---
title: "mova-modules-fetch — Mova code model"
description: "Mova code model of tools/modules/src/fetch.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/modules/src/fetch.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/modules/src/fetch.rs.groupant/>

# mova-modules-fetch

The groupant beside tools/modules/src/fetch.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/modules/src/fetch.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/modules/src/fetch.rs)
- **source SHA-256:** `4bfe8c9300bf4556…`
- **repository folder:** [`tools/modules/src/fetch.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/modules/src/fetch.rs.groupant)
- **repository commit:** `00204e2dc35d`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial source model | [forward](#forward) |
| **ast** | partial | `syntax.json` |
| **composition** | partial source model | [composition](#composition) |
| **cost** | partial source model | [cost](#cost) |
| **descriptant** | partial source model | [epoch-memory](#epoch-memory) |
| **invariant** | partial source model | [invariant](#invariant) |
| **tests** | partial source model | [checks](#checks) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `mova-modules-fetch-behavior-complement` | behavior_complement | partial source model | [behavior-complement](#behavior-complement) |
| `mova-modules-fetch-reverse-reconstruction` | reverse_reconstruction | partial source model | [reverse-reconstruction](#reverse-reconstruction) |
| `mova-modules-fetch-policy-and-bone` | constraint_relation | partial source model | [invariant](#invariant) |

## Model text


### forward

`ReleaseFiles::parse` reads `releases/<release>-files.json` (0.5 compiled in) and `check`s it: schema 1; an https
folder `base_url`; per file a unique id and name ending `.tar.gz`, 64-hex SHA-256 and 40-hex btih, `url = base_url +
name`, `torrent_url = url + ".torrent"`, `magnet = Magnet{btih, dn = name, xl = bytes, tr = trackers, ws = [url], xs =
[torrent_url]}.link()`, safe relative `top`/`unpack_to`/install paths, every install source among the contents,
`raw_bytes = Σ contents.bytes`; and the data policy: model and corpus `CC-BY-SA-4.0`, dictionaries ours
(`LicenseRef-Elamur-Cosmic`), a module not ours, not required, unpacked into `modules` with no install entries, no
`wiki`/`wikt` name outside a module, `required ⇔ kind = model`. `render_bone` makes the Markdown page from it.

`fetch_one` downloads into `$MOVA_DATA/release/<r>/<name>.part` by one way: `https` (curl, `--base` rebases URLs);
`torrent` (fetch the .torrent, require `info_hash = btih`, `length = bytes`, `name = name`, download from its first
`url-list` web seed, `verify_file` every piece); `magnet` (parse the link, require its btih to be the file's, take the
first https/file `xs`, then as torrent). `--archive FILE` skips the download. Then size and SHA-256 must equal the
manifest's, else the part file is removed and the call fails. `unpack_and_install`: `tar -tzf` members must lie in
`top` with no absolute or `..` path; unpack into a staging folder, every content's SHA-256 checked, move to
`$MOVA_DATA/<unpack_to>/<top>` (an existing different one renamed `.before-<r>`), stamp `<top>.fetched`; a module is
verified against its module.json and its licence must equal the manifest's; each install entry is copied (a file or a
folder) unless its tree hash already matches, an existing different target renamed `.before-<r>[-n]`.

### invariant

- Nothing is unpacked or installed unless the archive's size and SHA-256 equal the manifest's.
- By `torrent` and `magnet`, additionally: the .torrent hashes to the manifest's btih and every piece's SHA-1 matches.
- No existing file under the data directory is deleted: a replaced one is renamed `.before-<release>`.
- The shipped manifest passes `check`, and `releases/0.5-files.md` = `render_bone(manifest)` byte for byte.

### cost

B archive bytes: download O(B) network; SHA-1 pass O(B) (torrent, magnet); SHA-256 O(B); tar list + unpack O(B);
content SHA-256 O(raw); installs O(installed bytes) copy plus tree hashes of source and target. Memory: one piece
(≤ 16 MiB) or 1 MiB buffers; the .torrent in memory.

### composition

`main.rs` dispatches `mova fetch`; uses `crate::torrent` (Magnet, read_metainfo, verify_file), `crate::fetch`
(the .torrent over https), `crate::safe_rel`, `crate::sha256_hex`, `crate::Manifest::parse` and `crate::verify_dir`
(modules), `crate::data_dir`. `install.sh` runs `mova fetch 0.5 model`. `peta/tools/release-dist` writes the manifest
and the page with `render_bone`.

### behavior-complement

Does not: speak the peer wire protocol, contact trackers or the DHT, exchange metadata (BEP 9), read multi-file or v2
torrents, resume a partial download, check signatures beyond the hashes in the repository's manifest, delete earlier
installs, or decide licences (it checks the manifest's declared licences against fixed policy rules only).

### reverse-reconstruction

From an installed `$MOVA_DATA/<to>` with a `.before-<r>` sibling, both the new and the earlier content are present, so
the install is reversible by renaming. From the stamp `<top>.fetched` the archive's SHA-256 is recovered exactly, hence
(by the manifest) its name, size and btih; the way it was fetched is not recorded. From a refusal the expected and
observed size/SHA-256 are printed; the bad bytes are not kept.

### checks

`cargo test --release -p mova-modules fetch` (the_shipped_manifest_follows_the_policy_and_the_bone_agrees,
policy_rows_go_red, fetch_by_each_way_installs_and_a_tampered_byte_is_refused). Negative controls: a model under our
licence, share-alike dictionaries, a module under our licence, an optional model, Wiktionary contents outside a module,
a magnet without `xs`, a changed SHA-256 in the page, one flipped byte of the served archive (refused by https,
torrent and magnet, nothing installed), a manifest SHA-256 that does not match, a magnet of another info hash. Manual
mutations 2026-11-05: one licence cell of the page and one licence row of the JSON each turn the shipped-manifest
test red; restored, green.

### epoch-memory

2026-11-05, first epoch. Live run against https://research.elamur.ai/download/0/0.5/: `mova fetch 0.5 all` by https,
torrent and magnet each installed the four files in 7–9 s (local network), module verified; `install.sh` twice
(second run: up to date); `--archive` with a file a BitTorrent client (rqbit) downloaded from our seeder. The
web-seed way needed byte ranges on the server only for real BitTorrent clients; `mova fetch` downloads the whole file
from the web seed and checks pieces afterwards.