xap

The XAP orchestrator — the experience layer at the top of the CX web stack. It composes the general-purpose primitives (bus, journal, authz, session) into a single runtime: pure constructors build components, surfaces, and panels; render materializes a surface for HTML or agent consumption; and run, emit, on, state, dial, and why-allowed drive the committed cascade, journal-folded state, and authority-delegation surface. cx-xap is its own bundled package reached via [?lib 'cx-xap'], not a cx-stdlib module — it layers above stdlib and adds no authority, transport, or markup logic of its own.

xap:component

[$xap:component] -> element — Construct a named component — the typed state/intent/view triple — as pure data.

xap:compose

[$xap:compose] -> element — Compose n feature grammars into ONE grammar document — or reject with every W1-W6 conflict (CXER4870); zero arguments yield the empty grammar (the identity).

xap:compose-report

[$xap:compose-report] -> element — The never-raising tooling face of the compose gate — [compose-report ok=bool [conflict ...]*]; agrees with compose: it raises iff this reports ok=false.

xap:resolve

[$xap:resolve] -> string | element | absence — One head, two shape-dispatched contracts. With a composed [grammar ...] first: rho term resolution (grammar, term, context?) -> string — qualified wins, context narrows, ambiguity is CXER4871 with candidates, unknown is CXER4872 (pure, no journal). With an [xap-runtime ...] handle first: the context->composition entry (runtime, context, opts?) — applies the runtime's configured resolver ({resolver: ...} at run time; :scripted default, or a CX closure applied as ($context $opts) returning an [xap-surface ...] proposal carrying reason=..., or the absence channel), demotes the requested opts.tier per the attention gate (a proposal never seizes the foreground; :foreground caps at foreground-propose), journals the decision as a [resolved ...] event with :reason, and returns the composed surface or absence when nothing meets threshold.

xap:grammar-hash

[$xap:grammar-hash] -> string — The Tier-1 content hash of a composed grammar under canonical form — the structural-equality oracle and the distribution supply-chain witness.

xap:resolve-respond

[$xap:resolve-respond] -> null — Record the principal's response to a surfacing (xap.md §20.1) — the ramp fold's second input: (runtime, surface-name, response) with response one of :acted-on / :glanced-dismissed / :ignored / :suppressed. Journals a [resolution-response ...] event; the fold attributes it to the (component x class) candidates of the most recent [resolved ...] decision for that surface and scores asymmetrically — two consecutive acted-ons per level step (slow to gain), a dismissal drops a level and any response resets the streak (fast to lose), suppressed sticks at level 0 until a later acted-on or a dial pin. The organic bootstrap for a fresh capability is a summon ([$xap:resolve $rt $ctx {summon: 'component'}] — level 0's own semantics) whose surfacing then accumulates responses.

xap:resolver-default

[$xap:resolver-default] -> element — Build the deterministic scripted resolver from explicit affinity rules ([affinity component=... when= class= rank=?] ...) — validated now, malformed rules refuse. Returns a [scripted-resolver ...] value that [$xap:run {resolver: ...}] accepts; resolve then runs the fold: when-filter against the [context ...] projection, ramp-level gate per capability x context-class (level >=2 to surface, >=3 for a T2 placement; pins ride the dial as delegations at scope 'ramp//' with [setting level=N]; unpinned capabilities start at 0 = summon-only), declared rank, and one composed [xap-surface ...] with a generated auditable reason — or the absence channel. The runtime's bare :scripted default runs the same fold over the components' own §3.2 affinity declarations.

xap:surface

[$xap:surface] -> element — Construct a named surface — a composition of placed panels — as pure data.

xap:panel

[$xap:panel] -> element — Place a registered component into a surface as a panel — pure data.

xap:render

[$xap:render] -> element — Materialize a surface for one medium — an HTML fragment or the application/cx view tree.

xap:run

[$xap:run] -> element — Wire a single-tenant runtime and register its components, surfaces, and handlers; {grammar: G} pins a composed grammar as the control vocabulary, switching on emit-side resolution and constituent-set PEP evaluation.

xap:serve

[$xap:serve] -> element — Run a runtime over a real socket by bootstrapping the [?http-service] engine.

xap:host-push

[$xap:host-push] -> element — Push one hosted feature's fresh contract readout to every /stream subscriber as its named SSE event — the same frame an admitted act pushes. For deployment workers whose changes bypass the intent path (source ingest, simulation ticks).

xap:host

[$xap:host] -> element — Boot a complete XAP from its deployment document (distribution spec, deployment host): acquire every pinned feature from the CX_REGISTRY-bound store (fail closed on pin or verification mismatch), compose the grammar (the W-gate at load), attach it to a runtime, translate the roles ladder + spec governance + agent capabilities into dials, load each feature's runtime-contract module from its verified tree, and serve the standard surface (/grammar /features /surface /surface/{f} /intent /stream). opts: url (required), store (required — the working store), tenant, block, routes (adapter path->closure map), resolve-actor (intent->actor closure). A XAP with no custom transport is zero server code.

xap:emit

[$xap:emit] -> element — Run the committed cascade for one intent — PEP check, journal append, ordered dispatch. With a grammar attached, the term resolves through rho first (the committed event is qualified) and a derived verb is admitted by its transitive leaf constituent grants, never the wrapper's name.

xap:on

[$xap:on] -> null — Register a handler for intents matching a pattern, under the cascade discipline.

xap:state

[$xap:state] -> element — Return the journal-folded state slice selected by a CXPath — the server-authoritative truth now.

xap:coord-publish

[$xap:coord-publish] -> element — Publish a frame to a transient coordination channel — ephemeral viewport/selection, latest-wins, off the journal and PEP cascade.

xap:coord-read

[$xap:coord-read] -> element — Read the latest frame from a transient coordination channel — the latest-wins value off the journal and PEP cascade.

xap:pkg-tree

[$xap:pkg-tree] -> element — Build the canonical package content document from [entry path=... CONTENT] elements — sorted by path, byte-stable, so its store hash is the package's Tier-1 hash.

xap:pkg-seal

[$xap:pkg-seal] -> element — Store a package content tree, pin its Tier-1 hash into the manifest, and store the manifest beside it (the tag-object pattern) — returns [sealed hash=... manifest=...].

xap:pkg-sign

[$xap:pkg-sign] -> element — Fill the manifest's detached [signature]: ed25519 by a publisher-DID key over the sealed Tier-1 hash.

xap:pkg-publish

[$xap:pkg-publish] -> element — Set the name@version alias to a signed manifest's hash; released aliases are immutable — re-pointing is rejected, a new artifact is a new version.

xap:pkg-fetch

[$xap:pkg-fetch] -> element — Resolve a Tier-1 hash or name@version alias to its manifest document; aliases only discover hashes, trust never rests on one.

xap:pkg-verify

[$xap:pkg-verify] -> element — The fail-closed trust chain: content re-hashes to the pinned Tier-1 hash, the signature verifies against the publisher DID, and every supplied attestation VC verifies — nothing stages on failure.

xap:pkg-install

[$xap:pkg-install] -> element — The consumer pipeline: fetch, verify, per-kind gate (features meet the one W1-W6 compose gate, libraries the exports-surface check, clients the client-spec check), consent-as-grants of exactly the needs set, and enable — returning the updated hash-pinned deployment document.

xap:pkg-requires-closure

[$xap:pkg-requires-closure] -> element — Resolve the code-plane requires closure transitively into sorted hash-pinned [pin] entries — the reproducible lockfile view spanning both dependency planes.

xap:pkg-catalog

[$xap:pkg-catalog] -> element — Discover published packages on any store — local (alias table) or served over cx-store:// (CXPath query pushdown, server-side) — as a sorted [catalog [package ...]] with grammar/exports summaries; opts filter by term, name, or version. Trust never rests on discovery: install re-verifies the fetched artifact.

xap:license-issue

[$xap:license-issue] -> element — Issue an entitlement VC — an attenuating delegation granting enable of a package (or bundle member set), shaped by the terms: version range, expiry + grace window (subscription), seats and per-seat sub-issuance (the delegation chain is the count), members (bundle). Every commercial model is a shape of this one credential.

xap:license-verify

[$xap:license-verify] -> element — The enable-time entitlement check: the VC verifies (window plus subscription grace), the coverage holds for package@version (direct or bundle membership), and a seat credential's chain attenuates correctly — offline-capable, journal-recordable, a PEP check rather than a DRM subsystem.

xap:dial

[$xap:dial] -> element — Set the operational-control mode at a scope by issuing a scoped authz delegation.

xap:revoke

[$xap:revoke] -> element — Revoke an issued dial delegation by id; the agent's authority lapses and why-allowed flips to false.

xap:why-allowed

[$xap:why-allowed] -> element — Explain why an actor can or cannot emit a given intent — a query over the authority model. With a grammar attached, a derived verb is answered over its transitive leaf constituent grant set — allowed only when every constituent decision permits.