{
 "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.",
 "soma_version": "3.2.4",
 "count": 15,
 "domains": {
  "state_machines": 15
 },
 "features": [
  "agent",
  "cost",
  "fail",
  "guard",
  "http",
  "invariant",
  "lambda",
  "match",
  "multi_cell",
  "native",
  "pipeline",
  "service",
  "skeleton",
  "state_machine",
  "sum_type",
  "think",
  "tools",
  "try"
 ],
 "programs": [
  {
   "id": "state_machines/document_review",
   "domain": "state_machines",
   "title": "Document editorial workflow with a typed (sum-type) state machine",
   "summary": "Document editorial workflow with a typed (sum-type) state machine. A draft is submitted for review; a reviewer either requests changes (back to draft) or approves; approved documents are published. The changes-requested loop is bounded by reaching `published` or `archived` from every state, so liveness holds.",
   "url": "https://soma-lang.dev/corpus/state_machines/document_review.cell",
   "repo_path": "examples/corpus/state_machines/document_review.cell",
   "lines": 59,
   "features": [
    "state_machine",
    "sum_type"
   ],
   "cells": [
    "DocState",
    "Editorial",
    "EditorialTests"
   ]
  },
  {
   "id": "state_machines/elevator",
   "domain": "state_machines",
   "title": "An elevator door + motion interlock",
   "summary": "An elevator door + motion interlock. Two facts the machine enforces: the car only moves when doors are shut, and doors only open when the car is idle. The cycle idle -> doors_open -> idle -> moving_up/down -> idle keeps the machine live; `idle` is the recurrent hub every state returns to.",
   "url": "https://soma-lang.dev/corpus/state_machines/elevator.cell",
   "repo_path": "examples/corpus/state_machines/elevator.cell",
   "lines": 60,
   "features": [
    "state_machine"
   ],
   "cells": [
    "Elevator",
    "ElevatorTests"
   ]
  },
  {
   "id": "state_machines/expense_approval",
   "domain": "state_machines",
   "title": "Multi-step expense-approval workflow with guarded transitions",
   "summary": "Multi-step expense-approval workflow with guarded transitions. A submitted expense needs manager sign-off; anything over a threshold also needs finance. Rejection at either gate sends it back to draft. Guards on the state machine encode the business rule: the manager_ok -> finance_review arrow is only taken for large amounts.",
   "url": "https://soma-lang.dev/corpus/state_machines/expense_approval.cell",
   "repo_path": "examples/corpus/state_machines/expense_approval.cell",
   "lines": 81,
   "features": [
    "state_machine",
    "invariant",
    "fail"
   ],
   "cells": [
    "ExpenseApproval",
    "ExpenseTests"
   ]
  },
  {
   "id": "state_machines/game_match",
   "domain": "state_machines",
   "title": "Online game-match lifecycle",
   "summary": "Online game-match lifecycle. lobby -> starting -> playing -> finished, with an abandoned escape from the early phases. A rematch flows finished -> lobby, but because both finished and abandoned are reachable terminals listed in [verify], the rematch loop does not break liveness. Memory holds the player roster.",
   "url": "https://soma-lang.dev/corpus/state_machines/game_match.cell",
   "repo_path": "examples/corpus/state_machines/game_match.cell",
   "lines": 81,
   "features": [
    "state_machine",
    "invariant",
    "match"
   ],
   "cells": [
    "GameMatch",
    "GameMatchTests"
   ]
  },
  {
   "id": "state_machines/media_player",
   "domain": "state_machines",
   "title": "A media-player transport state machine",
   "summary": "A media-player transport state machine. stopped -> playing <-> paused, with stop reachable from play/pause. A typed (sum-type) machine so an illegal transport command is caught statically by the variant name. This is a reactive cyclic system: the proof obligation is deadlock-freedom.",
   "url": "https://soma-lang.dev/corpus/state_machines/media_player.cell",
   "repo_path": "examples/corpus/state_machines/media_player.cell",
   "lines": 57,
   "features": [
    "state_machine",
    "sum_type"
   ],
   "cells": [
    "Transport",
    "MediaPlayer",
    "MediaPlayerTests"
   ]
  },
  {
   "id": "state_machines/order_lifecycle",
   "domain": "state_machines",
   "title": "Order lifecycle as a typed state machine",
   "summary": "Order lifecycle as a typed state machine. Demonstrates: a sum-typed `state` machine (states ARE variants, so a typo in transition() is a compile error), guarded transitions, and assert_fails on illegal moves. `soma verify` proves the machine always reaches a terminal (delivered or cancelled).",
   "url": "https://soma-lang.dev/corpus/state_machines/order_lifecycle.cell",
   "repo_path": "examples/corpus/state_machines/order_lifecycle.cell",
   "lines": 58,
   "features": [
    "state_machine",
    "sum_type"
   ],
   "cells": [
    "OrderStatus",
    "OrderFlow",
    "OrderFlowTests"
   ]
  },
  {
   "id": "state_machines/shipment_tracking",
   "domain": "state_machines",
   "title": "Parcel shipment tracking with a delivery-exception loop",
   "summary": "Parcel shipment tracking with a delivery-exception loop. created -> picked_up -> in_transit -> out_for_delivery -> delivered. A failed delivery attempt bounces out_for_delivery back to in_transit; a parcel can be returned_to_sender from in_transit. Both delivered and returned_to_sender are terminal, and reachable from every state.",
   "url": "https://soma-lang.dev/corpus/state_machines/shipment_tracking.cell",
   "repo_path": "examples/corpus/state_machines/shipment_tracking.cell",
   "lines": 67,
   "features": [
    "state_machine"
   ],
   "cells": [
    "ShipmentTracker",
    "ShipmentTests"
   ]
  },
  {
   "id": "state_machines/subscription_billing",
   "domain": "state_machines",
   "title": "Subscription billing state machine",
   "summary": "Subscription billing state machine. trialing -> active -> past_due (on a failed charge) -> active (recovery) or -> canceled. Active subscriptions can be canceled directly. The past_due -> active retry loop is bounded by `canceled` being reachable from every state, so liveness holds. Memory tracks the failed-charge count so the handler can escalate to cancellation.",
   "url": "https://soma-lang.dev/corpus/state_machines/subscription_billing.cell",
   "repo_path": "examples/corpus/state_machines/subscription_billing.cell",
   "lines": 93,
   "features": [
    "state_machine",
    "invariant"
   ],
   "cells": [
    "Billing",
    "BillingTests"
   ]
  },
  {
   "id": "state_machines/support_ticket",
   "domain": "state_machines",
   "title": "Support-ticket lifecycle with a reopen path",
   "summary": "Support-ticket lifecycle with a reopen path. open -> in_progress -> resolved -> closed, with a resolved -> reopened loop that funnels back to in_progress. The * -> closed catch-all and the reopened -> in_progress arrow keep the machine live: every state can still reach the terminal `closed`. assert_fails guards illegal skips.",
   "url": "https://soma-lang.dev/corpus/state_machines/support_ticket.cell",
   "repo_path": "examples/corpus/state_machines/support_ticket.cell",
   "lines": 60,
   "features": [
    "state_machine"
   ],
   "cells": [
    "TicketDesk",
    "TicketTests"
   ]
  },
  {
   "id": "state_machines/tcp_connection",
   "domain": "state_machines",
   "title": "A simplified TCP connection state machine (active-open path)",
   "summary": "A simplified TCP connection state machine (active-open path). closed -> syn_sent -> established -> fin_wait -> closed. This is a classic protocol automaton; the model checker proves that from any state the connection can return to `closed` (no half-open leaks) and that the handshake order cannot be skipped.",
   "url": "https://soma-lang.dev/corpus/state_machines/tcp_connection.cell",
   "repo_path": "examples/corpus/state_machines/tcp_connection.cell",
   "lines": 58,
   "features": [
    "state_machine",
    "sum_type"
   ],
   "cells": [
    "TcpState",
    "TcpConnection",
    "TcpTests"
   ]
  },
  {
   "id": "state_machines/thermostat",
   "domain": "state_machines",
   "title": "An HVAC thermostat control loop",
   "summary": "An HVAC thermostat control loop. A single machine cycles between idle, heating, and cooling based on the measured temperature versus a target band. This is a reactive (cyclic) system with no terminal state — the proof obligation is deadlock-freedom: the controller always has a legal next action.",
   "url": "https://soma-lang.dev/corpus/state_machines/thermostat.cell",
   "repo_path": "examples/corpus/state_machines/thermostat.cell",
   "lines": 75,
   "features": [
    "state_machine",
    "fail"
   ],
   "cells": [
    "Thermostat",
    "ThermostatTests"
   ]
  },
  {
   "id": "state_machines/traffic_interlock",
   "domain": "state_machines",
   "title": "A two-road traffic-light interlock proven safe by construction",
   "summary": "A two-road traffic-light interlock proven safe by construction. The single machine cycles ns_go -> ns_caution -> ew_go -> ew_caution and back, with an all_red emergency reachable from anywhere. Because no state ever has both roads green, the model checker proves the safety property `never = []` over a machine that can never deadlock.",
   "url": "https://soma-lang.dev/corpus/state_machines/traffic_interlock.cell",
   "repo_path": "examples/corpus/state_machines/traffic_interlock.cell",
   "lines": 62,
   "features": [
    "state_machine",
    "match"
   ],
   "cells": [
    "TrafficInterlock",
    "TrafficTests"
   ]
  },
  {
   "id": "state_machines/turnstile",
   "domain": "state_machines",
   "title": "A coin-operated turnstile — the textbook two-state machine, plus an out-of-service state reachable only via maintenance",
   "summary": "A coin-operated turnstile — the textbook two-state machine, plus an out-of-service state reachable only via maintenance. Demonstrates a cyclic machine (locked <-> unlocked) with a generic transition handler so we can assert_fails on a jump that the machine forbids (you cannot go straight from locked to out_of_service without unlocking first). NOTE: every move needs a declared edge, including a move to the state the instance is already in (`locked -> locked` would have to be declared): a transition() with no edge raises invalid_transition.",
   "url": "https://soma-lang.dev/corpus/state_machines/turnstile.cell",
   "repo_path": "examples/corpus/state_machines/turnstile.cell",
   "lines": 77,
   "features": [
    "state_machine"
   ],
   "cells": [
    "Turnstile",
    "TurnstileTests"
   ]
  },
  {
   "id": "state_machines/vending_machine",
   "domain": "state_machines",
   "title": "A vending machine state machine",
   "summary": "A vending machine state machine. idle -> collecting (first coin) -> (more coins) -> dispensing -> idle. A refund from collecting returns to idle. The machine tracks the inserted balance in memory and only dispenses once the price is met.",
   "url": "https://soma-lang.dev/corpus/state_machines/vending_machine.cell",
   "repo_path": "examples/corpus/state_machines/vending_machine.cell",
   "lines": 89,
   "features": [
    "state_machine",
    "invariant",
    "fail"
   ],
   "cells": [
    "VendingMachine",
    "VendingTests"
   ]
  },
  {
   "id": "state_machines/wildcard_failure",
   "domain": "state_machines",
   "title": "WILDCARD FAILURE — `* -> failed` with an `eventually` property",
   "summary": "WILDCARD FAILURE — `* -> failed` with an `eventually` property. A job that can fail from any working state is the first thing people write, and the first thing that traps them: `* -> failed` also leaves the terminal states (a `done` job could \"fail\"), and `eventually = [\"done\", \"failed\"]` only holds if no cycle can dodge both. The recipe: - `except [done]` keeps the terminal state final; - the retry loop `running -> queued` is bounded by data, not by the graph, so `verify` proves deadlock-freedom and liveness on the graph and the `eventually` property on the declared machine; - each handler declares the edge it takes (`transition(id, from, to)`), so `verify` shows `start ⟶ {queued → running}` instead of a bare target. Run: soma verify wildcard_failure.cell (soma.toml carries the property)",
   "url": "https://soma-lang.dev/corpus/state_machines/wildcard_failure.cell",
   "repo_path": "examples/corpus/state_machines/wildcard_failure.cell",
   "lines": 68,
   "features": [
    "state_machine",
    "invariant",
    "guard",
    "fail"
   ],
   "cells": [
    "Job",
    "JobTests"
   ]
  }
 ]
}