📐crab-status-observation

The groupant beside tools/crab/src/status_observation.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Components

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

Model text

descriptant

Status observer epoch

A real operational gap motivated this module: a controller's fixed legacy status paths do not automatically observe newer independently supervised native workers. Overwriting old failed snapshots would hide history rather than connect the new pipeline. The generic fix adds an immutable, explicit read-only attachment catalog. Concrete worker paths, campaigns and identities remain outside public code.

Counters are projected before arbitrary receipt details can consume a generic object-key truncation budget. Missing kinds/configuration identities stay visible as a compatibility gap. Future heartbeat values are distinct from age zero. A status report never grants marker authority, proves process health, or admits training. Root may invoke this public module directly before a deliberate daemon reload; no worker or active consultant must be interrupted merely for observation.

The first native fixtures pass without models, training, DBs or live terminal calls. Repeated output at a supplied fixed time is identical. These are finite structural/refusal checks, not semantic accuracy or hostile-filesystem guarantees.

model

Bounded status observations

Forward vidtvorant

Subject: the exact adjacent Rust source. Domain: a trusted catalog of at most eight entries, each with a unique ASCII ID and kind of at most 64 bytes, absolute UTF-8 path of at most 1024 bytes without parent traversal, and lowercase SHA256 configuration identity. Observation input (a,t,F) comprises one attachment, supplied read time and encountered ordinary Linux filesystem state.

validate(A) refuses invalid catalogs without opening files. observe(a,t) repeats single-entry validation, opens read-only with O_NONBLOCK/O_NOFOLLOW, requires a regular file and reads at most B+1 bytes, B=262144. Metadata size and actual read length have independent caps. A bounded parsed JSON object reaches the projection only if kind and config_sha256 equal the configured pair exactly.

Let P retain only the source-declared unsigned scalars, three Boolean flags, bounded state/current_page strings and at most sixteen valid unsigned counters from each of counts/source_counts. Truncation is explicit. Prompts, nested objects and other fields or invalid types are omitted rather than repaired or set to zero. The output includes SHA256(read bytes) and H(t,h): unknown for no unsigned h, future for h>t, stale for h<=t and t-h>120, fresh otherwise. Age is null for future or missing timestamps. Health, control and training admission always remain false.

This is an exact source-derived partial categorical model, not a measured faster emulator or percentage-bounded approximant. JSON parser and filesystem behavior remain premises; no numerical approximation metric is admitted.

Invariant and cost

The module cannot write files, signal or launch processes, touch models/DBs or request training. A projected value requires a bounded object and exact identity. Future timestamps cannot become fresh zero-age observations. Counter units remain producer-declared: target counts are not jobs, facts or approved training records.

For n<=8 and cap B, byte work is O(nB), plus bounded projection. Allocations are bounded by the input cap and parser limits. Filesystem latency is not constant. Crab's separate aggregate serialized-response budget still applies. No measured speedup, global liveness or hostile-filesystem isolation theorem is claimed.

behavior_complement

Type: behavior_complement. Universe U contains declared (a,t,F,output) tuples; R is the forward relation and C=U minus R is the exact target. Source-derived partial exclusions: mismatched identity cannot yield value; malformed, oversized or special files cannot yield observed; future timestamps cannot yield fresh; prompt/details cannot appear in P. Invalid configuration cannot open its path. Counterexample to "fresh implies healthy": a matching current status can outlive its process. Evidence: native local refusal/projection/time fixtures, not health.

reverse_reconstruction

Type: reverse_reconstruction. R^-1(o) retains all compatible inputs/states. Projection cannot recover omitted prompts, artifact paths or ID membership. Two objects differing only in prompt have equal P and different source digests. SHA256 constrains read bytes assuming collision resistance, but neither reconstructs them nor authenticates a writer. Evidence: source-derived fiber and projection fixtures; no unique inverse or complete reconstruction implementation.

identity_withholding

Type: observation_exclusion. Domain: bounded parsed objects and configured pair (kind,config hash). Let E be exact pair equality. not E excludes every output with value, even if heartbeat/counters look plausible. Missing identity also fails. Counterexample to freshness-only admission: wrong-config file with current heartbeat remains identity_mismatch. Evidence: kind and hash substitution controls.

temporal_partition

Type: error_partition. Domain: unsigned t and optional unsigned h. The four H branches are disjoint and complete. At t=1000: h=1001 future/null age; h=880 fresh/120; h=879 stale/121; absent/invalid heartbeat unknown/null. Saturating subtraction alone would falsely make the future timestamp age zero. Evidence: native exact boundary fixture. Scope is reported time, not verified clock synchronization or process life.

bounded_information_projection

Type: information_loss. Domain: identity-admitted objects. P forgets unknown fields and types; each counter map keeps deterministic first-sixteen valid numeric entries and declares overflow. Omission is not zero. Counts cannot reconstruct source IDs: two different validated sets may both have count12. Evidence: finite counter/label budgets and prose omission; no semantic-quality or corpus-coverage inference.

artifact_failure_partition

Type: partial_exclusion. Domain: admitted paths and ordinary open/read/parse observations. Invalid_configuration, missing, read_error, not_regular, oversized, malformed and identity_mismatch are distinct states, selected by encountered operations. Metadata cannot authorize an uncapped read. Final symlinks fail, and FIFO opens cannot wait for a writer. Counterexample: treating every readable path as regular data permits blocking on a FIFO. Evidence: bounded local missing, malformed, directory, symlink, FIFO and oversized controls. Parent replacement, mount aliases, device/kernel latency and concurrent writes remain outside proof.

Evidence and composition

Six native module tests cover these finite controls and repeat equality at fixed time. Two native angel integration tests cover default-empty compatibility, immutable loaded catalog and legacy marker separation. Wrong-ID artifacts remain unknown observations, not silently attached workers. A reported training_authorized flag cannot override the observation's training_admission=false coordinate.

Live use is a separate checkpoint: read-only calls can inspect pinned worker identities without starting a server; Crab must reload deliberately to gain a new catalog. No reviewed observation establishes the old role controls govern another pipeline. Syntax projection is partial and does not expand macros or resolve semantics. All evidence is finite; no universal verification is inferred.

tests

Evidence

2026-11-02: six actual native module tests and two angel integration tests passed within the focused angel:: family: 27 passed, 49 unrelated library tests filtered. The command used the owning public Crab crate, offline/locked dependencies, at most two build jobs and an isolated target. No teacher, model, DB, signal, worker restart or terminal UI action was invoked.

Module fixtures cover exact identity and fixed projection, wrong kind/hash, future/stale/unknown heartbeat boundaries, malformed/missing/oversized/directory and final-symlink artifacts, nonblocking FIFO rejection, invalid catalogs and counter/label output limits. A fixed supplied read time yields byte-identical observation values on repeat. Integration fixtures preserve omitted-list response shape, frozen loaded catalogs and separate legacy marker effects.

A source mutation removed the complete identity check. The exact native identity partition test then failed with exit 101: a wrong identity became observed. The original source was restored byte-for-byte and the focused family rerun. This red/green evidence tests a real refusal boundary, not linguistic truth.

A separate external harness invoked this exact public module read-only on two native Fish status artifacts and their page producer, checking expected config hashes against actual configuration bytes. All three were identity-matching fresh observations at that dated snapshot. An older Eel status lacked identity fields and was retained as identity_mismatch, without projection or relaxed admission. The observation did not attach anything to the running Crab or control a worker. Private paths, current counts and raw receipts remain in the external worklog.

Syntax projection is repeated byte-identically for each owned Rust source. Source and composition guards establish binding/structure only; central ancestors remain root-integrated. All fixtures and live observations are finite evidence, not a process-health, security-isolation, semantic-quality or training-admission proof.

This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/crab/src/status_observation.rs.groupant/