xap
The XAP orchestrator — the experience layer at the top of the CX web stack. It composes the general-purpose primitives (bus, journal, authz, session) into a single runtime: pure constructors build components, surfaces, and panels; render materializes a surface for HTML or agent consumption; and run, emit, on, state, dial, and why-allowed drive the committed cascade, journal-folded state, and authority-delegation surface. It is imported as cx-platform/xap, a Ring-2 module rather than a cx-stdlib one — it layers above stdlib and adds no authority, transport, or markup logic of its own.
xap:component
[$xap:component] -> element — Construct a named component — the typed state/intent/view triple — as pure data. view: (a closure answering panel/table/list markup that [$xap:serve] renders as HTML at GET /) is xap.md §16.1's single-medium APPLIANCE exception, not the default: a XAP serves its surface as data at GET /surface (application/cx) and GET /events (SSE), and a separate client materializes it (cx-platform/ux + ux-web, or ux-tui) — leave view: out for that, the authored-XAP default (N-CLIENT-2).
xap:compose
[$xap:compose] -> element — Compose n feature grammars into ONE grammar document — or reject with every W1-W6 conflict (CXER4870); zero arguments yield the empty grammar (the identity). An OPTIONAL trailing map carries the deployment's fulfilment selection — {selection: <the deployment's [features ...] element>} — and runs the three kit-to-fulfilment checks of the composition spec section 4.3b: the claim exists at the kit document's revision (CXER4903), the fulfilment's verbs cover the contract (CXER4904), at most one fulfilment per kit feature (CXER4905). Every violation rides the refusal as a [fulfilment code= at= detail=] entry, and a document the selection bound as a fulfilment contributes its claim and never its verbs, so the composed grammar carries the KIT's vocabulary alone. Without the map nothing of this runs.
xap:compose-report
[$xap:compose-report] -> element — The never-raising tooling face of the compose gate — [compose-report ok=bool [conflict ...]*]; agrees with compose: it raises iff this reports ok=false. It takes the same optional trailing {selection: ...} map and reports the fulfilment violations as [fulfilment ...] entries.
xap:resolve
[$xap:resolve] -> string | element | absence — One head, two shape-dispatched contracts. With a composed [grammar ...] first: rho term resolution (grammar, term, context?) -> string — qualified wins, context narrows, ambiguity is CXER4871 with candidates, unknown is CXER4872 (pure, no journal). With an [xap-runtime ...] handle first: the context->composition entry (runtime, context, opts?) — applies the runtime's configured resolver ({resolver: ...} at run time; :scripted default, or a CX closure applied as ($context $opts) returning an [xap-surface ...] proposal carrying reason=..., or the absence channel), demotes the requested opts.tier per the attention gate (a proposal never seizes the foreground; :foreground caps at foreground-propose), journals the decision as a [resolved ...] event with :reason, and returns the composed surface or absence when nothing meets threshold.
xap:grammar-hash
[$xap:grammar-hash] -> string — The Tier-1 content hash of a composed grammar under canonical form — the structural-equality oracle and the distribution supply-chain witness.
xap:resolve-respond
[$xap:resolve-respond] -> null — Record the principal's response to a surfacing (xap.md §20.1) — the ramp fold's second input: (runtime, surface-name, response) with response one of :acted-on / :glanced-dismissed / :ignored / :suppressed. Journals a [resolution-response ...] event; the fold attributes it to the (component x class) candidates of the most recent [resolved ...] decision for that surface and scores asymmetrically — two consecutive acted-ons per level step (slow to gain), a dismissal drops a level and any response resets the streak (fast to lose), suppressed sticks at level 0 until a later acted-on or a dial pin. The organic bootstrap for a fresh capability is a summon ([$xap:resolve $rt $ctx {summon: 'component'}] — level 0's own semantics) whose surfacing then accumulates responses.
xap:resolver-default
[$xap:resolver-default] -> element — Build the deterministic scripted resolver from explicit affinity rules ([affinity component=... when=<CXPath> class=<atom> rank=<int>?] ...) — validated now, malformed rules refuse. Returns a [scripted-resolver ...] value that [$xap:run {resolver: ...}] accepts; resolve then runs the fold: when-filter against the [context ...] projection, ramp-level gate per capability x context-class (level >=2 to surface, >=3 for a T2 placement; pins ride the dial as delegations at scope 'ramp/<component>/<class>' with [setting level=N]; unpinned capabilities start at 0 = summon-only), declared rank, and one composed [xap-surface ...] with a generated auditable reason — or the absence channel. The runtime's bare :scripted default runs the same fold over the components' own §3.2 affinity declarations.
xap:surface
[$xap:surface] -> element — Construct a named surface — a composition of placed panels — as pure data.
xap:panel
[$xap:panel] -> element — Place a registered component into a surface as a panel — pure data.
xap:render
[$xap:render] -> element — Materialize a surface for one medium — an HTML fragment or the application/cx view tree.
xap:run
[$xap:run] -> element — Wire a single-tenant runtime and register its components, surfaces, and handlers; {grammar: G} pins a composed grammar as the control vocabulary, switching on emit-side resolution and constituent-set PEP evaluation.
xap:serve
[$xap:serve] -> element — Run a runtime over a real socket by bootstrapping the [?http-service] engine. The wire is four routes: GET /surface — the surface as application/cx, THE CLIENT ROUTE (xap.md §16.1, N-CLIENT-2); GET /events — the same surface as server-sent events; POST /intent/<verb> — an intent; GET / — an HTML page of the components' view: panels, the single-medium appliance exception. opts is the closed set {runtime, tenant, shell, auth, session, block}. session: is the cx-platform/session configuration (store, login, the cookie keys): the bridge resolves each request's session — the cookie the sso routes set, or a bearer minted for a CLI or an agent — and every intent commits as that session's principal, the same journal entry an in-process emit with {actor:} writes. A request with no session on a journal-bound runtime answers 401 naming the login route, never a 403 from an attempted anonymous append; a journal-bound runtime served with neither session: nor auth: refuses at BOOT with E_XAP_SERVE_UNATTRIBUTED. An unbound runtime keeps the localhost dev floor.
xap:host-push
[$xap:host-push] -> element — Push one hosted feature's fresh contract readout to every /stream subscriber as its named SSE event — the same frame an admitted act pushes. For deployment workers whose changes bypass the intent path (source ingest, simulation ticks).
xap:host
[$xap:host] -> element — Boot a complete XAP from its deployment document (distribution spec, deployment host): acquire every pinned feature from the CX_REGISTRY-bound store (fail closed on pin or verification mismatch), compose the grammar (the W-gate at load), load each feature's runtime-contract module from its verified tree, attach the grammar and the document's runtime bindings to a runtime, translate the roles ladder + spec governance + agent capabilities into dials, and serve the standard surface (/grammar /features /surface /surface/{f} /intent /stream). The DURABLE PLANE is deployment DATA, not opts: the document's [runtime …] block declares journal / sources / resolver / log-reduce (one child per [$xap:run] option, compiled into the same run opts that one validator checks), and [principals [deriver …]] binds each derived noun's producer — superseding the derivers opt when present. Naming journal/sources/resolver/log-reduce in opts refuses at boot. opts: url (required), store (required — the working store), tenant, block, routes (adapter path->closure map), resolve-actor (intent->actor closure), derivers (the direct-run parity path — same shape [$xap:run {derivers: (…)}] takes; a document with [deriver] rows supersedes it). A XAP with no custom transport is zero server code.
xap:emit
[$xap:emit] -> element — Run the committed cascade for one intent — PEP check, journal append, ordered dispatch. With a grammar attached, the term resolves through rho first (the committed event is qualified) and a derived verb is admitted by its transitive leaf constituent grants, never the wrapper's name.
xap:derive
[$xap:derive] -> element — Commit one derived-noun event as the noun's bound deriver (composition spec §4.2): {deriver:, noun:, record:} appends under actor deriver:<name> through the ordinary envelope/fold path — a derived noun's only producer; an unbound noun or a mismatched deriver refuses.
xap:instantiate
[$xap:instantiate] -> element — Derive a feature from an immutable archetype under the refinement contract (composition spec §4.3): a pinned [instance …] binding renames presentation, adds, tightens, and selects — repurposing an inherited name or loosening an inherited signature refuses; the effective [feature …] carries its [instantiated-from …] provenance and composes like any other.
xap:emits-of
[$xap:emits-of] -> sequence — The client vocabulary a [feature …] or a composed [grammar …] already declares (composition spec §6.1): one [do VERB [field :type]…] atom per ACT verb, in declaration order, ready to hand to [$xap:component]'s emits:. The optional options map selects the effect FAMILIES answered — {effects: (:act)} is the default and names every verb a principal invokes (act, arrange, and the undeclared effect), {effects: (:observe)} names the read verbs, whose slots are typed from the noun they read; the agent-tool projection asks for both so an observe verb projects as a read-only tool. The slots are the verb's declared intent parameters; a bare [intent [do :v]] falls back to the written noun's fields, and every slot's type comes from that noun's [field … type=] declaration — so the derived block equals what a careful author would write, and cannot drift from the grammar the way a hand-restated one does. The head's spelling follows the subject: a feature's atoms head with a bare atom (:register), a composition's with the qualified string the canonical act form uses ('owner/register'), so a derived block and the act it emits need no re-qualification. A withdrawn verb is not in the vocabulary. A subject with no act verbs answers the empty sequence.
xap:instantiate-preflight
[$xap:instantiate-preflight] -> element — The refinement instrument (composition spec §4.3): the same gate [$xap:instantiate] enforces, read as a report — one [refinement status=clean|refused|redundant …] per refinement of the binding, in binding order, with the refused ones carrying their own code. Report-first, never refuses what the gate decides; ok= is false exactly when instantiate would raise. A stale of= pin is itself reported, so a vendor can ask which of a fleet's bindings a candidate archetype would break, and on which refinement, instead of losing the fleet at the first tenant.
xap:cohesion
[$xap:cohesion] -> element — The granularity instrument (composition spec §4.4): a feature's internal graph under the declared-edge set, reported as components + members + edges. Report-first, never refuses — two components are two features wearing one name, and the components are the split the gate would accept.
xap:on
[$xap:on] -> element — Register a handler for intents matching a pattern, under the cascade discipline; answers the [subscription id=…] handle that cancels it. The pattern is a verb atom, a qualified verb string, a [?quote]d act pattern whose $x holes bind and reach the handler, or an arity-1 predicate; a handler that RETURNS an [err] rejects the act (CXER4851) and the err flows out of emit.
xap:off
[$xap:off] -> bool — Cancel a registration made by on, named by its [subscription] handle or by its id string; answers whether a live registration was cancelled. A registration that cannot be cancelled is a lifetime leak by construction, which is why on hands back a handle at all.
xap:state
[$xap:state] -> element — Return the journal-folded state slice selected by a CXPath — the server-authoritative truth now.
xap:coord-publish
[$xap:coord-publish] -> element — Publish a frame to a transient coordination channel — ephemeral viewport/selection, latest-wins, off the journal and PEP cascade.
xap:coord-read
[$xap:coord-read] -> element — Read the latest frame from a transient coordination channel — the latest-wins value off the journal and PEP cascade.
xap:pkg-tree
[$xap:pkg-tree] -> element — Build the canonical package content document from [entry path=... CONTENT] elements — sorted by path, byte-stable, so its store hash is the package's Tier-1 hash.
xap:pkg-seal
[$xap:pkg-seal] -> element — Store a package content tree, pin its Tier-1 hash into the manifest, and store the manifest beside it (the tag-object pattern) — returns [sealed hash=... manifest=...].
xap:pkg-sign
[$xap:pkg-sign] -> element — Fill the manifest's detached [signature]: ed25519 by a publisher-DID key over the sealed Tier-1 hash.
xap:pkg-publish
[$xap:pkg-publish] -> element — Set the name@version alias to a signed manifest's hash; released aliases are immutable — re-pointing is rejected, a new artifact is a new version.
xap:pkg-fetch
[$xap:pkg-fetch] -> element — Resolve a Tier-1 hash or name@version alias to its manifest document; aliases only discover hashes, trust never rests on one.
xap:pkg-verify
[$xap:pkg-verify] -> element — The fail-closed trust chain: content re-hashes to the pinned Tier-1 hash, the signature verifies against the publisher DID, and every supplied attestation VC verifies — nothing stages on failure.
xap:pkg-install
[$xap:pkg-install] -> element — The consumer pipeline: fetch, verify, per-kind gate (features meet the one W1-W6 compose gate, libraries the exports-surface check, clients the client-spec check), consent-as-grants of exactly the needs set, and enable — returning the updated hash-pinned deployment document.
xap:pkg-requires-closure
[$xap:pkg-requires-closure] -> element — Resolve the code-plane requires closure transitively into sorted hash-pinned [pin] entries — the reproducible lockfile view spanning both dependency planes.
xap:pkg-catalog
[$xap:pkg-catalog] -> element — Discover published packages on any store — local (alias table) or served over cx-store:// (CXPath query pushdown, server-side) — as a sorted [catalog [package ...]] with grammar/exports summaries; opts filter by term, name, or version. Trust never rests on discovery: install re-verifies the fetched artifact.
xap:license-issue
[$xap:license-issue] -> element — Issue an entitlement VC — an attenuating delegation granting enable of a package (or bundle member set), shaped by the terms: version range, expiry + grace window (subscription), seats and per-seat sub-issuance (the delegation chain is the count), members (bundle). Every commercial model is a shape of this one credential.
xap:license-verify
[$xap:license-verify] -> element — The enable-time entitlement check: the VC verifies (window plus subscription grace), the coverage holds for package@version (direct or bundle membership), and a seat credential's chain attenuates correctly — offline-capable, journal-recordable, a PEP check rather than a DRM subsystem.
xap:bundle-members
[$xap:bundle-members] -> element — Compute the member set a market bundle DEFINES: its own members plus the closure of every bundle its includes block names, duplicates collapsed on member identity and sorted by it, so one graph has one canonical value. An include cycle refuses, as does an include or -- under require-catalog -- a member pin the store does not carry. A bundle is a catalog object, never a composite feature: this walk never touches the compose gate.
xap:dial
[$xap:dial] -> element — Set the operational-control mode at a scope by issuing a scoped authz delegation.
xap:revoke
[$xap:revoke] -> element — Revoke an issued dial delegation by id; the agent's authority lapses and why-allowed flips to false.
xap:why-allowed
[$xap:why-allowed] -> element — Explain why an actor can or cannot emit a given intent — a query over the authority model. With a grammar attached, a derived verb is answered over its transitive leaf constituent grant set — allowed only when every constituent decision permits.
xap:push-keypair
[$xap:push-keypair] -> element — A fresh P-256 key, [ec-private-key crv="P-256" application-server-key=… [x] [y] [d]]: the VAPID key a deployment keeps; its application-server-key is the base64url value a page passes to pushManager.subscribe.
xap:push-encrypt
[$xap:push-encrypt] -> bytes — The RFC 8291 aes128gcm body of one push message for one subscription (the Push API map {endpoint, keys: {p256dh, auth}} or a [push-subscription] element), under a fresh sender key and salt.
xap:push-vapid
[$xap:push-vapid] -> string — The RFC 8292 Authorization value vapid t=<ES256 JWT>, k=<key> for a push to an endpoint's origin; opts vapid-key, subject (mailto: or https:), expires (seconds, at most 86400).
xap:push-send
[$xap:push-send] -> element — Encrypt, sign and POST one push (RFC 8030): [push-sent status= endpoint= location=], [push-expired] on 404/410 (delete the subscription), or [push-failed status= reason= retry-after=]. opts vapid-key, subject, ttl, urgency, topic, expires; gated on the net grant.
xap:push-notify
[$xap:push-notify] -> element — One push to every subscription a principal holds on a runtime served with push: (xap.md §29.1); a subscription the push service answers 404/410 for is forgotten. Answers [push-notified principal= sent= expired= failed=] holding each push's result; opts ttl, urgency, topic.