Elamur Groupantstwin-ledger-tests
The groupant beside tools/twin/tests/ledger.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | model.md |
| ast | partial | syntax.json |
| composition | partial | Composition |
| cost | partial | invariant-and-cost |
| descriptant | present | descriptant |
| invariant | partial | invariant-and-cost |
| tests | bounded or representation | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial source derived model | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial source derived model | reverse_reconstruction |
forecast_order | forecast_order | partial source derived model | forecast_order |
tamper_scope | tamper_scope | partial source derived model | tamper_scope |
failure_partition | failure_partition | partial source derived model | failure_partition |
scratch_lifetime | scratch_lifetime | partial source derived model | scratch_lifetime |
Parts
Model text
descriptant
twin-ledger-tests
Epoch 2026-10-31
Prospective inspection identified this relation before additions: Scratch creates unique PID/nanosecond temp directory with best-effort Drop cleanup. spec builds bounded /bin/sh workload. Tests assert forecast before launch, parent-chain count and immutability, reuse/domain/tamper rejection; failed/timeout/missing/mutated-input runs do not train; predict never launches command.
The production implementation is unchanged; only selected inline tests are appended. Source-bound syntax is generated twice and compared. Native checks exercise bounded helpers; entry orchestration, teacher calls, models and corpora remain source-derived. Partial syntax is not semantic proof. Preserve failure prefixes and ambiguity when refining this model.
approximant
Forward relation
Scratch creates unique PID/nanosecond temp directory with best-effort Drop cleanup. spec builds bounded /bin/sh workload. Tests assert forecast before launch, parent-chain count and immutability, reuse/domain/tamper rejection; failed/timeout/missing/mutated-input runs do not train; predict never launches command.
Composition
Actual tests call mova-twin run/report/predict binary via Cargo executable binding. This is independent from cycle training; common forecast/attempt terminology does not create runtime call edges.
catalog
Typed observations: twin-ledger-tests
Subject: tools/twin/tests/ledger.rs, SHA-256 cdc737ccddf5645b0273733f6c6b9acda530a84d544917d1ba080628a8d14ac9. Domain: bounded source inputs, declared filesystem/environment state and normal allocations. Each view is a partial source-derived relation, not a universal proof. Observation is one helper call or the explicitly described trace. Checks are in tests.md; unexecuted effects remain gaps.
behavior_complement
Predict witness excludes launched marker on its synthetic fixture. Failure witnesses exclude updated.json for exit/timeout/missing output and changed input; finite evidence not all workloads.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
reverse_reconstruction
Passing assertions admit many elapsed runtimes, model coefficients and unobserved artifacts. Forecast bytes identity constrains previous record only, not all filesystem state.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
forecast_order
Shell tests forecast exists and observation absent before echo; success witnesses launch ordering on one run, parent observations-before=1 and updated n=2 on next.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
tamper_scope
Changing theta rejects parent; replacing observation with {} rejects parent. Test does not enumerate all tamper fields or prove cryptographic validity.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
failure_partition
Exit 7, timeout sleep, missing 'complete', and modified input each constrain acceptance/update behavior. These are separate subprocess paths with different failure effects.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
scratch_lifetime
Unique path uses PID+nanoseconds and create_dir; collision panics. Drop ignores cleanup failure, so passing test is not proof of no residual files.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
tests
Checks and limits
forecast_precedes_execution_and_parent_chain_is_prospective; failed_timeout_invalid_output_and_changed_input_do_not_train; prediction_does_not_launch_the_command. All bodies inspected, safe synthetic temp roots.
Exact native outcomes and command metadata are retained in the external wave33 cycle receipt bundle. Selected names run twice in debug and release; syntax is independently regenerated twice. Compiled mutations and source restoration receipts distinguish behavior changes from assertion-only controls. These claims are finalized in evidence.md. No live teacher, real model/corpus, benchmark CLI or lesson-learning CLI is run.
evidence
Wave33 evidence — 2026-10-31
Across this nine-source slice, 14 exact native names passed twice in debug and twice in release (56 runs); sorted target-qualified outcomes agree. Six compiled behavior controls fail named assertions and exact restored bytes pass again. One exploratory parser-count control failed by unwrap panic; it was restored and replaced by a form-column assertion control. No assertion-only control is counted.
Nine syntax projections were generated twice and byte compared. Production source prefixes match the base exactly; four files append only formatted cfg(test) blocks. Local groupants validation reports valid=true, zero diagnostics. Counts: nine source roots, ten scoped children, 114 typed views.
See tests.md for this source's precise executed or representation-only coverage. Native evidence does not apply to ignored live teacher or lesson execution. No teacher/API, model/corpus, learning or benchmark CLI was run. Receipts retain numeric statuses, exact names, log/source hashes, original backups, unique mutation replacements and restoration assertions. The external bundle is named octopus-wave33-cycle-2026-10-31.
invariant-and-cost
Invariant and cost
These are synthetic CLI integration witnesses, not production workload performance evidence. Shell timeout uses one-second declared limit around sleep 10; no corpus/network. Parent/tamper checks assert failure and selected artifacts, not every failure detail.
Finite scratch file/process operations; timeout workload bounded by twin timeout enforcement, with external OS scheduling. Counts and timing not universal throughput bounds.
No executable percentage surrogate is claimed: effects, categorical acceptance and report text have no justified approximate metric here. Future profiles require a useful metric, zero case, reference and evidence at caps 1/2/5/10%.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/