{
 "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.",
 "soma_version": "3.2.4",
 "count": 16,
 "domains": {
  "governance": 16
 },
 "features": [
  "agent",
  "cost",
  "fail",
  "guard",
  "http",
  "invariant",
  "lambda",
  "match",
  "multi_cell",
  "native",
  "pipeline",
  "service",
  "skeleton",
  "state_machine",
  "sum_type",
  "think",
  "tools",
  "try"
 ],
 "programs": [
  {
   "id": "governance/amendment",
   "domain": "governance",
   "title": "AMENDMENT — supermajority ratification, and a \"yes\" that cannot be unsaid",
   "summary": "AMENDMENT — supermajority ratification, and a \"yes\" that cannot be unsaid In 1868, Ohio and New Jersey ratified the Fourteenth Amendment — then, as politics shifted, voted to RESCIND their ratifications. Congress and the Secretary of State counted them anyway: under Article V practice, ratification is a one-way act. The same fight resurfaced with the ERA in the 1970s. The constitutional answer became doctrine: a state's \"yes\" enters the permanent record; there is no take-back. This module makes both halves structural. A ratification slot can hold exactly the value 1 — the rescission (writing it back to 0) is refused by the MEMORY, not by a clerk's ruling. And the amendment cannot reach `ratified` (terminal, proven by soma verify) until a supermajority of 7 of the 10 member states is actually on the books.",
   "url": "https://soma-lang.dev/corpus/governance/amendment.cell",
   "repo_path": "examples/corpus/governance/amendment.cell",
   "lines": 129,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ArticleFive",
    "AmendmentTests"
   ]
  },
  {
   "id": "governance/anti_deficiency",
   "domain": "governance",
   "title": "ANTI-DEFICIENCY — no obligation of funds Congress never appropriated",
   "summary": "ANTI-DEFICIENCY — no obligation of funds Congress never appropriated The Anti-Deficiency Act (31 U.S.C. §1341, roots in 1870) exists because 19th-century agencies routinely spent money first and dared Congress to cover the bill — \"coercive deficiencies.\" The Act makes it a federal crime to obligate a dollar in excess of, or in advance of, an appropriation. It is the reason the U.S. government literally shuts down when appropriations lapse: with no enacted appropriation there is no legal way to spend. Both halves are structural here. \"In advance of\": spending handlers gate on the appropriation's lifecycle, and a LAPSED appropriation is terminal — soma verify proves money cannot flow from it again. \"In excess of\": the account balance carries `invariant remaining >= 0`, so the overdraft is not an error code — it is a write the memory refuses, and the balance keeps its last lawful value.",
   "url": "https://soma-lang.dev/corpus/governance/anti_deficiency.cell",
   "repo_path": "examples/corpus/governance/anti_deficiency.cell",
   "lines": 126,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Treasury",
    "AntiDeficiencyTests"
   ]
  },
  {
   "id": "governance/auditor_independence",
   "domain": "governance",
   "title": "AUDITOR INDEPENDENCE — one firm, one client, ONE role",
   "summary": "AUDITOR INDEPENDENCE — one firm, one client, ONE role In 2000, Arthur Andersen billed Enron $25 million for the audit — and $27 million for consulting. The firm certifying the books had a bigger business interest in pleasing management than in challenging it. When Enron collapsed, Andersen's partners were found shredding audit workpapers; the firm itself dissolved, taking 85,000 jobs with it. Sarbanes-Oxley §201 answered by making the dual role itself illegal: a registered public accounting firm may not provide most consulting services to an audit client. Not \"disclose it\" — may not hold both. Here the prohibition is arithmetic. A firm/client pair can hold at most ONE engagement. Signing the audit writes 1; selling consulting to the same client tries to write 2 — and the engagement ledger refuses. The conflict isn't reviewed by an ethics board after the fact; it is a value the books cannot hold. The audit itself runs a machine where `opinion_issued` is terminal: once signed, an opinion cannot be quietly recalled and re-negotiated.",
   "url": "https://soma-lang.dev/corpus/governance/auditor_independence.cell",
   "repo_path": "examples/corpus/governance/auditor_independence.cell",
   "lines": 117,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "EngagementLedger",
    "IndependenceTests"
   ]
  },
  {
   "id": "governance/board_motion",
   "domain": "governance",
   "title": "BOARD MOTION — Robert's Rules where \"no quorum, no vote\" is structural",
   "summary": "BOARD MOTION — Robert's Rules where \"no quorum, no vote\" is structural Quorum is the oldest anti-capture device in deliberative bodies: a minority that shows up early cannot bind the whole board. It matters enough that in 2011 fourteen Wisconsin state senators fled to Illinois for three weeks SOLELY to deny the chamber a quorum — denying quorum was the only brake left. Corporate law is harsher: board action taken without quorum is void, not voidable. Courts unwind the merger. Here the brake is not a clerk remembering to count the room. The motion lifecycle (Robert's Rules: moved -> seconded -> voted) is a state machine soma verify proves, `passed`/`failed` are terminal so a resolved motion can never be re-voted, and one-director-one-ballot is a MEMORY invariant — the second ballot is refused at the write.",
   "url": "https://soma-lang.dev/corpus/governance/board_motion.cell",
   "repo_path": "examples/corpus/governance/board_motion.cell",
   "lines": 155,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Boardroom",
    "MotionTests"
   ]
  },
  {
   "id": "governance/emergency_sunset",
   "domain": "governance",
   "title": "EMERGENCY SUNSET — extraordinary powers that cannot become ordinary",
   "summary": "EMERGENCY SUNSET — extraordinary powers that cannot become ordinary Egypt declared a state of emergency in 1981 after Sadat's assassination. It was \"temporarily\" renewed, again and again, for THIRTY-ONE YEARS — a whole generation governed under exception. The pattern is universal enough that modern emergency statutes (and the post-2020 reform wave in U.S. states) all converge on the same two teeth: an emergency expires BY ITSELF unless the legislature acts, and the executive cannot renew it indefinitely on its own signature. Both teeth are structural here. A declaration must be confirmed by the legislature before any power is exercised; `expired` is terminal — soma verify proves a lapsed emergency has no path back to life (you must declare a NEW one, in public, with a new confirmation). And the renewal counter carries `invariant <= 2`: the third renewal of the same declaration is a write the statute book refuses.",
   "url": "https://soma-lang.dev/corpus/governance/emergency_sunset.cell",
   "repo_path": "examples/corpus/governance/emergency_sunset.cell",
   "lines": 136,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "EmergencyAct",
    "SunsetTests"
   ]
  },
  {
   "id": "governance/four_eyes_approval",
   "domain": "governance",
   "title": "FOUR-EYES APPROVAL — the maker cannot be the checker, by construction",
   "summary": "FOUR-EYES APPROVAL — the maker cannot be the checker, by construction Wirecard collapsed in 2020 with €1.9 billion that never existed; for years the same small circle that originated transactions also signed off on them. Every controls framework since (SOX, Basel, ISO 27001) demands \"segregation of duties\": the person who drafts a document may not be the person who approves it. Usually that is a checkbox in a workflow tool — deletable, bypassable. Here it is arithmetic the memory enforces. Each document/person pair holds AT MOST ONE role. Authoring writes 1. Approving adds 1. If the author tries to approve their own document the write becomes 2 — and the invariant rejects it. The self-approval is not caught by a check; it is a value the ledger cannot hold.",
   "url": "https://soma-lang.dev/corpus/governance/four_eyes_approval.cell",
   "repo_path": "examples/corpus/governance/four_eyes_approval.cell",
   "lines": 115,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ApprovalChain",
    "FourEyesTests"
   ]
  },
  {
   "id": "governance/grant_milestones",
   "domain": "governance",
   "title": "GRANT MILESTONES — money moves only behind verified work, and only once",
   "summary": "GRANT MILESTONES — money moves only behind verified work, and only once Milestone-based disbursement is how funders stop the oldest grant fraud there is: draw the full award up front, deliver a report nobody reads, dissolve the entity. GAO audits of federal grant programs keep finding the same two failure modes — funds released ahead of the work, and the same milestone paid twice under slightly different paperwork. Clawing money back after the fact almost never works; the only cheap control is at the moment of disbursement. So that moment is where the walls are. The grant walks a machine — each milestone must be verified before the next opens, soma verify proves there is no path around the order. The escrow balance carries `invariant >= 0` (you cannot disburse money that is not there) and each milestone pays AT MOST ONCE: the duplicate-invoice write is refused by the ledger itself.",
   "url": "https://soma-lang.dev/corpus/governance/grant_milestones.cell",
   "repo_path": "examples/corpus/governance/grant_milestones.cell",
   "lines": 148,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "GrantEscrow",
    "EscrowTests"
   ]
  },
  {
   "id": "governance/judicial_recusal",
   "domain": "governance",
   "title": "JUDICIAL RECUSAL — a conflicted judge cannot sit, and cases aren't shopped",
   "summary": "JUDICIAL RECUSAL — a conflicted judge cannot sit, and cases aren't shopped Caperton v. A.T. Massey Coal (2009): while a $50M verdict against Massey was heading to West Virginia's Supreme Court, Massey's CEO spent $3M electing Justice Brent Benjamin to that court. Benjamin refused to recuse himself — twice — and cast the deciding vote to overturn the verdict. The U.S. Supreme Court held the Due Process Clause itself required recusal. The lesson: recusal cannot be left to the conflicted judge's own discretion. Here the conflicts register is consulted by the assignment machinery, not by the judge's conscience. And the second classic abuse — judge shopping, reassigning a case until a friendly bench appears — is a memory invariant: one case, one assignment, ever. The second assignment is a write the docket refuses.",
   "url": "https://soma-lang.dev/corpus/governance/judicial_recusal.cell",
   "repo_path": "examples/corpus/governance/judicial_recusal.cell",
   "lines": 121,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Docket",
    "RecusalTests"
   ]
  },
  {
   "id": "governance/minutes_adoption",
   "domain": "governance",
   "title": "MINUTES ADOPTION — the corporate record cannot be edited after the fact",
   "summary": "MINUTES ADOPTION — the corporate record cannot be edited after the fact The stock-option backdating scandals of 2006 (over 130 companies under SEC investigation, CEOs of Brocade and Comverse criminally charged) ran on one quiet mechanic: board paperwork written or \"fixed\" AFTER the fact, dressed up as the record of an earlier date. Minutes are evidence — Delaware courts treat adopted minutes as the authoritative memory of what a board decided. Their value collapses the moment they can be revised after adoption. So adoption here is a one-way door. Amendments append to a numbered revision trail only while the draft circulates; `adopted` is a terminal state soma verify proves, and the adoption ledger holds at most one adoption per document — a second \"corrected\" adoption of the same minutes is a write the memory refuses.",
   "url": "https://soma-lang.dev/corpus/governance/minutes_adoption.cell",
   "repo_path": "examples/corpus/governance/minutes_adoption.cell",
   "lines": 115,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "MinuteBook",
    "MinuteBookTests"
   ]
  },
  {
   "id": "governance/open_meetings",
   "domain": "governance",
   "title": "OPEN MEETINGS — no public decision without public notice, structurally",
   "summary": "OPEN MEETINGS — no public decision without public notice, structurally Every U.S. state has a Sunshine law because councils kept doing the same thing: decide in private, ratify in public. Texas's Open Meetings Act requires 72 hours of posted notice before a governmental body may act; actions taken in an unnoticed meeting are voidable, and courts have voided them — bond issues, firings, rezonings. The dodge du jour is the \"walking quorum\": a chain of small private chats that adds up to a deliberating majority no citizen ever saw. Here the Act is the machine. A meeting reaches `in_session` ONLY through `noticed`, and the notice ledger physically cannot record a posting shorter than 72 hours — `invariant notice_hours >= 72` makes the midnight 2-hour notice a write the memory refuses. Votes happen only in session; `adjourned` is terminal, so nothing can be slipped into a meeting after the gavel falls.",
   "url": "https://soma-lang.dev/corpus/governance/open_meetings.cell",
   "repo_path": "examples/corpus/governance/open_meetings.cell",
   "lines": 118,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "SunshineLaw",
    "SunshineTests"
   ]
  },
  {
   "id": "governance/peer_review",
   "domain": "governance",
   "title": "PEER REVIEW — double-blind where the blind cannot be lifted early",
   "summary": "PEER REVIEW — double-blind where the blind cannot be lifted early Double-blind review exists because the data says it must: when reviewers see author names, papers from famous labs are accepted at measurably higher rates (the NeurIPS 2014 and 2021 consistency experiments put numbers on how noisy and biased single-blind judging is). The whole mechanism collapses on two failure modes: an author reviewing their own paper under a conflict, and the author's identity leaking to the reviewer BEFORE the decision is locked. Both are structural here. A reviewer/author pair can hold at most one role on a paper — self-review is a write the memory refuses. And `unmasked` is reachable ONLY from `decided`: there is no edge from any pre-decision state to the unmasked world. soma verify proves it.",
   "url": "https://soma-lang.dev/corpus/governance/peer_review.cell",
   "repo_path": "examples/corpus/governance/peer_review.cell",
   "lines": 132,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ReviewDesk",
    "BlindTests"
   ]
  },
  {
   "id": "governance/release_pipeline",
   "domain": "governance",
   "title": "RELEASE PIPELINE — \"tests pass before deploy\" as a theorem, not a habit",
   "summary": "RELEASE PIPELINE — \"tests pass before deploy\" as a theorem, not a habit On August 1, 2012, Knight Capital deployed new trading code to seven of eight production servers. The eighth still ran a dead code path that the new deploy re-activated by reusing its feature flag. In 45 minutes Knight bought and sold $7 billion of stock it didn't want and lost $440 million — the firm was sold within the year. The SEC's post-mortem: no enforced deployment process. A human checklist, partly followed. Below, the pipeline is a state machine: production is reachable ONLY through green tests and a human approval, soma verify proves no other path exists, and the deploy ledger lets each build artifact reach production AT MOST ONCE — re-pushing a rolled-back artifact (Knight's exact sin: stale code reactivated) is a write the memory refuses.",
   "url": "https://soma-lang.dev/corpus/governance/release_pipeline.cell",
   "repo_path": "examples/corpus/governance/release_pipeline.cell",
   "lines": 133,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "Pipeline",
    "PipelineTests"
   ]
  },
  {
   "id": "governance/sealed_bids",
   "domain": "governance",
   "title": "SEALED BIDS — the envelope opens once, for everyone, after the deadline",
   "summary": "SEALED BIDS — the envelope opens once, for everyone, after the deadline Public procurement runs on sealed bidding because the alternative is what the DOJ Antitrust Division prosecutes every year: a contracting insider leaks competitor numbers to a favored vendor, who underbids by a dollar. Whole construction markets have been rigged this way. The integrity property is precise: NO bid is readable while the window is open, late bids do not exist, and once the envelopes open the window can never quietly re-open to slip a friend's bid in afterward. Here the envelope is the state machine: bids land only in `accepting`, numbers are served only past `opened`, and the opening is IRREVERSIBLE — soma verify proves no edge leads back. One vendor, one bid, is a memory invariant: the amended-after-peeking second bid is refused at the write.",
   "url": "https://soma-lang.dev/corpus/governance/sealed_bids.cell",
   "repo_path": "examples/corpus/governance/sealed_bids.cell",
   "lines": 131,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "BidRoom",
    "SealedBidTests"
   ]
  },
  {
   "id": "governance/term_limits",
   "domain": "governance",
   "title": "TERM LIMITS — the third term is not forbidden, it is unrepresentable",
   "summary": "TERM LIMITS — the third term is not forbidden, it is unrepresentable In 2008, New York's City Council — at Mayor Bloomberg's urging — voted 29-22 to extend its own term limits so the sitting mayor could run again, overriding two public referenda in which New Yorkers had twice voted for a two-term cap. It was legal precisely because the limit lived in an ordinary statute the limited officials themselves could amend. The U.S. answer to FDR's four terms was different: the 22nd Amendment put the cap somewhere no incumbent can reach. This module is the 22nd-Amendment version. The terms ledger carries `invariant terms <= 2` — certifying a third term for the same person is a WRITE THE MEMORY REFUSES, and there is no handler anywhere that can loosen an invariant at runtime. Each term also walks a machine whose `vacated` state is terminal: an ended term cannot be revived as a sneaky continuation of itself.",
   "url": "https://soma-lang.dev/corpus/governance/term_limits.cell",
   "repo_path": "examples/corpus/governance/term_limits.cell",
   "lines": 128,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "TermRegistry",
    "TermLimitTests"
   ]
  },
  {
   "id": "governance/three_readings",
   "domain": "governance",
   "title": "THREE READINGS — an ordinance cannot be law the night it is introduced",
   "summary": "THREE READINGS — an ordinance cannot be law the night it is introduced Most municipal charters require an ordinance to be read at three separate council meetings before adoption. The rule is anti-ambush: the public gets two full meeting cycles to notice, organize, and object before anything binds them. The standard evasion is the \"emergency clause\" — Ohio councils became notorious for passing garden-variety zoning as an \"emergency\" to skip readings and, not coincidentally, to dodge the citizen referendum that attaches to normal ordinances. In this machine the readings are not a custom the clerk remembers — they are the only path. `adopted` is reachable solely through three reading states, soma verify proves no shortcut edge exists, and each reading can be logged at most once per ordinance stage: stuffing all three readings into one wild night is a write the journal refuses.",
   "url": "https://soma-lang.dev/corpus/governance/three_readings.cell",
   "repo_path": "examples/corpus/governance/three_readings.cell",
   "lines": 145,
   "features": [
    "state_machine",
    "invariant",
    "try",
    "fail"
   ],
   "cells": [
    "CouncilJournal",
    "ReadingsTests"
   ]
  },
  {
   "id": "governance/whistleblower_shield",
   "domain": "governance",
   "title": "WHISTLEBLOWER SHIELD — retaliation against a reporter is unrepresentable",
   "summary": "WHISTLEBLOWER SHIELD — retaliation against a reporter is unrepresentable Sherron Watkins warned Ken Lay about Enron's accounting in August 2001; within days, Enron's lawyers were researching \"the consequences of terminating\" her. That memo is why Sarbanes-Oxley §806 exists: any adverse employment action against a corporate whistleblower — firing, demotion, the quiet bad shift — is unlawful retaliation. Yet OSHA's docket shows it still happens constantly, because the protection lives in a policy document while the termination lives in the HR system. Here they live in the same memory. Once a person files a report they are shielded: the adverse-actions ledger for a shielded employee carries `invariant == 0`, so HR's termination write is not flagged for review — it is REFUSED. And the report itself moves through a machine where `substantiated`/`unfounded` are terminal: a closed finding cannot be quietly re-opened to grind a reporter down.",
   "url": "https://soma-lang.dev/corpus/governance/whistleblower_shield.cell",
   "repo_path": "examples/corpus/governance/whistleblower_shield.cell",
   "lines": 119,
   "features": [
    "state_machine",
    "invariant",
    "try"
   ],
   "cells": [
    "ComplianceOffice",
    "ShieldTests"
   ]
  }
 ]
}