📐modelcheck-library-component-validation

The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Components

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

Parts

• modelcheck-library-evidence-digest

Model text

descriptant

Component references, exact H2 selectors and executable-approximant declaration gates groupant

Epoch 2026-10-31: materialized a scoped view after full-source review. Require core component records and both baseline family types; validate IDs/status/references and optional exact unique H2 sections outside narrow fences. Optional Rust profiles check bindings, confinement, classification compatibility, evidence, budget in {1,2,5,10} and finite nonnegative declared error<=budget.

Unknown nested fields remain opaque. Sections require explicit path and one exact plain H2; @document has no special meaning. Profile acceptance validates declarations only, with no compilation, runtime or accuracy certificate.

Useful prior epochs remain in the parent descriptant. This child uses exact byte anchors and the same whole-source hash: editing unrelated bytes also invalidates its binding. The fragment is a partial structural/behavior model, not a proof. No executable percentage surrogate is supplied: categorical gates have no defined useful loss metric; any future profile must use supported caps 1, 2, 5 or 10 percent with explicit domain and evidence.

catalog

Wave33 historical scope and evidence follow. Current source hashes and refreshed ranges are in manifest.json; wave34 refinements and evidence are at the source root.

Component references, exact H2 selectors and executable-approximant declaration gates typed models

Subject/revision: source SHA-256 in manifest; scope [36788 , 48082). Domain is one completed scoped call on a fixed snapshot with adequate resources, unless narrowed below. Observation includes return/error and declared filesystem effects. Models are source-derived partial relational constraints; complements are inner exclusion hypotheses, converse relations retain compatible-input ambiguity. No universal proof or inverse executor is claimed. Evidence: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Mutation evidence and limits are recorded in ../wave33-evidence.md.

behavior_complement

Exclude accepted missing core/type records, duplicate family IDs, invalid sections or stale executable/evidence hashes; exclude unsupported tiers and negative/over-budget declared errors.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

reverse_reconstruction

An accepted selector constrains compatible artifact text to one exact H2 outside recognized fences; all other text and model truth are ambiguous. Accepted profiles constrain labels/digests/domain strings without recovering executable behavior.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

fence_state_machine

State is Outside or (marker,length). Open backtick/tilde runs of >=3 with <=3 leading spaces; close matching marker of >=opening length and only trailing space/tab. Count exact column-zero heading only Outside.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

budget_boundary_relation

Budget b belongs to {1,2,5,10}; error e is finite and 0<=e<=min(b,10). Zero error is valid but zero budget is not. JSON nonfinite spellings cannot satisfy numeric admission.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

assurance_cross_product

Metric/method labels use enumerated sets; empirical pairs only with finite_observation, analytical pairs with analytical or per_input_certificate. Label membership is independent of mathematical truth.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

hashed_evidence_join

Each profile source object equals manifest source; source, Rust artifact and every nonempty evidence array element must hash-match confined files. Rust artifact must additionally remain inside sidecar and end .rs.

Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

tests

Native correspondence

Exact named checks: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence; groupant_tests::groupant_validation_negative_controls_and_open_extensions.

See ../wave33-evidence.md for current repeated profiles, actual production mutants and scope limits. AST generation alone is not behavioral evidence. Each reference test body was read before execution.

forward

Scoped forward model

Component references, exact H2 selectors and executable-approximant declaration gates

Require core component records and both baseline family types; validate IDs/status/references and optional exact unique H2 sections outside narrow fences. Optional Rust profiles check bindings, confinement, classification compatibility, evidence, budget in {1,2,5,10} and finite nonnegative declared error<=budget.

invariant-and-cost

Invariant and cost

Unknown nested fields remain opaque. Sections require explicit path and one exact plain H2; @document has no special meaning. Profile acceptance validates declarations only, with no compilation, runtime or accuracy certificate.

For C component references and repeated total referenced bytes B, O(B+ID sorting+section scans) plus filesystem calls. Repeated section references reread/rescan the same catalog; source/artifact/evidence files may be hashed per profile. Cache optimization remains unimplemented.

wave34-composition

evidence-digest

Require nonempty path; canonicalize a relative reference to a file under root; require expected SHA text; read current bytes and compare SHA-256; return canonical path only on equality. Callers separately constrain Rust sidecar placement and source object equality.

The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. Hash verification always rereads bytes and admits no cached filesystem result. Digest equality establishes declared-byte integrity, not model correctness or unique preimage.

section-fences

Scan lines with state Outside or (opening marker,run length). Outside, admit <=3-space backtick/tilde runs >=3 with backtick-info restriction; otherwise count exact column-zero H2 string. Inside, close only same marker at least opening length with whitespace-only suffix and skip every line from counting.

The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. Only exact unfenced H2 lines count. Closing fence lines never count. The scan counts all occurrences so duplicate headings remain detectable; it is not a Markdown renderer.

2026-11-04 one-file groupants

The fence automaton moved to sections.rs (shared with consolidation); its fragment is now sections.rs.groupant/section-fences.groupant, and this parent calls sections::heading_count. References accept file#Section: validate_references requires the file to be confined and the section to be exactly one plain H2 heading; a section field may repeat the same name but not a different one. evidence-digest now also covers reference_bytes: a hash-bound file#Section digests only that section's bytes (heading through the line before the next plain H2, trailing blank lines removed). Unchanged: whole-file references, confinement and error order before the digest comparison.

This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/component-validation.groupant/