{ "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.", "soma_version": "3.2.4", "count": 14, "domains": { "medical": 14 }, "features": [ "agent", "cost", "fail", "guard", "http", "invariant", "lambda", "match", "multi_cell", "native", "pipeline", "service", "skeleton", "state_machine", "sum_type", "think", "tools", "try" ], "programs": [ { "id": "medical/bloodbank", "domain": "medical", "title": "BLOOD BANK — an ABO-incompatible transfusion is unrepresentable, and", "summary": "BLOOD BANK — an ABO-incompatible transfusion is unrepresentable, and you cannot issue a unit you do not have Acute hemolytic transfusion reaction — giving group A blood to a group O patient — is one of the few transfusion errors that kills within minutes. It is almost always a clerical/lookup error: the wrong unit pulled, a label misread. Every blood bank runs a compatibility check; the failure mode is that it is advisory, a screen a tired tech can click past. Here `issue` REFUSES an incompatible match outright (compatible() is the real ABO/Rh donor→recipient lattice), AND the inventory is a conserved quantity: a unit count can never go negative and you cannot issue from an empty shelf. The stock invariant makes \"issued more units than exist\" a rejected write, not a reconciliation headache.", "url": "https://soma-lang.dev/corpus/medical/bloodbank.cell", "repo_path": "examples/corpus/medical/bloodbank.cell", "lines": 129, "features": [ "invariant", "match", "try", "lambda" ], "cells": [ "BloodBank", "BloodBankTests" ], "usage": [ "soma check examples/corpus/medical/bloodbank.cell", "soma test examples/corpus/medical/bloodbank.cell", "soma run examples/corpus/medical/bloodbank.cell demo" ] }, { "id": "medical/chain_of_custody", "domain": "medical", "title": "LAB CHAIN OF CUSTODY — a sample whose custody broke can never be reported, by construction A forensic toxicology or pathology result is only as trustworthy as the unbroken chain of custody behind it", "summary": "LAB CHAIN OF CUSTODY — a sample whose custody broke can never be reported, by construction A forensic toxicology or pathology result is only as trustworthy as the unbroken chain of custody behind it. If a sample is left unsealed, or its identity can't be accounted for at any handoff, the result is inadmissible and clinically worthless — but the dangerous version is the lab that reports it anyway, and a treatment (or a conviction) rests on a possibly-swapped tube. Here a specimen walks collected → sealed → in_transit → received → analyzed → reported. The one terminal failure state is `compromised`: any custody break sends the sample there and it can NEVER reach `reported`. `soma verify` proves reported is unreachable from compromised, and that compromised is itself terminal — no \"re-seal and pretend\" path exists.", "url": "https://soma-lang.dev/corpus/medical/chain_of_custody.cell", "repo_path": "examples/corpus/medical/chain_of_custody.cell", "lines": 125, "features": [ "state_machine", "try" ], "cells": [ "ChainOfCustody", "CustodyTests" ], "usage": [ "soma verify examples/corpus/medical/chain_of_custody.cell", "soma test examples/corpus/medical/chain_of_custody.cell", "soma run examples/corpus/medical/chain_of_custody.cell demo" ] }, { "id": "medical/coldchain", "domain": "medical", "title": "VACCINE COLD-CHAIN — a temperature breach is PERMANENT, not \"probably fine\"", "summary": "VACCINE COLD-CHAIN — a temperature breach is PERMANENT, not \"probably fine\" In 2018 a UK pharmacy revaccinated hundreds of patients after a fridge failure: the mRNA/protein vaccines had spent hours out of the 2–8 °C window and nobody could prove they were still potent. The temptation in software is always the same — log the excursion, let a human \"assess\" it, quietly keep using the vials. That is how spoiled doses reach arms. Here a vial's life is a state machine whose `discarded` state is TERMINAL: once a reading leaves [2,8] °C the vial transitions to discarded and there is NO path back to administrable. `soma verify` proves discarded is a sink — no sequence of \"re-inspect\" or \"override\" signals can resurrect it. A second wall: the recorded temperature slot only accepts plausible readings, so a stuck sensor reporting 999 °C can't be silently stored as in-range.", "url": "https://soma-lang.dev/corpus/medical/coldchain.cell", "repo_path": "examples/corpus/medical/coldchain.cell", "lines": 126, "features": [ "state_machine", "invariant", "try", "lambda" ], "cells": [ "ColdChain", "ColdChainTests" ], "usage": [ "soma verify examples/corpus/medical/coldchain.cell # discarded is terminal", "soma test examples/corpus/medical/coldchain.cell", "soma run examples/corpus/medical/coldchain.cell demo" ] }, { "id": "medical/controlled_substance", "domain": "medical", "title": "CONTROLLED SUBSTANCE CABINET — the narcotic count must reconcile, always", "summary": "CONTROLLED SUBSTANCE CABINET — the narcotic count must reconcile, always Diversion of controlled drugs (fentanyl, morphine, oxycodone) from hospital cabinets is a real and deadly problem: nurses have overdosed stealing from the supply, and patients have been undertreated when their dose was diverted and saline charted instead. The DEA requires a perpetual inventory where every dispense, every waste, every return is accounted for and the physical count matches the record. Here the cabinet count is a CONSERVED quantity. You cannot dispense a vial that isn't there (count can't go negative), and a \"waste\" of a partial dose must be witnessed — recorded as its own ledger entry — so the on-hand plus dispensed plus wasted always reconciles. The invariant makes an impossible count (negative, or more than ever stocked) a rejected write, turning diversion-by-miscount into a hard error.", "url": "https://soma-lang.dev/corpus/medical/controlled_substance.cell", "repo_path": "examples/corpus/medical/controlled_substance.cell", "lines": 133, "features": [ "invariant", "try" ], "cells": [ "Cabinet", "CabinetTests" ], "usage": [ "soma check examples/corpus/medical/controlled_substance.cell", "soma test examples/corpus/medical/controlled_substance.cell", "soma run examples/corpus/medical/controlled_substance.cell demo" ] }, { "id": "medical/dialysis", "domain": "medical", "title": "DIALYSIS — fluid removal is capped, and a session always ends with the", "summary": "DIALYSIS — fluid removal is capped, and a session always ends with the patient reconnected to their own blood In hemodialysis the machine pulls a patient's blood through a filter and returns it, removing excess fluid (ultrafiltration) along the way. Two ways it harms: removing too much fluid too fast crashes blood pressure (intradialytic hypotension — nausea, cramps, cardiac arrest in the frail); and a session ABORTED without rinse-back strands the patient's blood in the extracorporeal circuit — a real loss of ~200+ mL. Here the ultrafiltration total is a bounded ledger: it can never exceed the prescribed fluid removal goal, enforced by the memory invariant — the pump cannot pull more than the body can spare. And the session machine has NO path from `running` straight to `complete`: it must pass through `rinse_back`, so the blood is always returned. `soma verify` proves that path is the only way to finish.", "url": "https://soma-lang.dev/corpus/medical/dialysis.cell", "repo_path": "examples/corpus/medical/dialysis.cell", "lines": 148, "features": [ "state_machine", "invariant", "try" ], "cells": [ "Dialysis", "DialysisTests" ], "usage": [ "soma verify examples/corpus/medical/dialysis.cell", "soma test examples/corpus/medical/dialysis.cell", "soma run examples/corpus/medical/dialysis.cell demo" ] }, { "id": "medical/infusion_pump", "domain": "medical", "title": "INFUSION PUMP — the programmed rate can never exceed the drug's hard limit (\"guardrails\") A nurse programming an IV pump types the rate by hand", "summary": "INFUSION PUMP — the programmed rate can never exceed the drug's hard limit (\"guardrails\") A nurse programming an IV pump types the rate by hand. A misplaced decimal — 250 mL/h instead of 25, or a 10x insulin/heparin overdose — has killed patients; the infamous cases turn on a keypad slip that the pump dutifully obeyed. The fix the industry settled on is a \"drug library\" with hard maximums (Guardrails): the pump simply REFUSES to run faster than the ceiling for that drug, no override. Here the programmed rate lives in a memory slot whose invariant is the hard guardrail — a write above the maximum (or a negative rate) is rejected and the pump keeps its last safe setting. The cumulative volume infused is a second bounded ledger, so a runaway pump cannot silently deliver more than the bag holds.", "url": "https://soma-lang.dev/corpus/medical/infusion_pump.cell", "repo_path": "examples/corpus/medical/infusion_pump.cell", "lines": 113, "features": [ "invariant", "try", "lambda" ], "cells": [ "InfusionPump", "InfusionTests" ], "usage": [ "soma check examples/corpus/medical/infusion_pump.cell", "soma test examples/corpus/medical/infusion_pump.cell", "soma run examples/corpus/medical/infusion_pump.cell demo" ] }, { "id": "medical/isolation", "domain": "medical", "title": "ISOLATION PRECAUTIONS — a contagious patient cannot be discharged to a", "summary": "ISOLATION PRECAUTIONS — a contagious patient cannot be discharged to a shared bay, and clearance requires two negative tests Hospital-acquired infection spreads when an isolation breach goes unnoticed: a patient colonized with a multidrug-resistant organism (MRSA, C. diff, or a novel respiratory virus) is moved out of contact/airborne precautions before they are cleared, seeding the next ward. The control is a strict status: isolated patients stay isolated until an infection- prevention clearance — typically TWO negative tests — is documented. Here the patient's infection-control status is a state machine. A patient under `isolated` can only reach `cleared` through `pending_clearance` after the required negatives — there is no isolated -> cleared shortcut, and `cleared` is the only state from which a normal-ward transfer is allowed. A bounded counter records consecutive negatives; one positive resets it, so \"two negatives\" can't be faked by a single lucky swab.", "url": "https://soma-lang.dev/corpus/medical/isolation.cell", "repo_path": "examples/corpus/medical/isolation.cell", "lines": 155, "features": [ "state_machine", "invariant", "try" ], "cells": [ "Isolation", "IsolationTests" ], "usage": [ "soma verify examples/corpus/medical/isolation.cell", "soma test examples/corpus/medical/isolation.cell", "soma run examples/corpus/medical/isolation.cell demo" ] }, { "id": "medical/med_administration", "domain": "medical", "title": "MEDICATION ADMINISTRATION — the \"five rights\" enforced by barcode, no scan no dose Wrong-patient and wrong-drug medication errors are among the most common causes of inpatient harm", "summary": "MEDICATION ADMINISTRATION — the \"five rights\" enforced by barcode, no scan no dose Wrong-patient and wrong-drug medication errors are among the most common causes of inpatient harm. The defense that actually moved the numbers is Barcode Medication Administration (BCMA): the nurse scans their badge, the patient's wristband, and the drug — and the system confirms the five rights (right patient, drug, dose, route, time) BEFORE the dose is recorded as administered_done. Workarounds (charting without scanning) are exactly how the errors slip back in. Here an administration is a state machine that physically cannot reach `administered_done` without passing through `patient_verified` and `drug_verified`. A mismatch at either scan sends it to the TERMINAL `aborted` state — the dose is never administered_done and the attempt can't be silently retried into success. `soma verify` proves `administered_done` is unreachable from `aborted`.", "url": "https://soma-lang.dev/corpus/medical/med_administration.cell", "repo_path": "examples/corpus/medical/med_administration.cell", "lines": 135, "features": [ "state_machine", "match", "try" ], "cells": [ "BCMA", "BCMATests" ], "usage": [ "soma verify examples/corpus/medical/med_administration.cell", "soma test examples/corpus/medical/med_administration.cell", "soma run examples/corpus/medical/med_administration.cell demo" ] }, { "id": "medical/prescription_lockout", "domain": "medical", "title": "PRESCRIPTION INTERACTION LOCKOUT — a lethal drug combination is refused", "summary": "PRESCRIPTION INTERACTION LOCKOUT — a lethal drug combination is refused at the point of order, not flagged for later Serotonin syndrome (an MAOI plus an SSRI), fatal bleeds (warfarin plus an NSAID), torsade from stacked QT-prolongers — co-prescribing certain drugs can kill. Every CPOE system has an interaction checker; the recurring tragedy is alert fatigue, where the warning is one more dismissible pop-up and the order goes through anyway. Here the active medication list is the source of truth, and `prescribe` REFUSES to add a drug that interacts with anything already on the list — there is no \"override\" path in the data model, so the dangerous pair never coexists. A bounded count invariant also caps polypharmacy, the independent risk multiplier behind most interaction harm.", "url": "https://soma-lang.dev/corpus/medical/prescription_lockout.cell", "repo_path": "examples/corpus/medical/prescription_lockout.cell", "lines": 142, "features": [ "invariant", "try", "lambda" ], "cells": [ "Pharmacy", "PharmacyTests" ], "usage": [ "soma check examples/corpus/medical/prescription_lockout.cell", "soma test examples/corpus/medical/prescription_lockout.cell", "soma run examples/corpus/medical/prescription_lockout.cell demo" ] }, { "id": "medical/sepsis_bundle", "domain": "medical", "title": "SEPSIS BUNDLE — antibiotics never go in before the blood cultures are", "summary": "SEPSIS BUNDLE — antibiotics never go in before the blood cultures are drawn, and the 1-hour clock is real The Surviving Sepsis \"hour-1 bundle\" saves lives by ordering: measure lactate, DRAW BLOOD CULTURES, then give broad-spectrum antibiotics, then start fluids — all within an hour of recognition. The ordering is not bureaucratic: give antibiotics before the cultures are drawn and you sterilize the sample, losing the chance to identify the organism and target therapy. The other failure is the clock: every minute of delay to antibiotics raises mortality. Here the bundle is a state machine where `antibiotics` is reachable ONLY after `cultures_drawn` — there is no edge that lets the drug precede the draw. A memory invariant pins elapsed minutes into [0,60]: a bundle charted as completed past the hour is a rejected write, so \"we'll call it on-time\" cannot be recorded. `completed` is terminal.", "url": "https://soma-lang.dev/corpus/medical/sepsis_bundle.cell", "repo_path": "examples/corpus/medical/sepsis_bundle.cell", "lines": 147, "features": [ "state_machine", "invariant", "try" ], "cells": [ "SepsisBundle", "SepsisTests" ], "usage": [ "soma verify examples/corpus/medical/sepsis_bundle.cell", "soma test examples/corpus/medical/sepsis_bundle.cell", "soma run examples/corpus/medical/sepsis_bundle.cell demo" ] }, { "id": "medical/sterilization", "domain": "medical", "title": "AUTOCLAVE STERILIZATION — a failed cycle can never release instruments", "summary": "AUTOCLAVE STERILIZATION — a failed cycle can never release instruments as sterile Surgical instruments are sterilized in an autoclave: saturated steam at 121–134 °C held long enough to kill spores, verified by a biological indicator. The deadly shortcut is releasing a load as \"sterile\" when the cycle aborted (a steam fault, a failed indicator) — every patient that tray touches is exposed to surgical-site infection, and outbreaks have been traced to exactly this. The standard is unforgiving: a failed cycle means the whole load is reprocessed, never released. Here a load runs loaded → running → (held params met) → indicator_pass → released. Any parameter fault or a failed biological indicator routes to the TERMINAL `failed` state — there is no edge from `failed` to `released`. A memory invariant also pins the sterilization hold temperature into the validated band, so a probe reading 80 °C cannot be charted as a passing cycle. `soma verify` proves released is unreachable from failed.", "url": "https://soma-lang.dev/corpus/medical/sterilization.cell", "repo_path": "examples/corpus/medical/sterilization.cell", "lines": 159, "features": [ "state_machine", "invariant", "try", "lambda" ], "cells": [ "Autoclave", "AutoclaveTests" ], "usage": [ "soma verify examples/corpus/medical/sterilization.cell", "soma test examples/corpus/medical/sterilization.cell", "soma run examples/corpus/medical/sterilization.cell demo" ] }, { "id": "medical/surgical_checklist", "domain": "medical", "title": "SURGICAL SAFETY CHECKLIST — no incision before time-out, and the count", "summary": "SURGICAL SAFETY CHECKLIST — no incision before time-out, and the count must reconcile before you close The WHO Surgical Safety Checklist exists because of two recurring disasters: wrong-site surgery (operating on the wrong knee, the wrong patient) and retained foreign objects (a sponge or instrument left inside, requiring a second operation, sometimes fatal sepsis). The defenses are a pre-incision \"time-out\" (confirm patient, site, procedure) and a final instrument/sponge COUNT that must match before the surgeon closes. Here the operation is a state machine: you physically cannot reach `incision` without passing through `timeout_done`, and you cannot reach `closed` without `count_correct`. A memory invariant makes the count a conserved equation — sponges out must equal sponges in — so \"close with one still inside\" is a rejected write, not a postoperative X-ray surprise.", "url": "https://soma-lang.dev/corpus/medical/surgical_checklist.cell", "repo_path": "examples/corpus/medical/surgical_checklist.cell", "lines": 146, "features": [ "state_machine", "invariant", "match", "try" ], "cells": [ "Surgery", "SurgeryTests" ], "usage": [ "soma verify examples/corpus/medical/surgical_checklist.cell", "soma test examples/corpus/medical/surgical_checklist.cell", "soma run examples/corpus/medical/surgical_checklist.cell demo" ] }, { "id": "medical/transplant", "domain": "medical", "title": "ORGAN ALLOCATION — one organ, one recipient, and no taking it back once", "summary": "ORGAN ALLOCATION — one organ, one recipient, and no taking it back once it is in A donor organ is the scarcest thing in medicine and the lifecycle is unforgiving: an offer is made to one candidate, accepted, the organ is recovered and transplanted. The catastrophic bug is double-allocation — the same kidney \"offered\" to two centers, both accept, one patient is opened up for an organ that has already been sewn into someone else. UNOS allocation incidents have turned on exactly this kind of race. Here each organ is a state machine. From `offered` it can be accepted by exactly one recipient (recorded once); `transplanted` is TERMINAL — once the organ is in a body there is no offer, no re-allocation, no path back to the pool. `soma verify` proves transplanted is a sink and that the declined/expired dead-ends can't masquerade as available.", "url": "https://soma-lang.dev/corpus/medical/transplant.cell", "repo_path": "examples/corpus/medical/transplant.cell", "lines": 145, "features": [ "state_machine", "try" ], "cells": [ "Transplant", "TransplantTests" ], "usage": [ "soma verify examples/corpus/medical/transplant.cell # no resurrection", "soma test examples/corpus/medical/transplant.cell", "soma run examples/corpus/medical/transplant.cell demo" ] }, { "id": "medical/triage", "domain": "medical", "title": "EMERGENCY TRIAGE — the sickest patient is seen first, by construction", "summary": "EMERGENCY TRIAGE — the sickest patient is seen first, by construction ED overcrowding kills by inversion: a walk-in with a sprain gets a bed while a silent MI in the waiting room arrests. The Manchester / ESI triage standard fixes an ordering — level 1 (resuscitation) before level 5 (non-urgent) — but a queue implemented as plain FIFO quietly violates it the moment load spikes. Here \"the next patient is always the most acute waiting one\" is not a sort we hope ran; it is what `next_to_see` computes directly over the waiting set, and a patient's acuity is pinned to the ESI scale by a memory invariant (1..5). A bug that wrote acuity 0 or 9 — which would jump or sink someone in the order — is rejected at the slot.", "url": "https://soma-lang.dev/corpus/medical/triage.cell", "repo_path": "examples/corpus/medical/triage.cell", "lines": 123, "features": [ "invariant", "try" ], "cells": [ "Triage", "TriageTests" ], "usage": [ "soma check examples/corpus/medical/triage.cell", "soma test examples/corpus/medical/triage.cell", "soma run examples/corpus/medical/triage.cell demo" ] } ] }