---
title: "octopus-typed-slots — Mova code model"
description: "Mova code model of tools/octopus/src/slots.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/octopus/src/slots.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/octopus/src/slots.rs.groupant/>

# octopus-typed-slots

The groupant beside tools/octopus/src/slots.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/octopus/src/slots.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/octopus/src/slots.rs)
- **source SHA-256:** `c17e0f6aaa361eea…`
- **repository folder:** [`tools/octopus/src/slots.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/octopus/src/slots.rs.groupant)
- **repository commit:** `48f2e6f74146`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [Forward approximant](#forward-approximant) |
| **ast** | partial | `syntax.json` |
| **composition** | partial | [Composition](#composition) |
| **cost** | partial | [Cost](#cost) |
| **descriptant** | present | [Descriptant](#descriptant) |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | finite evidence | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |

## Model text


### model

## octopus-typed-slots

### Descriptant

Typed prompt arguments (URL, host) for configured deputy capabilities: strict validation, placeholder masking before parsing and binding through the native parse. Source: `tools/octopus/src/slots.rs`.

### Forward approximant

mask(prompt): split on whitespace, trim punctuation (a closing parenthesis stays while balanced); a word with '://' must validate as http/https URL without user information, valid host, port 1..65535, printable ASCII; a dotted host shape or IPv4 literal is a host; host/path without scheme is refused; reserved zurl*/zhost* words refused; non-public hosts (loopback, private, link-local, CGNAT, reserved names localhost/.local/.internal/.lan/.home.arpa/.test/.invalid) refused unless policy allows; each argument k becomes placeholder Zurl<k>/Zhost<k>. bound_head(w,node,heads): walk up while the node's relation base is obj/iobj/obl/nmod/appos/conj/compound/flat/list/dep/nsubj and no dependent is an exclusion marker; return the first request head reached.

### Invariant

No argument value enters a plan unless its placeholder node reaches a request head through argument relations; every masked value passed validation; text without URL/host shapes is unchanged by mask.

### Cost

O(prompt bytes) masking; bound_head O(n^2) for n native words (n<=160).

### Composition

Parent: `native-octopus-deputy`. Slot rules bounded (<=4 per capability, disjoint kinds, max<=16); arguments validated before parsing; binding only through argument relations to a request head.

### behavior_complement

Not done: IPv6 literals, schemeless URLs, internationalised domain names in Unicode form, DNS resolution (non-public addresses behind public names are left to the fetcher), coreference ('fetch it'), quoted or negated scopes (refused by the resolver). Counterexample: 'Fetch A because B has a copy.' leaves B under an adverbial clause, so the prompt is refused (red when binding ignores the parse). Evidence status: source-derived model with finite checks, not a proof.

### reverse_reconstruction

From a plan's arguments one recovers the validated values (scheme and host lowercased, '/' added to an empty path) and their native nodes; the original spelling (case, trailing punctuation) is recoverable only from the stored prompt. Many prompts map to one argument list; no unique inverse. No unique inverse is claimed.

### Dolphin pod (2026-11-04)

Slot kind `text`: quoted spans in «», “” or "" are masked first and whole as Ztext placeholders; their words never reach the parser; reserved placeholder words outside spans, unclosed or nested quotes, empty or over-6000-byte spans and control characters refuse with argument_invalid.

### Epoch 2026-11-04 (Whales in English)

Epoch 2026-11-04: SlotKind::Id (catalog slug: >=3 hyphen-joined lowercase alphanumeric parts with a letter and a digit, <=128 bytes), placeholder Zslug*, reserved prefix zslug; mask_with(prompt, policy, ids) masks ids only when enabled; mask() keeps its behaviour.

### tests

#### Checks

Command: cargo test --manifest-path tools/octopus/Cargo.toml --offline --locked with MOVA_OCTOPUS_TEST_MODEL (16 tests including the unchanged native controls; two identical runs on 2026-11-04).

Negative controls 2026-11-04: binding arguments to the first action instead of through the parse, allowing every robots decision, and ordering jobs by arrival only each turn the English tests red; restored afterwards.
These are finite fixtures and one live smoke against the project's own site (2026-11-04); not a proof.

2026-11-04: cargo test --manifest-path tools/whale/Cargo.toml --offline --locked with MOVA_OCTOPUS_TEST_MODEL=$MOVA_DATA/download/0/0.4/en.bin (unit tests incl. 5 service tests, 2 realizer tests, 3 length-gate tests; 2 English tests: 18 prompts, 10 refusals, a served end-to-end run with the real mova-whale child and a fake Codex executable; two identical runs on 2026-11-04)