Elamur Groupantsmodelcheck-library-evidence-digest
The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | Forward |
| ast | partial | ../../syntax.json |
| cost | partial | Cost |
| descriptant | partial | Descriptant |
| invariant | partial | Invariant |
| tests | partial | Tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial relational specification | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial relational specification | reverse_reconstruction |
first_failure_order | first_failure_order | partial relational specification | first_failure_order |
alias_fiber | alias_fiber | partial relational specification | alias_fiber |
evidence_edit_sensitivity | evidence_edit_sensitivity | partial relational specification | evidence_edit_sensitivity |
caller_refinement | caller_refinement | partial relational specification | caller_refinement |
Model text
Subject: current manifest source SHA and exact UTF-8 range [46076,47398). The observation is one completed scoped call with adequate resources; source-derived relations are partial specifications. Filesystem checks describe sequential reads, not an atomic snapshot.
Forward
Require nonempty path; canonicalize a relative reference to a file under root; require expected SHA text; read current bytes and compare SHA-256; return canonical path only on equality. Callers separately constrain Rust sidecar placement and source object equality.
Invariant
Hash verification always rereads bytes and admits no cached filesystem result. Digest equality establishes declared-byte integrity, not model correctness or unique preimage.
Cost
One canonicalization and file-type check plus O(B) read/hash for B bytes, O(B) temporary read storage. Repeated evidence references repeat this work.
Descriptant
Wave34, 2026-10-31: deeper scope retained under its existing parent without replacing historical views. Decode reuse was proposed before edits and checked against actual reference decoding; behavioral controls and repeated native receipts remain finite evidence. No numerical surrogate is justified for categorical validation outcomes; no percentage accuracy or complete semantic proof is claimed.
Tests
Exact native test: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Parent tests additionally exercise integration and failure order. Current evidence is in ../../wave34-evidence.md; old evidence remains explicitly historical in wave33-evidence.md at the source root.
behavior_complement
Over reference/filesystem/result triples exclude successful returned paths outside root, directories, missing expected hashes or changed bytes whose SHA differs. The exclusion assumes the confined target is not concurrently replaced.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
reverse_reconstruction
Given returned canonical path p and expected h, compatible references are relative spellings resolving to p with current bytes b satisfying SHA256(b)=h. Hash collisions are not ruled out and original spelling is not recovered.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
first_failure_order
Missing path precedes confinement; confinement precedes missing hash; reading precedes digest comparison. A missing file with missing hash therefore yields filesystem failure, not missing-SHA diagnostic.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
alias_fiber
Different sidecar-relative spellings or internal symlinks can resolve to one canonical file. The hash gate preserves that canonical identity while generic reference spelling is forgotten in the return value.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
evidence_edit_sensitivity
Fix path and expected hash. Any byte edit changing digest must reject even if file size and modification metadata match. Executable evidence declarations do not use the parsed JSON memo.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
caller_refinement
Success here is necessary but insufficient for Rust-approximant artifact acceptance: the caller still requires a .rs suffix inside the sidecar and source-object equality. Do not infer those stronger constraints from this helper.
Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::rust_approximants_validate_bindings_budgets_and_evidence. Finite observations do not establish universal completeness.
Epoch 2026-11-04
reference_bytes joins this range. A reference file#Section splits at the first #; the file is confined as before and the digest covers only the unique plain H2 section (heading line through the last nonblank line before the next plain H2). A missing or duplicate heading is an error before any digest comparison. Converse: a fresh section digest admits every file whose selected section has those bytes, whatever the other sections hold; edits elsewhere in the file leave it fresh. Negative controls: consolidate::tests::merges_rewrites_rebinds_and_checks (missing section rejected) and mova-correspondence section_reference_binds_only_its_section (own-section edit stale, other-section edit fresh).
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/component-validation.groupant/evidence-digest.groupant/