mulmoterminal-shared-app

Something other people use

A request like "make a survey for my talk", "I need a sign-up sheet", "let people book a slot", "a form I can send a link to" is asking for a SHARED APP — a thing that lives on the web, keeps its answers in one place, and can be handed to people who do not have this repository or this machine.

Do not offer a printable page, a Google Form, or a stand-alone HTML form as the answer. They are what this looked like before there was anywhere to keep the answers, and each of them leaves the user to solve the actual problem — where the responses go — by themselves. Offer them only if the user turns this down.

What a shared app is

• One repository is one app. The folder this session is open in becomes the app; its declaration is app.json at the root.
• The definition is committed; the answers are not. Schemas and views are files in the repository. Records live in the app's cloud store, so everyone sees the same rows.
• Who may do what is a list of email addresses in app.json. Inviting somebody is adding a line and publishing — they need no account here and no repository.

Start from a template when one fits

Nine shapes are written out in full — declaration, schemas, and the reasoning behind each key:

• templates/salon.md — a request that a NAMED PERSON approves, and only their own (a salon's bookings, interviews, repairs, review assignments). This is what assignee is for.
• templates/gym.md — first come, first served, with a waiting list and a per-class opening time (a gym class, a workshop, a slot booking). This is what stampField and window.fromField are for, and it explains why the capacity lives in the VIEW and not in the rules.
• templates/survey.md — collecting answers, with nothing to run out of (a survey, a quiz, an application form, a sign-up with no cap). The shortest declaration of the nine, and the shape most often written with a public page and nothing else — so this one is built around its member page, which is where the answers are read. It also spells out the three-way trade above, and what a tally may and may not claim about values a respondent typed.
• templates/meeting-room.md — a bookable unit you can LIST IN ADVANCE, taken on the spot with no approval (a meeting room, a desk, equipment on loan, a parking space). This is what idFrom: "field" and mirror are for, and it is the one that spells out who refills the slots, and what a cancellation does NOT do.
• templates/live-poll.md — a page that MOVES while people are looking at it (a live stream, a lecture, a stand-up quiz). This is what views[].live is for, and the only one whose declaration is decided by FAN-OUT: the audience may watch the questions, only the desk may watch the votes, and the shape that would let both is refused by publish. In English, because the strings in its pages are what a stranger reads.
• templates/project-board.md — the same work-claiming board with a ROSTER and an owner's desk: people register a name once (names, idFrom: "auth.uid"), then take work; the owner adds and removes tasks and frees an abandoned one from /m/. This is what writerDelete is for, and the one that spells out view.mine()'s three states — "you have not registered" and "nobody looked" are different answers, and treating them alike shows the registration form to somebody who has already registered. It also shows the owner-only form: a public.submit declaration whose window is CLOSED, which is how a page gets a create form that only a writer may send.
• templates/append-feed.md — a record a CLOSED GROUP writes to and nobody rewrites: rows are only ever added, and only their author may remove one (a shift handover note, an incident timeline, a team log, a class's question board, a chat room). This is what views[].limit is for — the one shape whose collection grows with the app's AGE rather than with the thing being booked — and the one where writerDelete is deliberately ABSENT, which is project-board.md turned over: an owner pressing delete on somebody else's row is refused by Firestore. It is also the only sample showing public.enabled: false beside a populated public.submit, which is the pair the naming makes look contradictory.
• templates/ai-council.md — a discussion the participants are AI AGENTS rather than people, held in public, which a human host can END (a debate, a design review by several models, a red-team panel). This is what agents[] is for — the app publishes the JOB beside the pages, so an agent at another MulmoTerminal takes a seat from the slug alone, with no copy of your repository. It is also the only sample that has to bind its own OWNER: every agent here signs in as the owner, so the host's close is enforced by refIn, a transitions map with no exit, and sealed together — any one alone is walked around in two writes. Read it for what a declaration can and cannot hold when the writer is an agent you handed your sign-in to.
• templates/magazine.md — several writers publishing things to READ, each at its own URL, each signing their own and editing nobody else's (a team blog, a newsletter's back issues, a research log, release notes, a review column). This is what views[].article is for — the platform draws the article page, so the app declares which fields are the title, the body and the byline, and idFrom: "slug" makes the writer's chosen name the document id and freezes it. It is the only sample that states a protocol of its own, the only one whose limit is a COST — publish works it out in bytes and refuses the declaration when it is too large — and the one that explains why the owner has to hold participant on their own collection — audience forces submitOnly, submitOnly closes the writer branch, and an owner who skips it cannot publish at all. Read it before any app where a record is something a stranger is meant to sit and read.