Assessing CX
We make structural claims, and we let you check each one.
CX is two rings and the groups above them: the data ring parses and
addresses data and can execute nothing; the code ring adds programs,
queries and authority; the platform group is the operating platform —
storage, history, wire, live data — reached over the network and never
embedded, which is what keeps the rings below it small enough to audit.
Every claim on this page stands beside the conformance case this
guide's cx replayed when the page was built, or names the step of
the front door's build that holds it. If a claim ever stops holding,
this page stops building.
The numbers on this page are counted, not typed: 92 shipped modules across 25 repositories, each declared once in a registry the build holds the tree to, and 82 directives in the language. rings draws the picture from the same rows.
The data ring — what a document is worth
One address per value
Every value has one cryptographic address, computed from its canonical bytes, and the address of a value equals the address of the text that spells it — so reconciliation between two systems is the comparison of two hashes, not a project. Fewer integration engineers per partner, fewer disputes, faster onboarding.
prog.cx
[$eq [$cx:hash [$cx:parse "[a 1]"]] [$cx:hash [a 1]]]
$ cx prog.cx
true
Fixture cx-025-hash-value-and-source-agree in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
The same value everywhere
A value is the same value whether it sits in a file, in a program, in a store or on the wire: what we write is what we read back, byte for byte, without a convention holding the two apart. The "it worked in system A and not in system B" incident class has no seam to live in.
prog.cx
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h [$store:put-doc $s [doc [item "hello"]]]] [$store:get-doc $s $h]]
$ cx prog.cx
[doc [item hello]]
Fixture store-rt-001-round-trip-get in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
Types without a registry
Two parties agree on a data shape by exchanging one hash: a type binding names the value's address and its schema's address, and anyone can recompute and compare. A tampered value fails the check as a value, not as a policy. No shared server, nothing to host, nothing to trust.
prog.cx
[$cx:serialize [$cx:type-binding [order id=7] '[schema of=order mode=closed]
[order [attr id::int [req]]]
']]
$ cx prog.cx
'[type-binding\n [subject hash=sha2-256:f0133d97150f589c10415631c6ce3a24686bf5131f70e7a058655e0cacae1145]\n [name order]\n [schema sha2-256:1b56731226a42f40b4df51e81bcbcd7271d888d524ad077559dc839b34b93697]\n]\n'
Fixture cx-113-type-binding-claim-shape in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[?let [= $s '[schema of=order]
[order [attr id::int]]
'] [$cx:type-binding-verify [$cx:type-binding [order id=7] $s] [order id=8] $s]]
$ cx prog.cx
[err code=cx-err:CXER4119 message='cx:type-binding-verify: subject address mismatch — claim sha2-256:f0133d97150f589c10415631c6ce3a24686bf5131f70e7a058655e0cacae1145, value sha2-256:161b719241c94467528be0559ffd20ca3399c448b8539871574a710f28088025' at='3:4']
Fixture cx-115-type-binding-verify-tamper in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
Exact money math
A fraction literal is an exact decimal, arithmetic keeps it one,
and a decimal's scale and sign are part of its identity — 1.10
is not 1.1, and neither is ever 1.0999…. Mixing a decimal with
a binary float is refused out loud, naming the one bridge between
them. The scalar kinds are
spec/03-approved/core/cxdm.md;
the sign rule is decision 1353-b.
Before — the form that fails
Mixing a decimal literal with a float in arithmetic
prog.cx
[+ 1.5 1.0e0]
$ cx prog.cx
[err code=cx-err:CXER0100 message='+: decimal/bigint arithmetic admits only int/bigint/decimal operands — [cast] is the only decimal↔float bridge (L44)' at='1:1']
Fixture ap-decimal-float-mix-wrong in conformance/llm/antipatterns.cxd — replayed against this cx when the page was built.
After — the CX form
Keep exact quantities in decimals
prog.cx
[?let [= $subtotal 19.99] [= $shipping 5.01] [total [+ $subtotal $shipping]]]
$ cx prog.cx
[total 25.00]
Fixture ap-decimal-float-mix-right in conformance/llm/antipatterns.cxd — replayed against this cx when the page was built.
A parser that cannot execute
The data build of cx contains no evaluator: it parses, converts,
canonicalizes, hashes, diffs and validates, and it can run
nothing. That is verified at build time, byte for byte, by two
standing steps of the front door — make test-extraction-gate,
which builds the data-only artifact and probes it for every
execution symbol, and make test-profile-gate, which grades each
of the four builds against the corpus its surface promises.
"Processing untrusted input cannot run code" is structural, not
policy; rings says which build carries what.
Every format, one model
JSON, XML, YAML, TOML, CSV and the columnar binary form read and write through one value model, so one team keeps one pipeline instead of one per format. An XML document arrives as the same tree a CX document would; a JSON array is a sequence like any other.
$ cx --from=xml --to=cx input.xml
[user id=1 name=Alice]
Fixture abi-010-xml-to-cx in deps/cx-core-code/conformance/abi.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-stdlib/json']
[$json:parse "[1, 2, 3]"]
$ cx prog.cx
[1, 2, 3]
Fixture json-006-parse-array in deps/cx-core-code/conformance/stdlib/json.cxd — replayed against this cx when the page was built.
Semantic diff and patch
A difference is computed on meaning, not on text lines: the diff of two documents is a record of what changed, and a patch applies it. Review over data — prices, configuration, contracts — becomes precise, and a change that changes nothing is empty.
prog.cx
[$cx:diff [users [user name="ada" age=30]] [users [user name="ada" age=31]]]
$ cx prog.cx
[diff [change kind=attribute-changed path='/users/user/@age' before='30' after='31' payload=attr [before [v age=30]] [after [v age=31]]]]
Fixture cx-041-diff-attr-record-shape in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[?let [= $a [users [user name="ada" age=30] [user name="bob"]]] [= $b [users [user name="ada" age=31] [user name="bob"] [user name="eve"]]] [= $d [$cx:diff $a $b]] [$cx:equal [$cx:patch $a $d] $b]]
$ cx prog.cx
true
Fixture cx-042-patch-attr-and-add in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
Schemas that fail closed
A schema states what a document must carry and refuses what it
does not know: a missing required attribute is a violation with a
code, a path and a message, and an unknown enumeration type or an
unregistered name is refused rather than waved through. Bad data
stops at the door, not at quarter close. The schema language is
spec/03-approved/core/schema.md.
prog.cx
[$cx:validate "[person name=ann]" "[schema of=person version='0.8'] [type person [attr age :type=int :required=true]]"]
$ cx prog.cx
([violation code=S002 path='' message="missing required attribute 'age' on <person>"])
Fixture cx-136-validate-violation-item in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-stdlib/validate']
[?let [= $h [$validate:register-schema 'Jobs2' "[schema of=job]
[type status::atom [enum :ok :err]]"]]
[$validate:enum-values 'Jobs2' 'nosuchtype']]
$ cx prog.cx
[err code=cx-err:CXER1600 message='E_VALIDATE_SCHEMA_NOT_FOUND: schema `Jobs2` declares no type `nosuchtype`' at='4:3']
Fixture validate-054-enum-values-unknown-type-fail-closed in deps/cx-core-code/conformance/stdlib/validate.cxd — replayed against this cx when the page was built.
A fifty-year format
The specification and its conformance corpus are the contract:
every release ships the full corpus as its conformance bundle
beside the binaries (the release flow's package step, and
make test-bundle-sources holds the bundle's source list to the
tree), so anyone can rebuild a conforming reader and grade it
against the same cases we grade ours. The governance page's
clean-room clause is the rule that keeps the spec implementable
from its text and corpus alone
(spec/03-approved/process/governance.md
§10.1a). No lock-in — including on our own implementation.
Fast bulk without a second system
A typed columnar table is a CX element like any other — the same
brackets, the same canonical bytes, the same address — and its
binary wire form carries the same identities as the text. The
corpus grades the table shape below and the chunked, compressed,
schema-driven and Arrow forms of its wire (the data_bin_*
suites of the data ring); analytics is the tour.
input.cx
[users [table[name::string age::int active::bool]]
alice 30 true
bob 25 false
]
$ cx --from=cx --to=cx input.cx
[users [table[name::string age::int active::bool]]
alice 30 true
bob 25 false
]
Fixture tab-001-typed-columns in conformance/../deps/cx-core-data/conformance/table.cxd — replayed against this cx when the page was built.
The code ring — what a computation is worth
Programs are data with addresses
Code, queries and configuration share the value model, so a program has an address like any document — the address of its quoted form is the address of the data document that spells it. You cannot approve, audit or price "exactly this computation" unless computations are addressable; here they are.
prog.cx
[?let [= $q [?quote [total $x]]] [$cx:hash [$cx:parse [$cx:serialize $q]]]]
$ cx prog.cx
'sha2-256:cf1204b421c2179448e1fe82338d37e64998a1897ea67d8c27674204ebf2c5a0'
Fixture cx-094-quote-hash-is-tier1 in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
Reproducible computation, by construction
A pure computation is deterministic — a property of the model, not a team discipline — and each carries an identity over its function, its inputs and its environment: two different computations never share one. "Show exactly what produced this number" is a lookup, not a forensic project.
prog.cx
[probe
[slice-bounds [$eq [$cx:computation-id '[?def f ($x) $x[0:2]]']
[$cx:computation-id '[?def f ($x) $x[1:4]]']]]
[attr-value [$eq [$cx:computation-id '[?def f ($d) [?match $d [case [user @role="admin"] 1] [else 0]]]']
[$cx:computation-id '[?def f ($d) [?match $d [case [user @role="guest"] 1] [else 0]]]']]]
[attr-type-test [$eq [$cx:computation-id '[?def f ($d) [?match $d [case [user @role::string] 1] [else 0]]]']
[$cx:computation-id '[?def f ($d) [?match $d [case [user @role::int] 1] [else 0]]]']]]
[pred-existence-absence [$eq [$cx:computation-id '[?def f ($d) $d//x[@k]]']
[$cx:computation-id '[?def f ($d) $d//x[@!k]]']]]
[alpha-slice-still-collides [$eq [$cx:computation-id '[?def f ($x $a $b) $x[$a:$b]]']
[$cx:computation-id '[?def f ($y $p $q) $y[$p:$q]]']]]]
$ cx prog.cx
[probe [slice-bounds false] [attr-value false] [attr-type-test false] [pred-existence-absence false] [alpha-slice-still-collides true]]
Fixture cx-108-computation-id-injectivity in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
Side effects are declared and enforced
A command states what it touches, and the runtime holds it to the
statement: a declared effect runs under its grant, an undeclared
one is refused before anything happens. The blast radius is known
before the program runs — incident prevention rather than
response. The vocabulary is
spec/03-approved/core/commands_effects.md.
prog.cx
[?lib 'cx-stdlib/path' as=path]
[?def canon impure [effects [read]] ($p) [$path:canonical $p]]
[$canon '/']
$ cx --allow-read prog.cx
'/'
Fixture cmd-001-command-effects-declared-cap-allowed in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-stdlib/uuid' as=uuid]
[?def stamp impure [effects [read]] () [$uuid:v4]]
[$stamp]
$ cx --allow-read --allow-random prog.cx
[err code=cx-err:CXER0271 message='E_CAP_DENIED: random capability required for uuid-v4; none granted (grant via --allow-random)' at='2:40']
Fixture cmd-002-command-effects-undeclared-cap-denied in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
Authority is delegated explicitly and only narrows
Authority is granted in writing and passed on only through a presented delegation; a grant row compiles to exactly one root delegation, and what a holder may do is what the chain permits and nothing wider. You can state, in writing, the most an automated caller can do.
prog.cx
[?lib 'cx-stdlib/authz']
[?let [= $dv [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
[capabilities [refund]] [assurance :t1] [signature s]]]
[= $az [$authz:open {tenant: 'acme', grants: $dv}]]
[= $ref [$concat 'cap:' [$cx:hash $dv]]]
[= $p [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [tenant acme] [basis $ref]]]]
[probe [decision [$name $p]] [via [?splice $p/via]]]]
$ cx prog.cx
[probe [decision permit] [via d-1]]
Fixture authz-091-basis-permits-through-the-presented-delegation in deps/cx-core-code/conformance/stdlib/authz.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'docs'}]]
[= $g [$authz-store:delegate $az
[delegation grant-1 [tenant docs]
[from [principal 'did:key:z6Mkgxj2R3HLtQRpPnvfvpuKEceSqf3tZHBjdmZ3fFz3JHGG']]
[to [agent 'did:key:z6MkneMkZqwqRiU5mJzSG3kDwzt9P8C59N4NGTfBLfSGE7c7']]
[capabilities [read] [write]] [over '/orders'] [assurance :t1] [signature sig-daemon]]]]
[$authz:check $az [authz-request
[actor [agent 'did:key:z6MkneMkZqwqRiU5mJzSG3kDwzt9P8C59N4NGTfBLfSGE7c7']]
[capability read] [slice '/orders/9'] [tenant docs]]]]
$ cx prog.cx
[permit rooted-principal=did:key:z6Mkgxj2R3HLtQRpPnvfvpuKEceSqf3tZHBjdmZ3fFz3JHGG [delegation grant-1] [via grant-1] [tier :t1] [capability read]]
Fixture store-grants-001-row-compiles-to-one-root-delegation in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
Approve exactly the code that runs
Propose mode binds a human approval to the address of the precise program text; a proposal is a value you can read, and a precondition that no longer holds refuses at commit. "Who approved this action, and what exactly did they approve?" has one answer.
prog.cx
[?def refund-order impure [effects [read]] [preconditions [> $amount 0]] [idempotent [window 7d]] ($order='' $amount=10) $amount]
[$cx:propose refund-order {order: 'o-1', amount: 42} {tenant: 'acme'}]
$ cx prog.cx
[proposal [command tier1='sha2-256:9b67313a100be30d5cc23527b82f0d731c7c82fc75f81d8d0c31a88d199789cd' code=sha2-256:e54650ef163b64c5a017e980c63463fff9791893774ffbc5e59b03710699a40f] [args {order: o-1, amount: 42}] [effects [read]] [preconditions [ok '[> $amount 0]']] [idempotency-key d:ce4e175558b9d2ec69f84e6c3e49e64e7c12f7dd8716aa1a966e1140d5e50ed7] [tenant acme]]
Fixture cmd-019-propose-value-shape in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
prog.cx
[?def refund-order impure [effects [read]] [preconditions [> $amount 0]] ($order='' $amount=10) $amount]
[$cx:propose refund-order {order: 'o-1', amount: 0} {}]
$ cx prog.cx
[err code=cx-err:CXER4112 message='E_CX_PRECONDITION_FAILED: precondition `[> $amount 0]` is false at propose — the proposal is refused (cx-err:CXER4112)' at='2:1']
Fixture cmd-020-propose-precondition-false-refuses in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
Double-execution protection built in
An idempotent command executes once inside its window however many times it is called — the key derived from the request itself when none is supplied — and a command that is not declared idempotent is never silently deduplicated. The double-refund and double-shipment defect class is removed at the platform, not per team.
prog.cx
[?def put-once impure [effects] [idempotent] ($x) [* $x 10]]
[?let [= $a [$put-once 5]] [= $b [$put-once 5]] ([first $a], [second $b])]
$ cx prog.cx
([first 50], [second [deduped 50]])
Fixture cmd-013-idempotent-direct-call-dedups in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
prog.cx
[?def plain impure [effects] ($x) [* $x 3]]
[?let [= $a [$plain 3]] [= $b [$plain 3]] ([a $a], [b $b])]
$ cx prog.cx
([a 9], [b 9])
Fixture cmd-018-non-idempotent-never-dedups in deps/cx-core-code/conformance/code.cxd — replayed against this cx when the page was built.
One query tier that optimizes itself
A query has a canonical plan with its own address, and two spellings of the same plan share one address — so they share one cache, and repeated analytical work is paid for once, organization-wide, with no coordination asked of anyone.
prog.cx
[$cx:plan-address '[?for [in $o [$store:source $s "//order"]] [group-by $o@region] [yield [g r=$key n=$count]]]']
$ cx prog.cx
'plan:sha2-256:b42c94eeb2164afea1ce4a8d81b7f21a6b115b4f5d80372b7eeb0cff19e76e34'
Fixture cx-100-plan-address-byte-pin in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[$eq
[$cx:plan-address '[?for [in $o [$store:source $s "//order"]] [group-by $o@region] [yield [g r=$key n=$count]]]']
[$cx:plan-address '[?for [in $x [$store:source $s "//order"]] [group-by $x@region] [yield [g r=$key n=$count]]]']]
$ cx prog.cx
true
Fixture cx-101-plan-pair-alpha-respelling in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
Agent tools derived, not maintained
A command definition projects to an agent tool descriptor by
itself — a definition with an effects clause is a command, and a
command is a tool — and an agent-protocol request is an ordinary
value projected to its wire form. New capabilities are
agent-ready the day they ship, and there is no wrapper to drift.
The projection is
spec/03-approved/x/agent_tool_projection.md.
prog.cx
[?lib 'cx-platform/tools' as=tools]
[?let [= $src """
[fn-doc name=touch scope=public purity=impure
[sig '''($x::string) -> string''']
[summary '''A zero-item-effects command (still a command).''']]
[?def touch scope=public impure [effects] [returns string] ($x::string) [$x]]
"""]
[$tools:descriptors-of $src]]
$ cx prog.cx
[tool name=touch [description A zero-item-effects command (still a command).] [input-schema {type: object, properties: {x: {type: string}}, required: (x), additionalProperties: false}] [output-schema {type: string}] [annotations read-only=true idempotent=false destructive=false open-world=false] [meta [source sha2-256:d47f9b8bb83bc841fcaf99d88bea54f01e13c5a9ae8d84388c973db367142087] [code computes-as:sha2-256:531a5e15748b3545e0f1d8b38efe1e7d9353b597d9468cd6969a1f38a2e619da] [input-schema-id sha2-256:e83d97d3f70736b8f54f426885f1875873cfed9c61cb88656e81dd8a0c534e61] [output-schema-id sha2-256:00404e686415370f1711c4d7acfa2905444d3cf23cef2e10c47d445ebe690f96] [returns-type string] [requires]]]
Fixture tools-004-zero-item-effects-is-a-command in deps/cx-platform-agent/conformance/x/tools.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/mcp' as=mcp]
[?lib 'cx-stdlib/json' as=json]
[$json:emit [$mcp:call-tool-request 1 "get_weather" {location: "NYC"}]]
$ cx prog.cx
'{"id":1,"jsonrpc":"2.0","method":"tools/call","params":{"arguments":{"location":"NYC"},"name":"get_weather"}}'
Fixture mcp-001-call-tool-request-shape in deps/cx-platform-agent/conformance/x/mcp.cxd — replayed against this cx when the page was built.
Run third-party logic safely
Untrusted code evaluates in a sandbox that can only narrow the caller's library set — never widen it — under a recursion ceiling the runtime enforces. A partner or extension surface opens without opening a hole.
prog.cx
[?lib 'cx-stdlib/strings' as=s]
[$cx:eval "[?lib 'cx-stdlib/strings' as=s] [$s:upper 'a']" {}]
$ cx --allow-eval prog.cx
A
Fixture cx-125-eval-lib-narrowing-allowed in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[$cx:eval "[?lib 'cx-stdlib/strings' as=s] [$s:upper 'a']" {}]
$ cx --allow-eval prog.cx
[err code=cx-err:CXER4113 message="cx-err:CXER4113: an eval may not widen the module set — `[?lib]` introducing `s` is not in the caller's [?lib] set (code.md §6.4.4 / modules/cx.md §3.2: inherits the caller's set; may narrow, not widen)" at='1:1']
Fixture cx-126-eval-lib-widen-refused in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
prog.cx
[$cx:eval "[$cx:eval '1' {} {max-depth: 1}]" {}]
$ cx --allow-eval prog.cx
[err code=cx-err:CXER4114 message='cx:eval recursion depth exceeded (max-depth=1)' at='1:1']
Fixture cx-127-eval-depth-exceeded in deps/cx-core-code/conformance/stdlib/cx.cxd — replayed against this cx when the page was built.
The platform group — what the system of record is worth
A store that works like git for data
Documents are content-addressed; named branches move with a
visible log, a forced move is recorded as one, and a compare-
and-set against a stale head refuses. "Who changed what, when,
and to what" is intrinsic to the store, so the audit-trail line
item leaves every application built on it. The store is
spec/03-approved/platform/store.md.
prog.cx
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]]
[= $h1 [$store:put-doc $s [doc [v 1]]]]
[= $h2 [$store:put-doc $s [doc [v 2]]]]
[= $b1 [$store:branch $s "main" $h1]]
[= $b2 [$store:branch-force $s "main" $h2]]
[= $l [$store:log $s]]
[?for [in $r $l//ref[= $_@plane "aliases"]]
[yield [$text $r/@pos]]]]
$ cx prog.cx
'1'
'2'
Fixture store-log-003-branch-advances-appear in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h1 [$store:put-doc $s [doc [v 1]]]] [= $h2 [$store:put-doc $s [doc [v 2]]]] [= $b1 [$store:branch $s "main" $h1]] [= $b2 [$store:branch-force $s "main" $h2]] [= [$store:get-alias $s "main"] $h2]]
$ cx prog.cx
true
Fixture store-branch-002-force-moves in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/store']
[?let [= $s [$store:open "mem://"]] [= $h1 [$store:put-doc $s [doc [v 1]]]] [= $h2 [$store:put-doc $s [doc [v 2]]]] [= $b1 [$store:branch $s "main" $h1]]
[$store:branch $s "main" $h2]]
$ cx prog.cx
[err code=cx-err:CXER1114 message='E_STORE_REF_CONFLICT: branch main points at sha2-256:5843b94b7af592c434acd9d8816e45f5bc50ebce67ea94a0bcb206202ccaeaed, not sha2-256:34bb7bd03048150a5f9b3fc52fb264f378d71d6f03a1ac0b0bfbdab43d1dac35 — use branch-force to move it' at='3:3']
Fixture store-branch-003-cas-conflict in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
A tamper-evident system of record
Journal entries are hash-chained, state is rebuilt by deterministic folds, and verification is a verb: an intact chain verifies to a value, and a tampered one answers a finding that names the break — also a value, never a crash. Prove the ledger to a regulator or a counterparty on demand.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://t" "acme"]]
[= $e1 [$journal:append $j [a] {actor: "u" authority: "g"}]]
[= $e2 [$journal:append $j [b] {actor: "u" authority: "g"}]]
[$journal:verify $j {}]]
$ cx prog.cx
[verification valid=true checked-from=1 checked-to=2 head-hash=sha2-256:d0ff5f72f597fa548dc5e52dc2e65d474e18a5fae0b440d09e2c29901ac39ac5]
Fixture journal-019-verify-valid in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://t" "acme"]]
[= $e1 [$journal:append $j [a] {actor: "u" authority: "g"}]]
[= $bad [snapshot tenant=acme at-seq=1 anchor-hash="sha256:deadbeef" hash-algo=sha256 sig-algo=none [state 99]]]
[$journal:snapshot-verify $j $bad]]
$ cx prog.cx
[snapshot-verification valid=false at-seq=1 reason=':algo-mismatch']
Fixture journal-022-tamper-finding-is-value in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
Time travel on business data
Valid time and record time are separate, first-class axes: an
entry's validity may be open-ended, and a correction is a new
entry chained to the one it corrects, so "what was true on the
third" and "what did we believe on the third" are both ordinary
reads. Back-dated corrections and restatements become queries.
The semantics are
spec/03-approved/core/bitemporal.md.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://bt-111" "acme"]]
[= $e1 [$journal:append $j [a from-only=1 valid-from="2026-06-01"] {actor: "u" authority: "g"}]]
[= $e2 [$journal:append $j [b to-only=1 valid-to="2026-06-01"] {actor: "u" authority: "g"}]]
[= $e3 [$journal:append $j [c plain=1] {actor: "u" authority: "g"}]]
[= $es [$journal:since $j 1]]
[open early=[$count [$journal:temporal-slice $es {valid-at: "2026-01-15"}]] late=[$count [$journal:temporal-slice $es {valid-at: "2026-12-15"}]]]]
$ cx prog.cx
[open early=2 late=2]
Fixture journal-111-open-ended-validity in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $f [?fn ($acc $e) [$string $e/event/price/@amount]]]
[= $j [$journal:open "mem://bt-x4" "acme"]]
[= $e1 [$journal:append $j [price sku="A" amount=19.99 valid-from="2026-08-01"] {actor: "u" authority: "g" stream: "p"}]]
[= $e2 [$journal:append $j [price sku="A" amount=17.99 valid-from="2026-08-01" [supersedes hash=$e1/@hash relation=:correction]] {actor: "u" authority: "g" stream: "p"}]]
[= $e3 [$journal:append $j [price sku="A" amount=16.49 valid-from="2026-08-01" [supersedes hash=$e2/@hash relation=:correction]] {actor: "u" authority: "g" stream: "p"}]]
[= $q3 [$journal:fold $j $f "none" "p" {valid-at: "2026-08-03"}]]
[= $q4-at1 [$journal:fold $j $f "none" "p" {at-seq: 1 valid-at: "2026-08-03"}]]
[= $q4-at2 [$journal:fold $j $f "none" "p" {at-seq: 2 valid-at: "2026-08-03"}]]
[chain q3=$q3 q4-at1=$q4-at1 q4-at2=$q4-at2]]
$ cx prog.cx
[chain q3='16.49' q4-at1='19.99' q4-at2='17.99']
Fixture journal-146-m5-correction-chain-depth-two in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
Right-to-be-forgotten in an append-only world
Erasure is a first-class entry: applying it purges the payload
and the deduplicated records that carried it while every chain
still verifies, because what the chain covers is the address, not
the bytes we no longer hold. Compliance without giving up
tamper-evident history — the combination regulated industries
cannot otherwise buy. The design is
spec/03-approved/platform/store/erasure_compliance.md.
prog.cx
[?lib 'cx-platform/store']
[?lib 'cx-platform/journal']
[?lib 'cx-stdlib/crypto']
[?lib 'cx-stdlib/bytes']
[?lib 'cx-stdlib/cx']
[?let
[= $so [$store:open "mem://ae-origin"]]
[= $jo [$journal:attach $so "acme"]]
[= $e0 [$journal:append $jo [order id="o-1"] {actor: "svc" authority: "g" stream: "orders"}]]
[= $r1 [$journal:erase-subject $jo "did:ex:dana" {actor: "dpo" authority: "rtbf-9"} {request: "shred-ae-1"}]]
[= $r2 [$journal:erase-subject $jo "did:ex:carol" {actor: "dpo" authority: "rtbf-9"} {request: "shred-ae-2"}]]
[= $sr [$store:open "mem://ae-rep"]]
[= $jr [$journal:attach $sr "acme"]]
[= $a1 [$journal:apply-erasures $jr $jo]]
[= $a2 [$journal:apply-erasures $jr $jo]]
[= $priv [$bytes:from-hex "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60"]]
[= $pub "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"]
[= $c1 [legal-hold [subject "did:ex:eve"] [signer "did:ex:counsel"] [at "2026-08-12"]]]
[= $s1 [$bytes:to-hex [$crypto:ed25519-sign $priv [$bytes:from-string-utf8 [$cx:canonical $c1]]]]]
[= $h1 [$journal:append $jr [legal-hold [subject "did:ex:eve"] [signer "did:ex:counsel"] [at "2026-08-12"] [sig alg=:ed25519 value=$s1 key=$pub]] {actor: "counsel" authority: "h-1" stream: "cx:legal-hold"}]]
[= $r3 [$journal:erase-subject $jo "did:ex:eve" {actor: "dpo" authority: "rtbf-9"} {request: "shred-ae-3"}]]
[= $a3 [$journal:apply-erasures $jr $jo]]
[probe [first $a1] [replay $a2] [with-held $a3]]]
$ cx prog.cx
[probe [first [erasure-sync records=2 applied=2 deduped=0 [shred-report subject=did:ex:dana request=shred-ae-1 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=1 holds-head=0] [shred-report subject=did:ex:carol request=shred-ae-2 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=2 holds-head=0]]] [replay [erasure-sync records=2 applied=0 deduped=2 [deduped [shred-report subject=did:ex:dana request=shred-ae-1 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=1 holds-head=0]] [deduped [shred-report subject=did:ex:carol request=shred-ae-2 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=2 holds-head=0]]]] [with-held [erasure-sync records=3 applied=0 deduped=2 held=1 [deduped [shred-report subject=did:ex:dana request=shred-ae-1 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=1 holds-head=0]] [deduped [shred-report subject=did:ex:carol request=shred-ae-2 docs=0 erased=0 already-erased=0 subject-keys=0 derived=0 checkpoints=0 dedup-records=0 stores=1 disposed=0 generation=2 holds-head=0]] [held subject=did:ex:eve request=shred-ae-3 code=cx-err:CXER4621]]]]
Fixture journal-137-apply-erasures in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/journal']
[?def notify impure [effects] [idempotent] ($who) [?let [= $c [?test-counter name='erase-dedup' op=inc]] $who]]
[?let
[= $j [$journal:open "mem://erase-dedup" "acme"]]
[= $a [$notify "did:ex:dana"]]
[= $b [$notify "did:ex:dana"]]
[= $r [$journal:erase-subject $j "did:ex:dana" {actor: "dpo" authority: "rtbf-9"} {request: "shred-dd-1"}]]
[= $c2 [$notify "did:ex:dana"]]
[probe [first $a] [second $b] [after-erase $c2] [purged $r@dedup-records] [execs [?test-counter name='erase-dedup' op=read]]]]
$ cx prog.cx
[probe [first did:ex:dana] [second [deduped did:ex:dana]] [after-erase did:ex:dana] [purged 1] [execs 2]]
Fixture journal-131-erase-purges-dedup-records in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
One security model on one wire
Identity and permission are one system across queries, events and storage, and the connection's own negotiation rides inside the signed transcript: a replayed handshake message fails its signature, and a version the peer did not offer is refused rather than downgraded to. One security review instead of three.
prog.cx
[?lib 'cx-platform/xsp-auth']
[?lib 'cx-stdlib/bytes' as=bytes]
[?lib 'cx-stdlib/did' as=did]
[?let
[= $i-eph-priv [$bytes:from-hex "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a"]]
[= $i-eph-pub [$bytes:from-hex "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"]]
[= $r-eph-pub [$bytes:from-hex "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f"]]
[= $i-seed [$bytes:from-hex "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60"]]
[= $i-pub [$bytes:from-hex "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"]]
[= $r-seed [$bytes:from-hex "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb"]]
[= $r-pub [$bytes:from-hex "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c"]]
[= $n-i [$bytes:from-hex "0101010101010101010101010101010101010101010101010101010101010101"]]
[= $n-r [$bytes:from-hex "0202020202020202020202020202020202020202020202020202020202020202"]]
[= $n-x [$bytes:from-hex "0303030303030303030303030303030303030303030303030303030303030303"]]
[= $i-did [$did:key-create $i-pub]]
[= $r-did [$did:key-create $r-pub]]
[= $m1 [$xsp-auth:hello {did: $i-did, nonce: $n-i, eph: $i-eph-pub, endpoint: "tcps://helm.local/xsp"}]]
[= $m2 [$xsp-auth:challenge $m1 {did: $r-did, nonce: $n-r, eph: $r-eph-pub, key: $r-seed}]]
[= $m1-fresh [$xsp-auth:hello {did: $i-did, nonce: $n-x, eph: $i-eph-pub, endpoint: "tcps://helm.local/xsp"}]]
[$xsp-auth:prove $m1-fresh $m2 {eph-priv: $i-eph-priv, key: $i-seed,
attach: [attach [tenant "acme"] [session mirror]]}]]
$ cx prog.cx
[err code=cx-err:CXER-XSP-AUTH-SIG message='xsp/auth-prove: responder transcript signature fails for did:key:z6MkiaMbhXHNA4eJVCCj8dbzKzTgYDKf6crKgHVHid1F1WCT' at='20:3']
Fixture xsp-auth-004-replay-m2-fails-sig in deps/cx-platform-xsp/conformance/xap/xsp-auth.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/xsp-auth']
[?lib 'cx-stdlib/bytes' as=bytes]
[?lib 'cx-stdlib/did' as=did]
[?let
[= $i-eph-priv [$bytes:from-hex "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a"]]
[= $i-eph-pub [$bytes:from-hex "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"]]
[= $r-eph-pub [$bytes:from-hex "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f"]]
[= $r-pub [$bytes:from-hex "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c"]]
[= $n-i [$bytes:from-hex "0101010101010101010101010101010101010101010101010101010101010101"]]
[= $n-r [$bytes:from-hex "0202020202020202020202020202020202020202020202020202020202020202"]]
[= $r-did [$did:key-create $r-pub]]
[= $m1 [$xsp-auth:hello {nonce: $n-i, eph: $i-eph-pub, endpoint: ""}]]
[; hand-forged M2 selecting a version the initiator never offered.
The §4.4a offer fields are present-and-well-formed so the VERSION
lane is what this case tests (a missing offer field is its own
refusal — see the downgrade family, cases 025-029). ]
[= $m2-v2 [xsp-auth phase=challenge [version 2]
[offer-profiles ""] [offer-features ""] [responder $r-did]
[nonce $n-r] [eph $r-eph-pub] [cb [$bytes:from-hex ""]] [sig "zAAA"]]]
[$xsp-auth:prove $m1 $m2-v2 {eph-priv: $i-eph-priv,
attach: [attach [session mirror]]}]]
$ cx prog.cx
[err code=cx-err:CXER-XSP-AUTH-VERSION message='xsp/auth-prove: responder selected version 2, not offered/supported' at='20:3']
Fixture xsp-auth-008-version-not-offered in deps/cx-platform-xsp/conformance/xap/xsp-auth.cxd — replayed against this cx when the page was built.
Live and batch are the same question
A query runs once, stays maintained, or answers changes-since a cursor — the same text, and the answers are equal by contract, which the corpus grades leg by leg. Real-time dashboards and pipelines without a second streaming stack.
prog.cx
[?lib 'cx-platform/store']
[?lib 'cx-platform/live']
[?let [= $s [$store:open "mem://live-002"]]
[= $h1 [$store:put-doc $s [order id=1 region=east]]]
[= $h2 [$store:put-doc $s [order id=2 region=west]]]
[= $q [?quote [?for [in $o [$store:source $orders "//order"]] [yield $o]]]]
[= $for-rows [?for [in $o [$store:source $s "//order"]] [yield $o]]]
[= $c [$live:changes-since $q {orders: $s} [head-set]]]
[= $cs-rows [?for [in $f $c/insert] [yield [$first $f/*]]]]
[leg1 eq=[$cx:equal $for-rows $cs-rows] n=[$count $cs-rows]]]
$ cx --allow-eval --allow-read --allow-write prog.cx
[leg1 eq=true n=2]
Fixture live-002-quartet-leg1-for-equivalence in deps/cx-platform-store/conformance/platform/live.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/store']
[?lib 'cx-platform/live']
[?let [= $s [$store:open "mem://live-004"]]
[= $q [?quote [?for [in $o [$store:source $orders "//order"]] [yield $o]]]]
[= $h1 [$store:put-doc $s [order id=1]]]
[= $c1 [$live:changes-since $q {orders: $s} [head-set]]]
[= $cur [?element "head-set" $c1/head-set]]
[= $h2 [$store:put-doc $s [order id=2]]]
[= $h3 [$store:put-doc $s [order id=3]]]
[$live:changes-since $q {orders: $s} $cur]]
$ cx --allow-eval --allow-read --allow-write prog.cx
[changes [head-set [s source=orders pos=3]] [insert pos=1 [order id=2]] [insert pos=2 [order id=3]]]
Fixture live-004-inserts-since-cursor in deps/cx-platform-store/conformance/platform/live.cxd — replayed against this cx when the page was built.
Offline and multi-site by design
A replica is seeded and ingests locally with no central sequencer,
and a merge is itself an entry with recorded lineage — the one
conflict value is how disagreement is spelled, and a resolution
is an entry anyone can read later. Field, branch and edge
scenarios work disconnected and reconcile honestly. The design is
spec/03-approved/platform/store/distributed_store.md.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://bt-117" "acme"]]
[= $e1 [$journal:append $j [reading site="buoy-7" v=3 valid-from="2026-03-01" valid-to="2026-03-02"] {actor: "replica-a" authority: "g"}]]
[= $e2 [$journal:append $j [reading site="buoy-7" v=5 valid-from="2026-01-01" valid-to="2026-01-02"] {actor: "replica-b" authority: "g"}]]
[= $es [$journal:since $j 1]]
[= $jan [$journal:temporal-slice $es {valid-at: "2026-01-01T12:00:00Z"}]]
[replica-seed known-now=[$count $jan] v=$jan/event/reading/@v tx-of-jan-fact=[$sum $jan/@seq] known-at-seq-1=[$count [$journal:temporal-slice $es {at-seq: 1 valid-at: "2026-01-01T12:00:00Z"}]]]]
$ cx prog.cx
[replica-seed known-now=1 v=5 tx-of-jan-fact=2 known-at-seq-1=0]
Fixture journal-117-offline-replica-seed in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/store']
[?lib 'cx-stdlib/cx']
[?let
[= $a [$store:open "mem://mr-a"]]
[= $b [$store:open "mem://mr-b"]]
[= $d1 [$store:put-doc $a [order [id 1]]]]
[= $d1b [$store:put-doc $b [order [id 1]]]]
[= $x1 [$store:set-alias $a "head" $d1]]
[= $x2 [$store:set-alias $b "head" $d1]]
[= $d3 [$store:put-doc $a [order [id 1] [line "y"]]]]
[= $x4 [$store:set-alias $a "head" $d3]]
[= $d4 [$store:put-doc $b [order [id 1] [note "rush"]]]]
[= $x5 [$store:set-alias $b "head" $d4]]
[= $dm [$store:put-doc $b [order [id 1] [line "y"] [note "rush"]]]]
[= $r [$store:reconcile-report $b $a {resolutions: [resolve ref="head" target=$dm]}]]
[= $rv [$first $r/*]]
[= $rec [$store:get-doc $b $rv/@record]]
[= $again [$store:reconcile-report $b $a]]
[= $t [$cx:equal [$store:get-alias $b "head"] $dm]]
[probe [resolved $r] [record $rec] [again $again] [target $t]]]
$ cx prog.cx
[probe [resolved [reconcile-report ok=true refs=1 identical=0 advanced=0 ahead=0 conflicts=0 resolved=1 [resolved name=head to='sha2-256:766f390f523fa864a370bf0fecd7e0b2d6309e63654941e95d05ebcb204b88c7' record=sha2-256:d642b04715c7e0dbcced6f0e4ee2431c85339a9b97a3418dfe3d08af9e9f9d4a]]] [record [merge ref=head [base stream='aliases/head' position=1 hash='sha2-256:59f4fc9c5c13e45e4f86a3c3b89087184d8cb442c919adb6e633c376061cc056'] [ours stream='aliases/head' position=2 hash=sha2-256:ab9d7a9879bcf3cf2493ed198944893dd954d402fcb7bb68f250a24f40075b08] [theirs stream='aliases/head' position=2 hash='sha2-256:150a51655bdea44c80a0f7f4960573b09f51702c47f078310fb23b344124f03b'] [target hash='sha2-256:766f390f523fa864a370bf0fecd7e0b2d6309e63654941e95d05ebcb204b88c7']]] [again [reconcile-report ok=true refs=1 identical=0 advanced=0 ahead=1 conflicts=0]] [target true]]
Fixture store-reconcile-003-resolution-merge-entry in deps/cx-platform-store/conformance/platform/store.cxd — replayed against this cx when the page was built.
Cross-system workflows that fail safely
A workflow is a document; before its pivot a failed step is
compensated — a bounded ladder of re-attempts first, each one
recorded, then the compensators in reverse order — and after
the pivot the run retries forward; the record says which. The
half-committed transaction —
the worst outage class in distributed systems — is designed
out; what remains is visible and recoverable. The runner law is
spec/03-approved/platform/flow.md.
input.cx
[flow name="dunning"
[args [acct::string]]
[step name="reserve" [do 'inv/reserve' [acct $args/acct]]]
[step name="charge" attempts=3 [do 'bill/charge' [acct $args/acct]]]
[step name="ship" pivot=true [do 'ship/dispatch' [acct $args/acct]]]]
prog.cx
[?lib 'cx-platform/flow']
[?let [= $e [resolver
[act name='inv/reserve' resolved='sha2-256:11' compensates='inv/release']
[act name='bill/charge' resolved='sha2-256:22' compensates='bill/refund' idempotent=true]
[act name='ship/dispatch' resolved='sha2-256:33']]]
[= $a [args [acct "pay:acme"]]]
[= $r [$flow:simulate $doc $a [results
[step name="reserve" status=:done [result [reserved]]]
[step name="charge" status=:failed [result [err code="cx-err:CXER0100" message="the gateway is rate limited"]]]] {env: $e}]]
[probe
[run [$string $r/flow-run/@status]]
[charge [?splice [?for [in $c $r/flow-run/step] [where [= [$string $c@name] "charge"]] [yield $c]]]]
[ladder [?splice [?for [in $t $r/transitions/*] [where [and [$exists $t@step] [= [$string $t@step] "charge"]]] [yield $t]]]]]]
$ cx --data=input.cx prog.cx
[probe [run compensated] [charge [step name=charge status=:failed ord=12 activated=4 reason=:attempts-exhausted attempt=3 [result [err code=cx-err:CXER0100 message='the gateway is rate limited']] [do 'bill/charge' [acct pay:acme]]]] [ladder [flow-transition step=charge status=:running attempt=1 [do 'bill/charge' [acct pay:acme]]] [flow-transition step=charge status=:failed [result [err code=cx-err:CXER0100 message='the gateway is rate limited']]] [flow-transition step=charge status=:retrying attempt=1] [flow-transition step=charge status=:running attempt=2 [do 'bill/charge' [acct pay:acme]]] [flow-transition step=charge status=:failed [result [err code=cx-err:CXER0100 message='the gateway is rate limited']]] [flow-transition step=charge status=:retrying attempt=2] [flow-transition step=charge status=:running attempt=3 [do 'bill/charge' [acct pay:acme]]] [flow-transition step=charge status=:failed [result [err code=cx-err:CXER0100 message='the gateway is rate limited']]] [flow-transition step=charge status=:failed reason=:attempts-exhausted attempt=3]]]
Fixture flow-057-attempts-exhausted-compensates in deps/cx-platform-flow/conformance/platform/flow.cxd — replayed against this cx when the page was built.
input.cx
[flow name="order"
[args [order::string]]
[step name="reserve" [do 'inventory/reserve' [order $args/order]]]
[step name="authorize" [do 'payments/authorize' [order $args/order]]]
[step name="place" pivot=true [do 'orders/place' [order $args/order]]]
[step name="notify" [do 'notify/send' [order $args/order]]]]
prog.cx
[?lib 'cx-platform/flow']
[?let [= $e [resolver
[act name='inventory/reserve' resolved='sha2-256:11' compensates='inventory/release']
[act name='payments/authorize' resolved='sha2-256:22' compensates='payments/void']
[act name='orders/place' resolved='sha2-256:33']
[act name='notify/send' resolved='sha2-256:44']]]
[= $a [args [order "o-1"]]]
[= $pre [$flow:simulate $doc $a [results
[step name="reserve" status=:done [result [reserved]]]
[step name="authorize" status=:failed]] {env: $e}]]
[= $post [$flow:simulate $doc $a [results
[step name="reserve" status=:done [result [reserved]]]
[step name="authorize" status=:done [result [authorized]]]
[step name="place" status=:done [result [placed]]]
[step name="notify" status=:failed]] {env: $e}]]
[probe [compensated $pre] [incomplete $post/flow-run]]]
$ cx --data=input.cx prog.cx
[probe [compensated [simulation [flow-run flow='sha2-256:1d9de285a6fcb8f1e2de15d60d5a60d50fdf93f13f5721d3c99f4ada03b0105c' version=1 status=:compensated [args [order o-1]] [step name=reserve status=:compensated ord=8 activated=2 [result [reserved]] [do 'inventory/reserve' [order o-1]]] [step name=authorize status=:failed ord=5 activated=4 [do 'payments/authorize' [order o-1]]] [step name=place status=:waiting pivot=true] [step name=notify status=:waiting]] [transitions [flow-transition status=:started flow='sha2-256:1d9de285a6fcb8f1e2de15d60d5a60d50fdf93f13f5721d3c99f4ada03b0105c' version=1 [args [order o-1]] [step name=reserve] [step name=authorize] [step name=place pivot=true] [step name=notify]] [flow-transition step=reserve status=:running [do 'inventory/reserve' [order o-1]]] [flow-transition step=reserve status=:done [result [reserved]]] [flow-transition step=authorize status=:running [do 'payments/authorize' [order o-1]]] [flow-transition step=authorize status=:failed] [flow-transition status=:compensating] [flow-transition step=reserve status=:compensating] [flow-transition step=reserve status=:compensated [result [reserved]]] [flow-transition status=:compensated]]]] [incomplete [flow-run flow='sha2-256:1d9de285a6fcb8f1e2de15d60d5a60d50fdf93f13f5721d3c99f4ada03b0105c' version=1 status=:incomplete incomplete=1 [args [order o-1]] [step name=reserve status=:done ord=3 activated=2 [result [reserved]] [do 'inventory/reserve' [order o-1]]] [step name=authorize status=:done ord=5 activated=4 [result [authorized]] [do 'payments/authorize' [order o-1]]] [step name=place status=:done pivot=true ord=7 activated=6 [result [placed]] [do 'orders/place' [order o-1]]] [step name=notify status=:failed ord=9 activated=8 [do 'notify/send' [order o-1]]]]]]
Fixture flow-012-simulate-compensation-and-incomplete in deps/cx-platform-flow/conformance/platform/flow.cxd — replayed against this cx when the page was built.
Data that survives schema change
Old entries upgrade through declared upcasters at one seam, and an upcaster that cannot cover its input refuses instead of guessing, so history stays replayable across every format the schema has had. The recurring migration project becomes a declaration.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://se-118" "acme"]]
[= $e1 [$journal:append $j [order id="A-1" total=107 schema="sha2-256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"] {actor: "svc" authority: "g"}]]
[= $e2 [$journal:append $j [order id="A-2" subtotal=90 tax=10 schema="sha2-256:b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2"] {actor: "svc" authority: "g"}]]
[= $up [?fn ($e)
[?if [= $e/event/order/@schema "sha2-256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"]
[then [entry seq=$e@seq hash=$e@hash
[event [order id=$e/event/order/@id subtotal=[- $e/event/order/@total 10] tax=10 schema="sha2-256:b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2"]]]]
[else $e]]]]
[upcast v2-subtotals=[$journal:fold $j [?fn ($a $e) [+ $a $e/event/order/@subtotal]] 0 "" {upcast: $up}] raw-v2-only=[$journal:fold $j [?fn ($a $e) [+ $a [$sum $e/event/order/@subtotal]]] 0] pure-count=[$count [$journal:upcast [$journal:since $j 1] $up]]]]
$ cx prog.cx
[upcast v2-subtotals=187 raw-v2-only=90 pure-count=2]
Fixture journal-118-upcaster-seam in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/journal']
[?let [= $j [$journal:open "mem://se-120" "acme"]]
[= $e1 [$journal:append $j [order id="A-1" total=107 schema="sha2-256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"] {actor: "svc" authority: "g"}]]
[= $e2 [$journal:append $j [legacy blob="x" schema="sha2-256:c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"] {actor: "svc" authority: "g"}]]
[= $narrow [?fn ($e)
[?if [= $e/event/order/@schema "sha2-256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"]
[then $e]
[else [err code="upcaster-gap" message="no upcaster for this payload"]]]]]
[= $renumber [?fn ($e) [entry seq=99 hash=$e@hash [event [x]]]]]
[= $drop [?fn ($e) [entry seq=$e@seq hash=$e@hash [note]]]]
[= $count-fn [?fn ($a $e) [+ $a 1]]]
[refusals [uncovered [?fallback [$journal:fold $j $count-fn 0 "" {upcast: $narrow}] [recover-with [context] [code $err@code]]]]
[renumbered [?fallback [$journal:fold $j $count-fn 0 "" {upcast: $renumber}] [recover-with [context] [code $err@code]]]]
[dropped [?fallback [$journal:fold $j $count-fn 0 "" {upcast: $drop}] [recover-with [context] [code $err@code]]]]]]
$ cx prog.cx
[refusals [uncovered [code cx-err:CXER4641]] [renumbered [code cx-err:CXER4642]] [dropped [code cx-err:CXER4642]]]
Fixture journal-120-upcast-refusals in deps/cx-platform-store/conformance/platform/journal.cxd — replayed against this cx when the page was built.
Messaging without a broker
Fan-out channels with glob subscriptions, a delivery count you
can read, and a dead-letter path for a record that breaks its
bound — on the same store and the same security model as
everything else. One vendor, one cluster and one pager rotation
fewer, with a stronger audit story than the broker they replace.
The unified model is
spec/03-approved/core/delivery.md.
prog.cx
[?lib 'cx-platform/journal']
[?lib 'cx-platform/fabric' as=fabric]
[?let [= $j [$journal:open "mem://t" "acme"]]
[= $f [$fabric:open $j]]
[= $r [$fabric:publish $f "orders" [do :order.placed] {actor: "u" authority: "g"}]]
[= $s [$fabric:subscribe $f "orders" :order.*]]
[$count [?receive from=$s max=9]]]
$ cx prog.cx
1
Fixture fabric-004-subscribe-glob-receive in deps/cx-platform-fabric/conformance/platform/fabric.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-stdlib/bus']
[?with-open [$bus:bus] $b
[?with-open [$bus:on $b :t [?fn ($m) $m]] $s1
[?with-open [$bus:on $b :t [?fn ($m) $m]] $s2
[?let [= $d [$bus:emit $b [do :t]]] $d@delivered]]]]
$ cx prog.cx
2
Fixture bus-005-delivered-count in deps/cx-core-code/conformance/stdlib/bus.cxd — replayed against this cx when the page was built.
prog.cx
[?lib 'cx-platform/sync']
[?let [= $c [capture mode=polling-diff kind=instant key='/id' version='/updated_at' overlap=5m]]
[= $ix [index source='acme/acme-api' count=0 from='2026-09-01T00:00:00Z']]
[= $pg [rows [row [id 'c-17'] [blob [$str-repeat 'x' 20000000]]] [row [id 'c-18']]]]
[= $d [$sync:diff-page $c $ix $pg 2026-09-13T10:05:00Z]]
[probe [refused [$count [?for [in $it $d/delta[= $_@op :refused]] [yield $it]]]] [created [$count [?for [in $it $d/delta[= $_@op :create]] [yield $it]]]]]]
$ cx prog.cx
[probe [refused 1] [created 1]]
Fixture sync-011-a-record-over-the-byte-bound-is-dead-lettered in deps/cx-platform-connector/conformance/platform/sync.cxd — replayed against this cx when the page was built.
Where to go next
The front door's page, cx, is where the claims above
are assembled: the pins, the four builds of one binary, the release
and the installer, each held by a step. The contributor's front door,
llm/contributor.md, lists
every step of the build with the decision it holds. rings is the
map of what you take on; quickstart runs a first file in five
minutes; every repository in the group below has a page in the same
shape — what it is, what it gives you, one replayed example, its
status and its links.