📐annot-tests-codex-batches-assertions

The groupant beside annot/tests/codex_batches.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Components

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

Model text

descriptant

annot-tests-codex-batches-assertions

Six assertions exercise resume/publication/model/snapshot/timeout/lock paths of actual annot with fake process transport.

Epoch 2026-10-31: scoped source-derived model. Byte scope [2615,12222); AST is shared partial projection, not a separate semantic proof.

approximant

Scoped forward relation

Six assertions exercise resume/publication/model/snapshot/timeout/lock paths of actual annot with fake process transport.

Parent composition and symbolic resource costs remain in ../approximant.md. No executable percentage surrogate is supplied for this categorical/effect scope.

invariant

Scoped fragment: assertions

Local scope: Nine assertions (plus success_row/ids helpers and a strict no-trim reader) exercise separator-boundary, resume/publication/model/snapshot/timeout/lock paths of actual annot with fake process transport.

The following parent relations supply composition context; claims apply only where this byte scope implements the stated operation. Other operations remain sibling/parent obligations.

Invariants and limits

Each run uses MOVA_CODEX_BIN pointing to the synthetic script; script requires both API variables stripped before execution. No test intentionally contacts live Codex/API. Successful requests return sample OK and fixed token counts, not real model inference. Tempdir cleanup is best effort.

• Unix-only, finite scheduling deadlines, no live teacher or cloud behavior.
• No source mutation control directly targeting fixture implementation; controls target actual queue/production contracts.

models

Scoped fragment: assertions

Local scope: Nine assertions (plus success_row/ids helpers and a strict no-trim reader) exercise separator-boundary, resume/publication/model/snapshot/timeout/lock paths of actual annot with fake process transport.

The following parent relations supply composition context; claims apply only where this byte scope implements the stated operation. Other operations remain sibling/parent obligations.

behavior_complement

The fixture rejects a child inheriting API variables; failing/timeout runs cannot satisfy final-publication assertions. Passing fake tests excludes those observed local wiring failures only, not external transport or adversarial crash cases.

reverse_reconstruction

Observed call count3 after failure/resume is compatible with two initial attempts plus one resumed request under recorded script state; it does not recover remote answers. Identical success JSON can come from many prompt strings because fake output ignores most input except FAIL selector.

environment_isolation

Command-scoped env overrides avoid global process environment races. Fake shell tests key absence; supplied values are fixture-only.

failure_resume_witness

First success plus FAIL produces no final file and two calls; sticky retry leaves calls unchanged; explicit error removal permits only remaining call, final repeated run adds none.

publication_observer

Async test polls final existence at20ms intervals for<=5s then checks two lines/calls. This observes completion, not every intermediate filesystem state.

timeout_and_lock

Long prompt tests writer/timeout behavior within5s. Stale lock PID4294967295 tests no-launch rejection; neither assertion proves all PID races safe.

separator_witness

Supplied partial rows are written by success_row (worker envelope, no terminator) plus an explicit tail. Witness Q=[a,b,c], P=[b]: the final file must start with the exact prior bytes, end with LF, parse row by row and list ids [1,0,2] with two calls. Boundary shapes: empty and whitespace-only files add no record; all-done without LF publishes with zero calls and a terminator; a truncated last row is refused with "incomplete", zero calls and unchanged bytes; FAIL after a repaired boundary leaves exactly prior ++ LF and resumes without repeating a. The ids helper fails on any unparsable row, so a merged line is detected as an error, not as a lower line count.

strict_consumer_witness

A strict reader parses every physical line with serde_json and no trim or blank filter. Priors: whitespace-only space, tab, CR; a terminated row followed by spaces or CR; a complete row followed by a bare CR. Each must publish prior bytes as prefix, end with LF, keep ask counts, and give ids [0,1,2] or [1,0,2] under the strict reader. Not claimed: files that already hold blank physical lines (accepted by the tolerant worker only), Unicode-only whitespace tails.

tests

Scoped fragment: assertions

Local scope: Nine assertions (plus success_row/ids helpers and a strict no-trim reader) exercise separator-boundary, resume/publication/model/snapshot/timeout/lock paths of actual annot with fake process transport.

The following parent relations supply composition context; claims apply only where this byte scope implements the stated operation. Other operations remain sibling/parent obligations.

Bounded source evidence

Selected actual-code tests (twice debug, twice release):

• failure_requires_explicit_resume_and_never_repeats_successes
• async_worker_publishes_only_complete_results
• legacy_teacher_is_rejected_before_launch
• changed_requests_cannot_reuse_partial_answers
• timeout_is_a_failure_without_partial_publication
• stale_worker_lock_is_reported
• partial_without_final_lf_keeps_record_separation_on_resume (wave38)
• partial_boundary_shapes_and_failed_next_request (wave38)
• strict_line_consumers_see_only_json_rows_after_resume (wave38 follow-up)

Run command: cargo test -p annot --bin annot --test codex_batches [--release] -- --test-threads=1 --skip ann:: --skip bfs_transfer_checks. The fake executable fixture uses temporary files, no live teacher/API. Paired named outcomes must match. Six compiled production mutations target batch last-wins, llm closed-set, repair shape gate, hints severity, main seed alias and queue resume. Each compilation exits0, test exits101, exact source restored and focused positive rerun exits0. The fixture itself has no separate mutation. Existing repair test may early-return without dictionary; independent added repair test always runs.

Unexecuted limits:

• Unix-only, finite scheduling deadlines, no live teacher or cloud behavior.
• No source mutation control directly targeting fixture implementation; controls target actual queue/production contracts.

This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/annot/tests/codex_batches.rs.groupant/assertions.groupant/