Elamur Groupantstwin-ledger-failure-witness
The groupant beside tools/twin/tests/ledger.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | approximant |
| ast | partial | ../syntax.json |
| cost | partial | invariant-and-cost |
| descriptant | present | descriptant |
| invariant | partial | invariant-and-cost |
| tests | bounded or representation | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial source derived model | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial source derived model | reverse_reconstruction |
exit_gate | exit_gate | partial source derived model | exit_gate |
timeout_gate | timeout_gate | partial source derived model | timeout_gate |
output_gate | output_gate | partial source derived model | output_gate |
input_binding | input_binding | partial source derived model | input_binding |
Model text
descriptant
twin-ledger-failure-witness
Epoch 2026-10-31
Prospective inspection identified this relation before additions: Run exit/timeout/missing-output specs and assert failure, forecast presence, accepted=false and no updated; separately modify declared input during command and assert no update plus changed-during error.
The production implementation is unchanged; only selected inline tests are appended. Source-bound syntax is generated twice and compared. Native checks exercise bounded helpers; entry orchestration, teacher calls, models and corpora remain source-derived. Partial syntax is not semantic proof. Preserve failure prefixes and ambiguity when refining this model.
approximant
Forward relation
Run exit/timeout/missing-output specs and assert failure, forecast presence, accepted=false and no updated; separately modify declared input during command and assert no update plus changed-during error.
Composition
This fragment isolates the stated helper relation; parent composition retains surrounding effects and failures.
catalog
Typed observations: twin-ledger-failure-witness
Subject: tools/twin/tests/ledger.rs, SHA-256 cdc737ccddf5645b0273733f6c6b9acda530a84d544917d1ba080628a8d14ac9. Domain: bounded source inputs, declared filesystem/environment state and normal allocations. Each view is a partial source-derived relation, not a universal proof. Observation is one helper call or the explicitly described trace. Checks are in tests.md; unexecuted effects remain gaps.
behavior_complement
On these four fixtures successful training update is excluded despite echo complete in exit/mutation cases.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
reverse_reconstruction
No updated file alone admits many rejection causes. Error substring narrows mutated-input witness but not exact file contents or time.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
exit_gate
Nonzero status is sufficient rejection even with expected stdout; not a parser-only output gate.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
timeout_gate
sleep 10 with one-second timeout witnesses timeout rejection, not deterministic exact latency.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
output_gate
Zero exit with echo wrong rejects required contains marker. This does not test sha256 output constraints.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
input_binding
Declared fixture starts old then child writes changed; changed-during substring and no updated bind input stability. No other input types tested.
Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.
tests
Checks and limits
failed_timeout_invalid_output_and_changed_input_do_not_train invoked exactly, twice per profile.
Exact native outcomes and command metadata are retained in the external wave33 cycle receipt bundle. Selected names run twice in debug and release; syntax is independently regenerated twice. Compiled mutations and source restoration receipts distinguish behavior changes from assertion-only controls. These claims are finalized in evidence.md. No live teacher, real model/corpus, benchmark CLI or lesson-learning CLI is run.
invariant-and-cost
Invariant and cost
All paths operate in fresh scratch. Failure still preserves forecast evidence; update absence is the admission boundary observation.
Four child runs and bounded temp-file operations, one timeout path; no fixed wall time guarantee.
No executable percentage surrogate is claimed: effects, categorical acceptance and report text have no justified approximate metric here. Future profiles require a useful metric, zero case, reference and evidence at caps 1/2/5/10%.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/failure-witness.groupant/