Elamur Groupantsmodelcheck-library-group-source-bindings
The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | forward |
| ast | partial | ../syntax.json |
| composition | partial | wave34-composition |
| cost | partial | invariant-and-cost |
| descriptant | present | descriptant |
| invariant | partial | invariant-and-cost |
| tests | finite native evidence | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial relational specification | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial relational specification | reverse_reconstruction |
transitive_binding_equality | transitive_binding_equality | partial relational specification | transitive_binding_equality |
canonical_reference_boundary | canonical_reference_boundary | partial relational specification | canonical_reference_boundary |
family_status_projection | family_status_projection | partial relational specification | family_status_projection |
ast_optin_boundary | ast_optin_boundary | partial relational specification | ast_optin_boundary |
Parts
Model text
descriptant
Group transitive binding, confinement, required-type projection and source manifest identity groupant
Epoch 2026-10-31: materialized a scoped view after full-source review. Group manifests match immediate registry child sets and the exact transitive source set with current hashes; source manifests identify the canonical adjacent source and expected digest. Both validate components. Source AST opt-in additionally reads and validates a projection; relative artifact paths may use .. only while canonical target remains inside root.
Each expected source has one binding; no extra binding is admitted. Group IDs used as filenames contain only ASCII alphanumeric ._- excluding . and ... Baseline required-family rows are emitted in fixed complement/reverse order, without proving model truth.
Useful prior epochs remain in the parent descriptant. This child uses exact byte anchors and the same whole-source hash: editing unrelated bytes also invalidates its binding. The fragment is a partial structural/behavior model, not a proof. No executable percentage surrogate is supplied: categorical gates have no defined useful loss metric; any future profile must use supported caps 1, 2, 5 or 10 percent with explicit domain and evidence.
catalog
Wave33 historical scope and evidence follow. Current source hashes and refreshed ranges are in manifest.json; wave34 refinements and evidence are at the source root.
Group transitive binding, confinement, required-type projection and source manifest identity typed models
Subject/revision: source SHA-256 in manifest; scope [30536 , 36788). Domain is one completed scoped call on a fixed snapshot with adequate resources, unless narrowed below. Observation includes return/error and declared filesystem effects. Models are source-derived partial relational constraints; complements are inner exclusion hypotheses, converse relations retain compatible-input ambiguity. No universal proof or inverse executor is claimed. Evidence: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Mutation evidence and limits are recorded in ../wave33-evidence.md.
behavior_complement
Exclude accepted group with wrong/duplicate child set or missing/stale/foreign transitive binding; exclude source identity mismatch or escaped artifact. A valid hash does not establish semantics.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
reverse_reconstruction
A group manifest constrains immediate child IDs and all descendant source digests. Interior source contents remain hash-compatible fibers; group tree topology is additionally constrained by the registry, not reconstructed from hashes alone.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
transitive_binding_equality
Let DescSources(g) be DFS source leaves; declared binding paths must equal this set, each exactly once, with expected current hashes. Child order is immaterial to group set acceptance.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
canonical_reference_boundary
Reference name must be relative and nonblank; canonical target must be a file under root. Internal symlinks may be admitted for generic references; fragment child directories/manifests have stricter rules elsewhere.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
family_status_projection
For each baseline type, absent records map to missing_record; all matching not_materialized map to not_materialized; otherwise declared_requires_review. Multiple same-type entries are allowed with distinct IDs.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
ast_optin_boundary
Only ast.format=rust_syntax_projection invokes artifact integrity validation; absence preserves legacy declaration behavior. Source digest equality and artifact checks do not reparse or certify AST semantics.
Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
tests
Native correspondence
Exact named checks: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges.
See ../wave33-evidence.md for current repeated profiles, actual production mutants and scope limits. AST generation alone is not behavioral evidence. Each reference test body was read before execution.
forward
Scoped forward model
Group transitive binding, confinement, required-type projection and source manifest identity
Group manifests match immediate registry child sets and the exact transitive source set with current hashes; source manifests identify the canonical adjacent source and expected digest. Both validate components. Source AST opt-in additionally reads and validates a projection; relative artifact paths may use .. only while canonical target remains inside root.
invariant-and-cost
Invariant and cost
Each expected source has one binding; no extra binding is admitted. Group IDs used as filenames contain only ASCII alphanumeric ._- excluding . and ... Baseline required-family rows are emitted in fixed complement/reverse order, without proving model truth.
For groups g, sum subtree sizes T_g can be quadratic in registry depth. Binding checks use ordered sets/maps O((T+H) log N), plus repeated component/AST IO and validation. Confinement performs canonicalization for each reference.
wave34-composition
source-ast-dispatch
Accumulate schema/kind/id/status diagnostics, canonical source identity mismatch and expected SHA mismatch. Validate all components even after identity errors. Only rust_syntax_projection format triggers confined artifact read/decode and full syntax validation; append its error after earlier diagnostics. A caller-owned reader shares identical decoded bytes across this source tree.
The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. Changing only manifest SHA cannot refresh stale artifact source metadata. Reference mode and memo mode execute identical validation after decoding; errors accumulate rather than fail fast across manifest/component/AST phases.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant/