---
title: "mova-whale-util — Mova code model"
description: "Mova code model of tools/whale/src/util.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/whale/src/util.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/whale/src/util.rs.groupant/>

# mova-whale-util

The groupant beside tools/whale/src/util.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/whale/src/util.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/whale/src/util.rs)
- **source SHA-256:** `6be6e83b40dcd15b…`
- **repository folder:** [`tools/whale/src/util.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/whale/src/util.rs.groupant)
- **repository commit:** `48f2e6f74146`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [Forward approximant](#forward-approximant) |
| **ast** | partial | `syntax.json` |
| **composition** | partial | [Composition](#composition) |
| **cost** | partial | [Cost](#cost) |
| **descriptant** | present | [Descriptant](#descriptant) |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | finite evidence | `tests.md` |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |

## Model text


### Descriptant

Shared bounded file, hash, pin, lease, process-identity and storage helpers. Source: `tools/whale/src/util.rs`. Public, domain-agnostic: concrete prompts, schemas, gate parameters and deployments come from pinned configuration.

### Forward approximant

Pure helpers: SHA-256 of bytes/files; bounded reads (refuse > max); JSON save via synced temp+rename; create_new JSON/bytes; owned 0700 private directories; nonblocking flock leases (`try_lease` -> None when held); `Operation` mutex that explicitly unlocks on drop; /proc start-tick PID identity and liveness; statvfs free-space check; UTF-8 prefix on a character boundary; `pinned({path,sha256})` reading a regular file (absolute, or normal-relative to a base) and requiring an exact hash match.

### Invariant

A pinned read returns bytes only when SHA-256(bytes)=declared hash and the path is a regular file; `prefix(s,n)` is a prefix of s with byte length <= n on a char boundary; `create` never overwrites; `Operation` releases its lock even if descriptor copies survive; lifetime leases (`lease`) are released only when every inherited copy closes.

### Cost

O(file bytes) for hashing/pinned reads (1 MiB buffer); O(1) syscalls for leases, statvfs and /proc reads.

### Composition

Leaf: every other Whale module uses these helpers; `pinned` is the single hash gate for specifications, templates, queues and references.

### behavior_complement

Domain: arbitrary paths/values. Excluded: symlinked or non-regular pin targets, relative non-normal pins, oversized reads, mismatched hashes, non-owned or group/world-accessible private directories, overwrites by `create`. Counterexample: a pin whose file differs by one byte is refused (negative control in spec/whale/agent tests). Evidence status: source-derived model with finite checks, not a proof.

### reverse_reconstruction

From a successful pinned read one recovers the exact bytes and their hash; from a hash alone the file is not recoverable (many preimages, SHA-256 not inverted). From `prefix(s,n)` all strings sharing that prefix are compatible antecedents. A `None` from `try_lease` admits any holder of the same open file description. No unique inverse is claimed.

### tests.md


Exercised through spec::tests (pin refusal), whale/agent/swarm tests (leases, private dirs, storage floor bounds 0 and u64::MAX).

Command: cargo test --manifest-path tools/whale/Cargo.toml --offline --locked (74 tests, fake teachers/executables; two identical runs on 2026-11-03).
These are finite fixtures; no live run, model call or deployment was exercised.