xap
The XAP orchestrator — the experience layer at the top of the CX web stack. It composes the general-purpose primitives (bus, journal, authz, session) into a single runtime: pure constructors build components, surfaces, and panels; render materializes a surface for HTML or agent consumption; and run, emit, on, state, dial, and why-allowed drive the committed cascade, journal-folded state, and authority-delegation surface. cx-xap is its own bundled package reached via [?lib 'cx-xap'], not a cx-stdlib module — it layers above stdlib and adds no authority, transport, or markup logic of its own.
xap:component
[$xap:component] -> element — Construct a named component — the typed state/intent/view triple — as pure data.
xap:compose
[$xap:compose] -> element — Compose n feature grammars into ONE grammar document — or reject with every W1-W6 conflict (CXER4870); zero arguments yield the empty grammar (the identity).
xap:compose-report
[$xap:compose-report] -> element — The never-raising tooling face of the compose gate — [compose-report ok=bool [conflict ...]*]; agrees with compose: it raises iff this reports ok=false.
xap:resolve
[$xap:resolve] -> string | element | absence — One head, two shape-dispatched contracts. With a composed [grammar ...] first: rho term resolution (grammar, term, context?) -> string — qualified wins, context narrows, ambiguity is CXER4871 with candidates, unknown is CXER4872 (pure, no journal). With an [xap-runtime ...] handle first: the context->composition entry (runtime, context, opts?) — applies the runtime's configured resolver ({resolver: ...} at run time; :scripted default, or a CX closure applied as ($context $opts) returning an [xap-surface ...] proposal carrying reason=..., or the absence channel), demotes the requested opts.tier per the attention gate (a proposal never seizes the foreground; :foreground caps at foreground-propose), journals the decision as a [resolved ...] event with :reason, and returns the composed surface or absence when nothing meets threshold.
xap:grammar-hash
[$xap:grammar-hash] -> string — The Tier-1 content hash of a composed grammar under canonical form — the structural-equality oracle and the distribution supply-chain witness.
xap:resolve-respond
[$xap:resolve-respond] -> null — Record the principal's response to a surfacing (xap.md §20.1) — the ramp fold's second input: (runtime, surface-name, response) with response one of :acted-on / :glanced-dismissed / :ignored / :suppressed. Journals a [resolution-response ...] event; the fold attributes it to the (component x class) candidates of the most recent [resolved ...] decision for that surface and scores asymmetrically — two consecutive acted-ons per level step (slow to gain), a dismissal drops a level and any response resets the streak (fast to lose), suppressed sticks at level 0 until a later acted-on or a dial pin. The organic bootstrap for a fresh capability is a summon ([$xap:resolve $rt $ctx {summon: 'component'}] — level 0's own semantics) whose surfacing then accumulates responses.
xap:resolver-default
[$xap:resolver-default] -> element — Build the deterministic scripted resolver from explicit affinity rules ([affinity component=... when=
xap:surface
[$xap:surface] -> element — Construct a named surface — a composition of placed panels — as pure data.
xap:panel
[$xap:panel] -> element — Place a registered component into a surface as a panel — pure data.
xap:render
[$xap:render] -> element — Materialize a surface for one medium — an HTML fragment or the application/cx view tree.
xap:run
[$xap:run] -> element — Wire a single-tenant runtime and register its components, surfaces, and handlers; {grammar: G} pins a composed grammar as the control vocabulary, switching on emit-side resolution and constituent-set PEP evaluation.
xap:serve
[$xap:serve] -> element — Run a runtime over a real socket by bootstrapping the [?http-service] engine.
xap:host-push
[$xap:host-push] -> element — Push one hosted feature's fresh contract readout to every /stream subscriber as its named SSE event — the same frame an admitted act pushes. For deployment workers whose changes bypass the intent path (source ingest, simulation ticks).
xap:host
[$xap:host] -> element — Boot a complete XAP from its deployment document (distribution spec, deployment host): acquire every pinned feature from the CX_REGISTRY-bound store (fail closed on pin or verification mismatch), compose the grammar (the W-gate at load), attach it to a runtime, translate the roles ladder + spec governance + agent capabilities into dials, load each feature's runtime-contract module from its verified tree, and serve the standard surface (/grammar /features /surface /surface/{f} /intent /stream). opts: url (required), store (required — the working store), tenant, block, routes (adapter path->closure map), resolve-actor (intent->actor closure). A XAP with no custom transport is zero server code.
xap:emit
[$xap:emit] -> element — Run the committed cascade for one intent — PEP check, journal append, ordered dispatch. With a grammar attached, the term resolves through rho first (the committed event is qualified) and a derived verb is admitted by its transitive leaf constituent grants, never the wrapper's name.
xap:on
[$xap:on] -> null — Register a handler for intents matching a pattern, under the cascade discipline.
xap:state
[$xap:state] -> element — Return the journal-folded state slice selected by a CXPath — the server-authoritative truth now.
xap:coord-publish
[$xap:coord-publish] -> element — Publish a frame to a transient coordination channel — ephemeral viewport/selection, latest-wins, off the journal and PEP cascade.
xap:coord-read
[$xap:coord-read] -> element — Read the latest frame from a transient coordination channel — the latest-wins value off the journal and PEP cascade.
xap:pkg-tree
[$xap:pkg-tree] -> element — Build the canonical package content document from [entry path=... CONTENT] elements — sorted by path, byte-stable, so its store hash is the package's Tier-1 hash.
xap:pkg-seal
[$xap:pkg-seal] -> element — Store a package content tree, pin its Tier-1 hash into the manifest, and store the manifest beside it (the tag-object pattern) — returns [sealed hash=... manifest=...].
xap:pkg-sign
[$xap:pkg-sign] -> element — Fill the manifest's detached [signature]: ed25519 by a publisher-DID key over the sealed Tier-1 hash.
xap:pkg-publish
[$xap:pkg-publish] -> element — Set the name@version alias to a signed manifest's hash; released aliases are immutable — re-pointing is rejected, a new artifact is a new version.
xap:pkg-fetch
[$xap:pkg-fetch] -> element — Resolve a Tier-1 hash or name@version alias to its manifest document; aliases only discover hashes, trust never rests on one.
xap:pkg-verify
[$xap:pkg-verify] -> element — The fail-closed trust chain: content re-hashes to the pinned Tier-1 hash, the signature verifies against the publisher DID, and every supplied attestation VC verifies — nothing stages on failure.
xap:pkg-install
[$xap:pkg-install] -> element — The consumer pipeline: fetch, verify, per-kind gate (features meet the one W1-W6 compose gate, libraries the exports-surface check, clients the client-spec check), consent-as-grants of exactly the needs set, and enable — returning the updated hash-pinned deployment document.
xap:pkg-requires-closure
[$xap:pkg-requires-closure] -> element — Resolve the code-plane requires closure transitively into sorted hash-pinned [pin] entries — the reproducible lockfile view spanning both dependency planes.
xap:pkg-catalog
[$xap:pkg-catalog] -> element — Discover published packages on any store — local (alias table) or served over cx-store:// (CXPath query pushdown, server-side) — as a sorted [catalog [package ...]] with grammar/exports summaries; opts filter by term, name, or version. Trust never rests on discovery: install re-verifies the fetched artifact.
xap:license-issue
[$xap:license-issue] -> element — Issue an entitlement VC — an attenuating delegation granting enable of a package (or bundle member set), shaped by the terms: version range, expiry + grace window (subscription), seats and per-seat sub-issuance (the delegation chain is the count), members (bundle). Every commercial model is a shape of this one credential.
xap:license-verify
[$xap:license-verify] -> element — The enable-time entitlement check: the VC verifies (window plus subscription grace), the coverage holds for package@version (direct or bundle membership), and a seat credential's chain attenuates correctly — offline-capable, journal-recordable, a PEP check rather than a DRM subsystem.
xap:dial
[$xap:dial] -> element — Set the operational-control mode at a scope by issuing a scoped authz delegation.
xap:revoke
[$xap:revoke] -> element — Revoke an issued dial delegation by id; the agent's authority lapses and why-allowed flips to false.
xap:why-allowed
[$xap:why-allowed] -> element — Explain why an actor can or cannot emit a given intent — a query over the authority model. With a grammar attached, a derived verb is answered over its transitive leaf constituent grant set — allowed only when every constituent decision permits.