{
 "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.",
 "soma_version": "3.2.4",
 "count": 3,
 "domains": {
  "services": 3
 },
 "features": [
  "agent",
  "cost",
  "fail",
  "guard",
  "http",
  "invariant",
  "lambda",
  "match",
  "multi_cell",
  "native",
  "pipeline",
  "service",
  "skeleton",
  "state_machine",
  "sum_type",
  "think",
  "tools",
  "try"
 ],
 "programs": [
  {
   "id": "services/payments_approval",
   "domain": "services",
   "title": "PAYMENTS APPROVAL — a whole service in one file: a ledger that cannot overdraw, a payment lifecycle the verifier proves, an HTTP API that maps error kinds to status codes, and tests that run offline",
   "summary": "PAYMENTS APPROVAL — a whole service in one file: a ledger that cannot overdraw, a payment lifecycle the verifier proves, an HTTP API that maps error kinds to status codes, and tests that run offline. What is PROVEN (soma verify + soma.toml): paid is unreachable without authorized; nothing follows rejected; every payment ends paid or rejected. What is ENFORCED: the balance never goes negative (invariant, checked on every write); a handler that fails is rolled back entirely, so a payment whose debit is refused stays exactly where it was.",
   "url": "https://soma-lang.dev/corpus/services/payments_approval.cell",
   "repo_path": "examples/corpus/services/payments_approval.cell",
   "lines": 165,
   "features": [
    "state_machine",
    "invariant",
    "http",
    "match",
    "try",
    "fail",
    "multi_cell",
    "service"
   ],
   "cells": [
    "Ledger",
    "Payments",
    "PaymentsTests"
   ],
   "usage": [
    "soma check  payments_approval.cell",
    "soma verify payments_approval.cell",
    "soma test   payments_approval.cell",
    "soma run    payments_approval.cell request POST /payments '{\"id\":\"p1\",\"amount\":250}'"
   ],
   "manifest": "https://soma-lang.dev/corpus/services/soma.toml"
  },
  {
   "id": "services/refund_agent",
   "domain": "services",
   "title": "REFUND AGENT — an LLM decides, the language decides what it may do",
   "summary": "REFUND AGENT — an LLM decides, the language decides what it may do. The model proposes approve / deny / escalate as JSON; its output becomes a sum type (malformed → Escalate, never a crash). The hard rules are not the model's to bend: a refund above the order amount or after 30 days is refused by guards on the edge to `paid`; the daily payout cap is a memory invariant; a refund above 20,000 cents needs a human (`approve()`), which tests script with `mock approve`. Proven: paid is unreachable without decided; nothing after denied. Proven too: the cost bound, because every think() has a literal max_tokens and one provider round (max_rounds).",
   "url": "https://soma-lang.dev/corpus/services/refund_agent.cell",
   "repo_path": "examples/corpus/services/refund_agent.cell",
   "lines": 162,
   "features": [
    "state_machine",
    "invariant",
    "agent",
    "sum_type",
    "think",
    "match",
    "try",
    "guard",
    "fail",
    "cost",
    "tools"
   ],
   "cells": [
    "Decision",
    "RefundAgent",
    "RefundTests"
   ],
   "usage": [
    "soma check  refund_agent.cell      → cost: 'tokens' bound proven",
    "soma verify refund_agent.cell",
    "soma test   refund_agent.cell      → offline: think() and approve() are scripted"
   ],
   "manifest": "https://soma-lang.dev/corpus/services/soma.toml"
  },
  {
   "id": "services/warehouse_reservations",
   "domain": "services",
   "title": "WAREHOUSE RESERVATIONS — two cells: a stock ledger with hard bounds and a reservation lifecycle with a supervisor guard, behind one HTTP router",
   "summary": "WAREHOUSE RESERVATIONS — two cells: a stock ledger with hard bounds and a reservation lifecycle with a supervisor guard, behind one HTTP router. Proven (`soma verify --strict` is green): on-hand quantity stays in [0, 10000] per SKU and there are at most 500 SKUs — every writer narrows its value with a `require` before the one write, so the invariants hold by induction instead of being checked at run time; shipped requires picked AND held; released never ships; rejected and shipped are final (`* -> rejected except [shipped, released]`). Enforced at the transition: a reservation above 100 units only reaches `held` when a supervisor is named (a guard). A hold that would overdraw stock ends `rejected` and stock is untouched — the failing `try` block is rolled back to where it started.",
   "url": "https://soma-lang.dev/corpus/services/warehouse_reservations.cell",
   "repo_path": "examples/corpus/services/warehouse_reservations.cell",
   "lines": 187,
   "features": [
    "state_machine",
    "invariant",
    "http",
    "match",
    "try",
    "guard",
    "fail",
    "multi_cell",
    "service"
   ],
   "cells": [
    "Stock",
    "Reservations",
    "WarehouseTests"
   ],
   "usage": [
    "soma check  warehouse_reservations.cell",
    "soma verify --strict warehouse_reservations.cell",
    "soma test   warehouse_reservations.cell"
   ],
   "manifest": "https://soma-lang.dev/corpus/services/soma.toml"
  }
 ]
}