---
title: "modelcheck-library-group-source-bindings — Mova code model"
description: "Mova code model of tools/modelcheck/src/lib.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant/>

# modelcheck-library-group-source-bindings

The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial
- **source:** [`tools/modelcheck/src/lib.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/modelcheck/src/lib.rs)
- **source SHA-256:** `0a09fdb807efa690…`
- **covers:** Group transitive binding, confinement, required-type projection and source manifest identity (bytes 31958–38348)
- **part of:** [modelcheck-library](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/)
- **repository folder:** [`tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [forward](#forward) |
| **ast** | partial | `../syntax.json` |
| **composition** | partial | [wave34-composition](#wave34-composition) |
| **cost** | partial | [invariant-and-cost](#invariant-and-cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [invariant-and-cost](#invariant-and-cost) |
| **tests** | finite native evidence | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial relational specification | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial relational specification | [reverse_reconstruction](#reverse-reconstruction) |
| `transitive_binding_equality` | transitive_binding_equality | partial relational specification | [transitive_binding_equality](#transitive-binding-equality) |
| `canonical_reference_boundary` | canonical_reference_boundary | partial relational specification | [canonical_reference_boundary](#canonical-reference-boundary) |
| `family_status_projection` | family_status_projection | partial relational specification | [family_status_projection](#family-status-projection) |
| `ast_optin_boundary` | ast_optin_boundary | partial relational specification | [ast_optin_boundary](#ast-optin-boundary) |

## Parts

- [modelcheck-library-source-ast-dispatch](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/group-source-bindings.groupant/source-ast-dispatch.groupant/)

## Model text


### descriptant

#### Group transitive binding, confinement, required-type projection and source manifest identity groupant

Epoch 2026-10-31: materialized a scoped view after full-source review. Group manifests match immediate registry child sets and the exact transitive source set with current hashes; source manifests identify the canonical adjacent source and expected digest. Both validate components. Source AST opt-in additionally reads and validates a projection; relative artifact paths may use .. only while canonical target remains inside root.

Each expected source has one binding; no extra binding is admitted. Group IDs used as filenames contain only ASCII alphanumeric ._- excluding . and ... Baseline required-family rows are emitted in fixed complement/reverse order, without proving model truth.

Useful prior epochs remain in the parent descriptant. This child uses exact byte anchors and the same whole-source hash: editing unrelated bytes also invalidates its binding. The fragment is a partial structural/behavior model, not a proof. No executable percentage surrogate is supplied: categorical gates have no defined useful loss metric; any future profile must use supported caps 1, 2, 5 or 10 percent with explicit domain and evidence.

### catalog

Wave33 historical scope and evidence follow. Current source hashes and refreshed ranges are in manifest.json; wave34 refinements and evidence are at the source root.

## Group transitive binding, confinement, required-type projection and source manifest identity typed models

Subject/revision: source SHA-256 in manifest; scope [30536 , 36788). Domain is one completed scoped call on a fixed snapshot with adequate resources, unless narrowed below. Observation includes return/error and declared filesystem effects. Models are source-derived partial relational constraints; complements are inner exclusion hypotheses, converse relations retain compatible-input ambiguity. No universal proof or inverse executor is claimed. Evidence: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Mutation evidence and limits are recorded in ../wave33-evidence.md.

### behavior_complement

Exclude accepted group with wrong/duplicate child set or missing/stale/foreign transitive binding; exclude source identity mismatch or escaped artifact. A valid hash does not establish semantics.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### reverse_reconstruction

A group manifest constrains immediate child IDs and all descendant source digests. Interior source contents remain hash-compatible fibers; group tree topology is additionally constrained by the registry, not reconstructed from hashes alone.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### transitive_binding_equality

Let DescSources(g) be DFS source leaves; declared binding paths must equal this set, each exactly once, with expected current hashes. Child order is immaterial to group set acceptance.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### canonical_reference_boundary

Reference name must be relative and nonblank; canonical target must be a file under root. Internal symlinks may be admitted for generic references; fragment child directories/manifests have stricter rules elsewhere.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### family_status_projection

For each baseline type, absent records map to missing_record; all matching not_materialized map to not_materialized; otherwise declared_requires_review. Multiple same-type entries are allowed with distinct IDs.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### ast_optin_boundary

Only ast.format=rust_syntax_projection invokes artifact integrity validation; absence preserves legacy declaration behavior. Source digest equality and artifact checks do not reparse or certify AST semantics.

Oracle: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### tests

#### Native correspondence

Exact named checks: groupant_tests::groups_bind_transitive_sources_and_preserve_open_families; syntax::artifact_tests::declared_projection_rejects_stale_wrong_source_and_bad_ranges.

See ../wave33-evidence.md for current repeated profiles, actual production mutants and scope limits. AST generation alone is not behavioral evidence. Each reference test body was read before execution.

### forward

#### Scoped forward model

Group transitive binding, confinement, required-type projection and source manifest identity

Group manifests match immediate registry child sets and the exact transitive source set with current hashes; source manifests identify the canonical adjacent source and expected digest. Both validate components. Source AST opt-in additionally reads and validates a projection; relative artifact paths may use .. only while canonical target remains inside root.

### invariant-and-cost

#### Invariant and cost

Each expected source has one binding; no extra binding is admitted. Group IDs used as filenames contain only ASCII alphanumeric ._- excluding . and ... Baseline required-family rows are emitted in fixed complement/reverse order, without proving model truth.

For groups g, sum subtree sizes T_g can be quadratic in registry depth. Binding checks use ordered sets/maps O((T+H) log N), plus repeated component/AST IO and validation. Confinement performs canonicalization for each reference.

### wave34-composition


#### source-ast-dispatch

Accumulate schema/kind/id/status diagnostics, canonical source identity mismatch and expected SHA mismatch. Validate all components even after identity errors. Only rust_syntax_projection format triggers confined artifact read/decode and full syntax validation; append its error after earlier diagnostics. A caller-owned reader shares identical decoded bytes across this source tree.

The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. Changing only manifest SHA cannot refresh stale artifact source metadata. Reference mode and memo mode execute identical validation after decoding; errors accumulate rather than fail fast across manifest/component/AST phases.