it never re-opens for \"supplemental\" off-book payments.",
   "url": "https://soma-lang.dev/corpus/civic/disaster_aid.cell",
   "repo_path": "examples/corpus/civic/disaster_aid.cell",
   "lines": 116,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "DisasterAid",
    "DisasterAidTests"
   ]
  },
  {
   "id": "civic/election_audit",
   "domain": "civic",
   "title": "ELECTION AUDIT — a risk-limiting audit that cannot count a ballot twice",
   "summary": "ELECTION AUDIT — a risk-limiting audit that cannot count a ballot twice Colorado pioneered statewide risk-limiting audits in 2017: pull a random sample of paper ballots, compare to the machine count, escalate to a full hand recount if the sample disagrees. The integrity of the method dies if the same favorable ballot can be inspected twice (padding agreement) or if a \"confirmed\" audit can be quietly reopened and re-run until it confirms. Both are structural here: each ballot's inspection count is capped at 1 by a memory invariant, escalation to full recount is a real transition the sample-mismatch forces, and `confirmed` is terminal — soma verify proves there is no second bite at the audit.",
   "url": "https://soma-lang.dev/corpus/civic/election_audit.cell",
   "repo_path": "examples/corpus/civic/election_audit.cell",
   "lines": 117,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "RiskLimitingAudit",
    "AuditTests"
   ]
  },
  {
   "id": "civic/foia",
   "domain": "civic",
   "title": "FOIA — the statutory clock cannot be silently ignored",
   "summary": "FOIA — the statutory clock cannot be silently ignored 5 U.S.C. § 552 gives an agency 20 working days to answer a FOIA request. In practice requests sit for years — agencies just keep them \"processing\" and courts call the silence a constructive denial (journalists sued the FBI over requests pending for a decade). The dodge works because nothing FORCES the escalation. Here the day counter has a hard ceiling: day 21 cannot be written for a request still in processing — the refused write trips the escalation transition instead. Overdue requests land on the commissioner's desk structurally, and `fulfilled` is terminal: an answered request cannot be quietly re-opened to dodge reporting.",
   "url": "https://soma-lang.dev/corpus/civic/foia.cell",
   "repo_path": "examples/corpus/civic/foia.cell",
   "lines": 99,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Foia",
    "FoiaTests"
   ]
  },
  {
   "id": "civic/grants",
   "domain": "civic",
   "title": "GRANTS — budget conservation: the fund cannot award money it does not have",
   "summary": "GRANTS — budget conservation: the fund cannot award money it does not have COVID-era relief programs paid out past their appropriations because the \"remaining budget\" lived in a spreadsheet beside the disbursement system — GAO flagged billions in over- and duplicate disbursements. The bug class is always the same: the balance check and the payment are two systems. Here they are one write: an award debits the fund slot, and a negative balance is unrepresentable — the memory refuses the overdraft. Conservation (awards + remaining == appropriation) holds by construction, and a closed fund is terminal: soma verify proves no path re-opens it.",
   "url": "https://soma-lang.dev/corpus/civic/grants.cell",
   "repo_path": "examples/corpus/civic/grants.cell",
   "lines": 107,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "GrantFund",
    "GrantFundTests"
   ]
  },
  {
   "id": "civic/jury",
   "domain": "civic",
   "title": "JURY — strikes are counted by the bench, not by the honor system",
   "summary": "JURY — strikes are counted by the bench, not by the honor system Curtis Flowers was tried six times; the prosecutor's pattern of striking Black jurors finally reached the Supreme Court (Flowers v. Mississippi, 2019). Peremptory strikes are abusable partly because nothing mechanical stops a side from burning more than its allotment — the count lives in a clerk's margin notes. Here 28 U.S.C. § 1870's three peremptory challenges per side is a memory invariant: the fourth strike is refused at the write. A juror can be seated at most once, and a sworn panel is terminal — soma verify proves no one reshuffles the box after jeopardy attaches.",
   "url": "https://soma-lang.dev/corpus/civic/jury.cell",
   "repo_path": "examples/corpus/civic/jury.cell",
   "lines": 118,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "JurySelection",
    "JuryTests"
   ]
  },
  {
   "id": "civic/land_registry",
   "domain": "civic",
   "title": "LAND REGISTRY — a parcel cannot be sold to two buyers at once",
   "summary": "LAND REGISTRY — a parcel cannot be sold to two buyers at once Deed-theft rings in Brooklyn and Detroit ran the same con for years: file a sale of the same house to two different buyers in the gap before the recorder's index catches up, collect both down payments, vanish. The con needs a registry that will hold two open sales on one parcel. This one will not: open escrows per parcel is a memory invariant capped at 1 — the second contract is refused at the write. Sales also only move title when the seller IS the recorded owner, and an escheated parcel (abandoned to the state) is terminal: soma verify proves it never re-enters commerce.",
   "url": "https://soma-lang.dev/corpus/civic/land_registry.cell",
   "repo_path": "examples/corpus/civic/land_registry.cell",
   "lines": 110,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "LandRegistry",
    "RegistryTests"
   ]
  },
  {
   "id": "civic/lottery",
   "domain": "civic",
   "title": "LOTTERY — committed entries, a published seed, and a draw that closes forever",
   "summary": "LOTTERY — committed entries, a published seed, and a draw that closes forever Public lotteries get rigged in two ways: officials slip entries in after seeing the pool (charter-school placement scandals), or they quietly \"re-draw\" until a favored name comes up — the 2017 HUD housing-voucher re-draws drew exactly this complaint. Both attacks die structurally here: an applicant's entry count cannot exceed 1 (memory wall), entries lock BEFORE the draw, the winner is a pure function of the locked pool and a pre-published seed, and `drawn` is a terminal state soma verify proves has no exit — there is no second draw.",
   "url": "https://soma-lang.dev/corpus/civic/lottery.cell",
   "repo_path": "examples/corpus/civic/lottery.cell",
   "lines": 96,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "HousingLottery",
    "LotteryTests"
   ]
  },
  {
   "id": "civic/permit",
   "domain": "civic",
   "title": "PERMIT — a building permit that cannot skip a review",
   "summary": "PERMIT — a building permit that cannot skip a review New York's self-certification program let architects stamp their own permits \"to speed things up\" — DOB audits later found buildings approved with zoning and structural reviews simply skipped, and the city spent a decade revoking permits for occupied buildings. The skip is possible when \"reviewed\" is a checkbox. Here the approval chain is the state machine itself: `issued` is only reachable THROUGH zoning, structural, and fire review, soma verify proves it, and `denied` and `issued` are terminal. The fee ledger is a second wall: a permit cannot be charged twice.",
   "url": "https://soma-lang.dev/corpus/civic/permit.cell",
   "repo_path": "examples/corpus/civic/permit.cell",
   "lines": 118,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "BuildingPermit",
    "PermitTests"
   ]
  },
  {
   "id": "civic/petition",
   "domain": "civic",
   "title": "PETITION — one signature per citizen, a wall in memory, not a clerk's eye",
   "summary": "PETITION — one signature per citizen, a wall in memory, not a clerk's eye In 2022 five Michigan governor candidates were struck from the ballot after an estimated 68,000 forged or duplicate petition lines; in 2004 the Nader petition in Pennsylvania collapsed the same way. Paid circulators duplicate names because the dedup is a spreadsheet applied weeks later. Here it is structural: a citizen's line count CANNOT exceed 1 — the memory refuses the write — and the clerk's certify/reject ruling is a terminal state that",
   "url": "https://soma-lang.dev/corpus/civic/petition.cell",
   "repo_path": "examples/corpus/civic/petition.cell",
   "lines": 100,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Petition",
    "PetitionTests"
   ],
   "usage": [
    "soma verify proves has no exit."
   ]
  },
  {
   "id": "civic/procurement",
   "domain": "civic",
   "title": "PROCUREMENT — sealed bids stay sealed, and the unsealing ends the auction",
   "summary": "PROCUREMENT — sealed bids stay sealed, and the unsealing ends the auction Classic bid-rigging (a DOJ antitrust staple): a procurement officer leaks the standing low bid to a favored vendor, who then \"submits\" a bid one dollar under it — possible because the system can read bids before close and accept bids after. Both capabilities are removed here, structurally: bid amounts are unreadable until the tender leaves `accepting`, the unsealing transition is the same event that closes submissions forever, and one bid per vendor is a memory invariant — there is no \"revised bid\" after a peek. `awarded` is terminal: the contract cannot be quietly re-tendered for a do-over.",
   "url": "https://soma-lang.dev/corpus/civic/procurement.cell",
   "repo_path": "examples/corpus/civic/procurement.cell",
   "lines": 112,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "SealedTender",
    "TenderTests"
   ]
  },
  {
   "id": "civic/sunshine",
   "domain": "civic",
   "title": "SUNSHINE — a council cannot vote on what the public never got to discuss",
   "summary": "SUNSHINE — a council cannot vote on what the public never got to discuss California's Brown Act and its fifty state cousins exist because councils kept adopting ordinances at 11pm on items never noticed on any agenda — courts void such votes, but only years later, after the garage is built. Here the sunshine sequence IS the state machine: `adopted` is reachable only through public notice and an open comment hearing, and soma verify proves it. Each councilmember votes at most once (memory wall), adoption requires a majority of the five-member body, and an adopted ordinance is terminal — no midnight amendment un-adopts it off the record.",
   "url": "https://soma-lang.dev/corpus/civic/sunshine.cell",
   "repo_path": "examples/corpus/civic/sunshine.cell",
   "lines": 135,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Ordinance",
    "SunshineTests"
   ]
  },
  {
   "id": "civic/vital_records",
   "domain": "civic",
   "title": "VITAL RECORDS — a person dies at most once, and benefits know it instantly",
   "summary": "VITAL RECORDS — a person dies at most once, and benefits know it instantly SSA's Inspector General found tens of millions paid to beneficiaries who were dead — and, in the mirror failure, thousands of LIVING people marked dead in the Death Master File (sometimes twice, by different counties), freezing their bank accounts. Both failures come from death being a row any clerk can insert again. Here a person's death count is a memory invariant capped at 1: the second certificate is refused at the write. A registered certificate is terminal — soma verify proves no resurrection edit — and the benefits handler refuses payment the moment the count is 1.",
   "url": "https://soma-lang.dev/corpus/civic/vital_records.cell",
   "repo_path": "examples/corpus/civic/vital_records.cell",
   "lines": 107,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "VitalRecords",
    "VitalRecordsTests"
   ]
  }
 ]
}