Infrastructure

std-anim-tick

sprite animation clock atom. Owns a global animation counter and exposes the current frame NAME (@entity.frameName = frames[counter % len]) every 100ms tick. Boards compose it via uses + a trait-ref rebound (linkedEntity) to the board entity; render-ui merges @entity.frameName onto the animated sprite's asset, replacing the inlined animTick frame counters that were duplicated across game boards. 1.1.0 redesign: the 1.0.0 units-frame-advance / effects-aging sets were removed — numeric unit frames served the pre-animation-contract regime (draw-sprite paints atlas sub-texture NAMES, which is exactly what frameName now exposes; zero consumers existed), effects aging is owned by std-fx-particles, and the shared-entity one-writer rule (ORB_SHARED_ENTITY_FIELD_CONFLICT) forbids a shared atom co-writing fields a board's own ticks also write. Tick interval is a language-level literal (100ms); the config surface is frames.

Entity: AnimTickItem (runtime)

Traits

Config knobs

std-approval-gate

generic approval gate / approver workflow. Use when a user voices that an action must be reviewed, approved, signed off, or authorized by a privileged role before it proceeds (admin approval, supervisor sign-off, manager approval, gatekeeper review, editor approval, senior editor approval, reviewer approval, publishing approval, draft approval, content review, submit drafts then editors review and approve or reject, needs approval before going live, requires sign-off before publish). Persists ApprovalRequest rows + surfaces the PENDING ones in a review queue showing what is being approved and who asked, with Approve / Deny actions — Deny captures a written reason. approverRoles is ENFORCED by the review transitions themselves: an APPROVE/DENY from a viewer whose role is not listed does not fire. blockSelfApproval additionally stops a reviewer approving their own request (four-eyes) — DENY stays allowed as self-withdrawal. On approval emits ApprovalGranted; on denial emits ApprovalDenied (with the reason). Hosts that replay the gated action MUST route a failed replay back via APPROVAL_REPLAY_FAILED so the request reopens instead of being silently consumed. Compose onto any orbital whose action you want to gate: the target orbital emits an external event, an ApprovalRequest row is created (stamp subjectLabel/subjectId/requestedBy so reviewers see what they are judging), and downstream effects wait on ApprovalGranted. Differs from std-mod-queue, which is content-moderation-specific.

Entity: ApprovalRequest (persistent)

Traits

Config knobs

std-audit-capture

event-interceptor audit log / audit trail. Use when a user voices that a record's changes must be tracked, logged, or auditable (audit trail, track changes, change history, who edited what, mutation log, record changes, log every edit, edit history, modification log, who did what when, accountability log). Listens for the generic EntityMutated sentinel (rename via traitOverrides.events to the real mutation event, e.g. ContactSaved) and persists an AuditEntry row capturing actor, action, entity type/id, before/after snapshots, and timestamp. captureEventTypes filters on @payload.data.kind, or on the delivered event's own name when the payload carries no kind (empty = capture all). Every entry also records where the change came from — the delivering event, the behavior and module that emitted it, and the scheduled job when a tick caused it — with no change to the upstream emitter. Compose with std-lifecycle to apply retention. Composable via extraTraits to interpose audit logging behind any mutating trait.

Entity: AuditEntry (persistent)

Traits

Config knobs

std-cache-aside

std-cache-aside as a Function

Entity: CacheEntry (runtime)

Traits

Config knobs

std-calendar-sync

two-way Google Calendar synchronization engine. PUSH: a 15-minute cron scan (and the user-addressable SYNC_NOW) walks targetEntity rows whose externalEventId marker is blank and creates a remote event per row through calendar.createEvent, reading the summary/start/end via the configured field mapping (titleField/startField/endField/durationMinutes fallback/locationField/descriptionField) — so ANY event-shaped host entity pushes, provided it declares the two marker columns externalEventId : string and syncedAt : number (the remindedAt precedent). PULL: CAL_REMOTE_CHANGED (delivered by the shared /api/hooks/google-calendar ingress from a calendar.watch channel) or the same cycle after a clean push lists remote events (incremental via the in-memory sync token; a restart falls back to a full window list) and upserts each into the atom's own canonical CalendarEvent store, matched by externalEventId — pulls land in the canonical store, NOT the arbitrary target, because persist keys are static in the language; bind calendar UI to CalendarEvent to surface remote events. Conflict detection (local-newer-than-remote) needs a local-modified marker convention and is a recorded gap, not a decorative state. Composes with std-notify-on-event via CAL_SYNCED / CAL_SYNC_FAILED.

Entity: CalendarSyncRun (persistent)

Traits

Config knobs

std-cascade-on-delete

relational owns cascade. Listens for a parent-deleted sentinel (ParentDeleted — rename via traitOverrides.events to the consumer's actual parent-deleted event), then deletes every dependent row whose foreignKeyField points at the deleted parent — via a self-driving loop (delete the head of the matching set, re-fetch until none remain). Emits CascadeRowDeleted per row and CascadeCompleted when done.

Entity: CascadeLog (persistent)

Traits

Config knobs

std-circuit-breaker

std-circuit-breaker as a Function

Entity: ServiceNode (runtime)

Traits

Config knobs

std-cooldown

ability/action cooldown primitive; START begins the countdown, READY fires when it expires.

Entity: CooldownRecord (runtime)

Traits

Config knobs

std-cross-reference

join-table primitive for N:M relationships. Listens for LinkRequested/UnlinkRequested/FETCH_LINKS_FOR and manages the junction collection (default CrossRefLink [persistent: cross_ref_links]). Rebind via linkedEntity={YourJunction} to your consumer junction; if your junction's id fields differ from leftId/rightId, override them with fields{} renames at the call site. A rebind target must supply leftId, rightId, createdAt, filteredLinks. Emits LinkCreated, LinkRemoved, LinksLoaded as external broadcasts for downstream consumers.

Entity: CrossRefLink (persistent)

Traits

std-data-erasure

GDPR Art. 17 right-to-be-forgotten queue. Tracks ErasureRequest rows through pending → grace → executed lifecycle with Cancel during grace. v1.0 ships the request lifecycle UI + knob set; auto-emit of ExecuteErasure after grace lands in v1.1 (loop-with-emit gap — docs/Almadar_Std_Factories.md). Target app/ atoms then own the actual delete or piiFields scrub via an ExecuteErasure listener.

Entity: ErasureRequest (persistent)

Traits

Config knobs

std-data-import

staged CSV import run, source-agnostic: upload → staged review → confirm → parse+map → handoff. UPLOAD_CSV opens a run and persists an ImportBatch row (status uploaded, fieldMappingJson recorded verbatim for provenance); the host's file UI parses the CSV and answers with STAGE_ROWS, one JSON string per raw row, which the atom bulk-persists into import_rows against the batch id and presents as a staged review (row/error counts + Confirm/Discard). CONFIRM_IMPORT marks the batch confirmed, emits IMPORT_CONFIRMED { batchId, sourceName, rowCount }, and fetches the batch's staged rows; on fetch success the atom parses each rowJson via json/parse, remaps keys through the batch's mappingJson, and emits IMPORT_ROWS_PARSED { batchId, rows, failed } — the persist half is the CONSUMER organism's: it listens for IMPORT_ROWS_PARSED and persists the mapped rows into its own target entity (cross-atom persist into a consumer's entity is not expressible from here). This is deliberately the CSV-file path: the atom never calls a source service — sourceName/fieldMappingJson/targetEntity are consumer configs, and any persist failure marks the batch row failed and fires IMPORT_FAILED, never a silent swallow. Compose with std-import for the file-picker menu.

Entity: ImportBatch (persistent)

Traits

Config knobs

std-game-clock

fixed-timestep authoritative clock games compose to drive time; emits GameClockTicked every 100ms while running.

Entity: GameClockRecord (runtime)

Traits

Config knobs

std-global-search

cross-module federated search. Use when a user voices that one search box should query several modules at once (global search, search everything, unified search, cross-module search, federated search, search across records, omnisearch, one search box, aggregated results, grouped results). One SEARCH event fans out to every module key listed in the modules config (comma-separated, deterministic — no registry magic): the trait walks the parsed key list with an internal FAN_OUT_STEP sentinel and emits one scoped MODULE_SEARCH_REQUESTED { moduleKey, queryText, typeFilter, scopeJson } -> external per key, so modules respond in parallel rather than in sequence. Modules answer with SEARCH_RESULTS { moduleKey, resultsJson }; each answer appends a SearchResultGroup to the entity, so the merged view stays grouped by module. A module that answers twice is counted once, a keyless answer is filed under the answering module's name, and every group records which behavior answered it. Client/person/date/type filters ride scopeJson — the atom never interprets them. Every query persists as a SearchQuery row (recent/saved searches) when saveHistory is on. The input is the mapped search-input type rendered inline with event renamed to SEARCH (the std-geosearch idiom); its native {searchTerm}/{value} payloads are bridged via str/default, so programmatic SEARCH { queryText, typeFilter, scopeJson } emitters and the UI box drive the same arm.

Entity: SearchQuery (persistent)

Traits

Config knobs

std-knowledge-loop

generic epistemic-loop / decision-gate machinery. Use when a user voices that a claim, hypothesis, or fix needs to be varied, predicted, falsified, independently checked, and calibrated before it is trusted (root-cause investigation, hypothesis testing, a fix that needs sign-off before it ships, a claim that needs a second opinion). The topology (vary -> compare -> hypothesize -> predict -> falsify -> verify -> generalize -> isolate & intervene -> compose -> calibrate -> select next target -> vary again) is fixed and never re-authored per domain. Each gate is announced: entering falsification emits FalsificationRequested, entering verification emits VerificationRequested, entering calibration emits CalibrationRequested (all carry the claim's title + candidateStructure). Who answers a gate is the consumer's call: with manualFalsification / manualVerification on (the default) the atom renders Survived/Failed and Checks-agree/Checks-disagree buttons and a person judges; a consumer that can compute the verdict sets the knob off, authors a sibling trait that listens for the *Requested event, does the domain check, and emits its result, then overrides listens {} at the call site to route that result into SURVIVED/FAILED or CHECKS_AGREE/CHECKS_DISAGREE — the when guard on that route IS the consumer's definition of what the gate means (e.g. ReproCheck.REPRO_RESULT -> SURVIVED when (>= ?passRate 0.95)). Calibration is enforced by the atom itself: a submitted numeric score is checked against reliabilityThreshold. On a claim clearing calibration, emits LoopConcluded (title, reliabilityScore) so a composing host can act on the validated result.

Entity: KnowledgeClaim (runtime)

Traits

Config knobs

std-lifecycle

age-based status lifecycle for a target entity. A periodic tick scans the target for records in fromStatus whose dateField is older than ageDays, and transitions each one to toStatus — every matching record, via a self-driving scan loop (process the head of a filtered fetch, persist the status, re-fetch until the set drains). Compose onto any orbital and bind targetEntity + the status/date knobs.

Entity: LifecycleRunLog (persistent)

Traits

Config knobs

std-migration-job

one import run of external data into the host system, modeled as a persistent MigrationJob row with a lifecycle state machine: idle → fetching → mapping → reviewing → committing → done | failed. All source access goes through the migration service (call-service "migration" listDocuments / fetchDocument / commit) — the atom never talks to a source directly, and the host-injected service handler resolves credentials from the connectionRef knob (a reference, never the secret). Staging/mapping is host work (deterministic pipeline or agent): the atom fetches, the host stages and emits MIGRATION_STAGED with stats and, optionally, the staged units/skipped/validationErrors rows themselves — when the rows are supplied, reviewing renders an ImportPreviewTree so the user can see what will commit before approving. The user approves (MIGRATION_APPROVED) and only then does commit run. Terminal runs persist the job row for provenance. Rebind the entity to a host-owned job entity via linkedEntity; target, connectionRef and reviewSlot are config knobs.

Entity: MigrationJob (persistent)

Traits

Config knobs

std-mod-queue

moderation queue for content review. Owns a ModQueueItem entity (one row per flagged target) and a single review trait that loads pending items, renders them in a data-grid with Approve / Reject / Escalate actions, and persists the reviewer's verdict back to the row.

Entity: ModQueueItem (persistent)

Traits

Config knobs

std-notification-center

per-user notification preferences, web-push subscriptions, and the digest drain for suppressed notifications. Owns the two owner-scoped stores std-notify-on-event consults at dispatch time: NotificationPreference rows (per event key: mode instant/digest/off, channel override, per-user quiet hours) and PushSubscription rows (captured via the browser/push-subscribe flow — the shared service worker + PushManager subscription, persisted as flat endpoint/p256dh/auth credentials). The DigestDrain trait is the delivery half of every suppression std-notify-on-event records: an hourly cron tick scans NotificationRecord audit rows left undispatched for digest/quiet-hours reasons and at least minAgeHours old, delivers each by email (the digest channel), and marks it dispatched — the reminder-scheduler self-driving scan loop verbatim. Compose alongside std-notify-on-event: the listener suppresses and records, this atom captures subscriptions, edits preferences, and drains.

Entity: NotificationPreference (persistent)

Traits

Config knobs

std-notification-preferences

per-person notification preference store plus a consultable gate. Owns NotificationPreference rows (one per person + event key: channel override in_app/email/push/slack/sms/webhook, mode instant/digest/off, quiet-hours window 'HH:MM-HH:MM' such as 22:00-07:00). The PreferencesManage trait is standard CRUD over the store (list / create / update / delete, persisted, success/failure cascade arms): a data-grid browse plus ModalRecordModal create/edit forms whose SAVE carries the full row payload (std-list daisy-chain idiom). The PreferenceGate trait is the consult half other notify traits call: emit CHECK_PREFERENCE { personId, eventKey } and the gate fetches the matching row (a row whose eventKey is blank applies to every event) and answers PREFERENCE_RESOLVED { personId, eventKey, channel, mode, suppressed } — suppressed is true only when the row's quietHours window covers the current hour; mode 'digest' rides on the verdict for the caller to defer. Default policy: no matching row — or a failed lookup — resolves fail-open to { channel: in_app, mode: instant, suppressed: false }; the absence of a preference never silences a notification.

Entity: NotificationPreference (persistent)

Traits

Config knobs

std-notify-on-event

cross-orbital wiring atom. Subscribes to events from another orbital (e.g. CheckoutOrbital emits OrderPlaced, OrderRecordOrbital reacts via this atom) and dispatches a notification. Use when one orbital needs to react to or be notified about events that happen in another orbital — the wiring goes through this atom's EventOccurred listener which the molecule renames via traitOverrides.events to the upstream event name. Dispatch gates on guardOp: eq (default) does string-equality on triggerStatus against the upstream event's status field; gt/lt/gte/lte instead numerically compare guardField (read from the event's data payload) against guardValue, for threshold-crossing asks such as low-stock alerts. Resolves recipient from recipients (first entry; multi-recipient fan-out is a future extension), falling back to fallbackRecipient when set, or @user.id otherwise. Skips dispatch when the recipient is in suppressionList. Delivery consults std-notification-center data before dispatching: per-person NotificationPreference rows (matched on personId = recipient and eventKey = this listener's eventKey, blank = all) can mute (mode: off), defer to the digest drain (mode: digest), override the channel, or impose per-user quiet hours (a 'HH:MM-HH:MM' window, blank = none); the atom-level quietStartHour/quietEndHour window and the frequencyCapPerWeek rolling cap (counted against dispatched NotificationRecord audit rows for the same recipient + channel) suppress likewise. Every suppression persists an honest audit row (dispatched: false with the reason in error: quiet-hours / digest-deferred / muted-by-preference / frequency-cap / no-push-subscription) which std-notification-center's digest cycle drains later. Channels: in-app emits the notify toast; email/sms/webhook dispatch through call-service (email.send / twilio.sendSMS / webhook.send); push looks up the recipient's PushSubscription row (owned by std-notification-center) and dispatches web-push via push.send (pushTitle falls back to template; pushDeepLink/pushIcon optional). The audit row's dispatched flag is honest — true only once the service call succeeds.

Entity: NotificationRecord (persistent)

Traits

Config knobs

std-page-open

opens a URL in a new, focused browser tab and reports the tab. Wire OPEN to something the person does (a button or a row action), so a page only ever opens because they asked for it. Needs a host with the page service (a browser extension).

Entity: PageOpenRecord (runtime)

Traits

Config knobs

std-page-search

runs one search on a site in a background tab: opens searchUrl with the query as the queryParam parameter, reads up to maxResults elements matching resultSelector (waiting up to waitMs for the results to appear), closes the tab, and reports RESULTS with the fields read from each. One search at a time: SEARCH is accepted again once RESULTS or SEARCH_FAILED is reported. It never clicks anything. Needs a host with the page service (a browser extension with access to the search pages).

Entity: PageSearchRecord (runtime)

Traits

Config knobs

std-page-treat

applies a declared visual treatment to one element of a browser tab (hide, blur, highlight, or label it with text) or restores it, and reports which element it treated. TREAT takes the tab and element id std-page-watch reports. The treatments are a fixed, declared set: no arbitrary styles or scripts. Needs a host with the page service (a browser extension).

Entity: PageTreatRecord (runtime)

Traits

Config knobs

std-page-watch

watches every browser tab whose URL matches match for elements matching itemSelector, and reports each element once as ITEM with the fields read from it, now and as the page changes. Needs a host with the page service (a browser extension, which asks for access to exactly the match pages). Each item carries its tab and element id; compose std-page-treat to hide, blur, highlight or label it.

Entity: PageWatchRecord (runtime)

Traits

Config knobs

std-permission-matrix

role × module permission grant table / capability matrix admin surface. Use when a user voices that permissions must be managed per role and module (permission matrix, role permissions, capability matrix, permission grants, access matrix, who can see finance, hide margins, module-level permissions, admin permission screen, grant management, finance visibility by role, restrict modules by role). Persists PermissionGrant rows (workspaceId + role + module + capability flags canReadFinance / canSeeOthersHours / canSeeMargins) with full CRUD on an admin page mounted at /admin/permissions — create/edit forms are the std-modal ModalRecordModal substrate (the corpus's two-trait CRUD shape, mirroring std-list), persists live in a sibling coordinator trait, and adminRoles is ENFORCED at the persist boundary (a viewer whose role is not listed cannot fire a write, from the button or from the bus). Ships a query trait other traits consult event-wise: CHECK_GRANT { role, module } fetches the matching grant(s) and re-emits GRANT_RESOLVED { role, module, canReadFinance, canSeeOthersHours, canSeeMargins, found }. Grant SURFACE only — entity-layer @read/@update gate integration is a recorded core gap (gates are pure @entity/@user S-expressions and cannot consult another entity's rows), so enforcement stays with the consumer until that core lands.

Entity: PermissionGrant (persistent)

Traits

Config knobs

std-rate-limiter

std-rate-limiter as a Function

Entity: RateBucket (runtime)

Traits

Config knobs

std-reminder-scheduler

deadline reminders for a target entity. A periodic tick scans the target for records whose dateField deadline (a ms-epoch number or an ISO datetime string) is within offsetHours of now and that have not been reminded yet, and emits ReminderDue for each — every matching record, via a self-driving scan loop. direction picks which side of now the scan matches: 'future' (default) fires for deadlines up to offsetHours ahead; 'past' fires once a record's date is at least offsetHours behind now. Marks each record remindedAt so it isn't reminded twice — and only when the record actually matched the scan, so records outside the window stay eligible for later passes. Compose alongside std-notify-on-event to deliver the reminder.

Entity: ReminderRunLog (persistent)

Traits

Config knobs

std-review-cycle

revise-and-resubmit review workflow (document review, pull-request review, design review, editorial review, submission review, send back for changes, request changes, resubmit, review rounds, four-eyes approval). A record moves draft → in review → changes requested → in review → … → approved. One SUBMIT event serves both the first submission and every resubmission; the atom counts review rounds and marks resubmissions on the emitted ReviewRequested. Every move writes a ReviewEvent history row stamped with the states it left and entered. requireSeparateApproval enforces four-eyes review: an approval raised in the same action that submitted the record (an auto-responding rule or bot) is rejected. Headless — the host renders the badge and buttons and routes its actions to SUBMIT / REQUEST_CHANGES / APPROVE.

Entity: ReviewItem (persistent)

Traits

Config knobs

std-row-access-control

row-level access control gate / ownership filter / role-based row visibility. Use when a user voices that only certain users should see or edit certain records (only the owner can edit, private to owner, owner-only visibility, only see your own records, role-based visibility, admin-only access, visible to admins only, restricted to role, permission gate, ownership scoping, hide from other users, only show mine). Listens for RowsLoaded (rename via traitOverrides.events to the consumer's load event), filters @payload.data by @user.id (when ownerField is set) and/or @user.role (when visibleRoles is non-empty), re-emits RowsFiltered for downstream consumers (rename to wire into the UI atom's listen). Composable via extraTraits to interpose between a data fetch and a list/grid UI.

Entity: RowAccessGateView (runtime)

Traits

Config knobs

std-status-lifecycle

the host renders the badge and buttons.

Entity: StatusRecord (persistent)

Traits

Config knobs

std-status-lifecycle-control

infra molecule pairing std-status-lifecycle's StatusMachine, which deliberately surfaces no UI of its own. Pure presentational: shows the current status and one button per legal next move (config.transitions filtered on config.currentStatus), emitting ChangeStatusRequested with the picked move's id/from/to on click. Driven entirely by config (currentStatus/recordId/transitions) rather than a bound entity, so a host embeds it inline at the record it's viewing (currentStatus={@entity.status} recordId={@entity.id} transitions matching the paired StatusMachine's own config.transitions) and points that StatusMachine's listens at this trait's emit (<Composer>.ChangeStatusRequested -> ChangeStatusRequested) instead of at a dead declared-only event.

Entity: StatusControlItem (runtime)

Traits

Config knobs