12 KiB
Native PE and DOS entry-view checkpoint
Continuation of #2016 after #2122 and #2193 merged. Real Ghidra observations and real Codex CLI answers support the selected native facets on these shipped inputs. They do not justify an automatic native summary policy: the four selected replies are larger than the complete dossier for the small PE entry, and smaller for the DOS entry. The initial complete analysis still runs and is delivered in both cases.
This checkpoint changes experiment scripts, corpus inputs and grading only. Existing production CLI/MCP contracts, defaults and session behavior are unchanged.
Inputs and runtime
Production runtime: main 10400fdb57e4226c5ce15af17968a664f35498ce,
including the merged WASM summary work and subsequent main changes. Node
24.18.0/npm 11.16.0, locked dependencies, actual Ghidra 12.1.4 on Linux.
Default auto-analysis remains enabled, with a 768 MiB JVM ceiling and one
active processor. The whole process family uses the existing one-CPU,
4 GiB hard/3 GiB early-stop, no-swap, bounded-task resource scope.
| Shipped artifact | Selected bytes | SHA-256 | Static scope |
|---|---|---|---|
ShareX 19.0.2 ShareX.exe |
198,656 | 46af1ccc514b395cb703633abb5a505a771942b7db9b1915f31aeea541b3685f |
Native PE32+ x86-64 component with no CLR directory; entry 0x1400125c0 derived from original image base/RVA |
FreeDOS EDLIN 2.24 BIN/EDLIN.EXE |
31,492 | 96b2b6d543e2d8bdc83e313756444e103339eb5ee2c1229abe3607539b31ad6e |
Original UPX-compressed DOS MZ; admitted entry 0x10000, independently verified static load image |
Acquisition URLs, archive sizes/digests and exact regular ZIP members are in
corpus.json. EDLIN's package APPINFO/EDLIN.LSM reports its
version and UPX compression. No binary was executed, unpacked or committed.
The independent PE header does not establish Windows runtime behavior.
DOS load-image verification and unpacking-stub pseudocode do not recover the
editor's application logic or establish DOS execution. DOS COM is still untested.
The SDK and frozen model runtime share the exact dist/ and bridge/ file
table digest:
e2b67eb0966072fd8b159edfab074cbaf1db9bfc0ac9c57d25ba1435cc0fdbcf.
The model copy was independently checked against all 1,375 compiled files and
30 bridge files. Runtime copies and detailed receipts remain outside Git.
Public SDK observations
The workflow opens the selected target with Ghidra, resolves the entry,
calls analyze_function once, reads retained procedure/pseudocode/callers/callees
facets, and closes the ephemeral session. DOS obtains its address from
inspect_native_load_image before resolving the procedure. Each facet is checked
against the complete producer facts, original parent ID, target digest and distinct
derived Evidence ID. The actual SDK validates named advertised output contracts.
| Entry | Complete dossier JSON bytes | Four facet replies combined | Workflow seconds | First provider query seconds | Last-observed family CPU seconds | Sampled family peak MiB |
|---|---|---|---|---|---|---|
| ShareX PE | 50,936 | 68,257 | 63.123 | 57.490 | 63.660 | 1,197.85 |
| EDLIN DOS MZ | 224,670 | 70,539 | 26.436 | 21.366 | 26.899 | 939.25 |
These are exploratory observations, not a paired implementation performance cohort. JSON byte counts include the SDK tool-result representations, excluding catalog discovery and wire framing; they are not model token counts. Four PE facets cost about 34% more bytes than that dossier. The DOS facets cost about 69% fewer bytes when reading already-retained Evidence. Their first analysis still returned the full dossier; summing both paths increases first-task traffic. The first provider query includes the observable wait for the imported Program and its analysis, not an independently measured engine-only stage.
The observed PE entry contains 18 analyzed bytes, zero recorded callers and two resolved callees. Ghidra's terminal-call caveat remains explicit. The DOS entry contains 53 analyzed bytes and zero recorded callers/callees; overlapping instruction and abnormal stack-frame warnings remain in the pseudocode. Neither zero count establishes absence of unresolved runtime calls.
An earlier PE probe completed production analysis and two facets, then failed
its harness assertion: a pseudocode page is {text, unit}, not a string. That
failed attempt remains archived and is excluded from successful workflow figures.
The corrected exploratory SDK driver fingerprints are
4876c0ecaa84069ddc508e29649715c6c914bd3c4960a76fa9724b5992123699
and native-helper 76023ad45cd1edab57dcd4a8ccf29a9b8a8378029ff2d9711ae35c73940e80d6.
The published helper in 6d7f6885c removes redundant scopes; replaying the actual
PE/DOS replies reproduces every answer field and the same 9/10 calls. Recorded
real jq entry and entry/main replies also preserve their selected facts, profile
and 4/12-call ordering. These replays are driver regression checks, not fresh
provider runs or timing measurements.
Real Codex CLI observations
Three serial runs used Codex CLI 0.161.0, requested alias gpt-5.6-terra, high
reasoning, temporary isolated profiles and the frozen modified REA MCP runtime.
Resolved server-side model identity is not inferred. The same explicit seven-tool
subset was enabled: open, containing-procedure resolution, dossier, analysis view,
load image, retained Evidence discovery and close. This is not full-catalog tool
selection verification. Questions are PE and
DOS.
| Trial | Total input | Cached input | Uncached input | Output | Seconds | Calls / failed |
|---|---|---|---|---|---|---|
| PE 1 | 451,337 | 399,616 | 51,721 | 3,820 | 130.073 | 12 / 2 |
| DOS 1 | 730,578 | 658,944 | 71,634 | 3,310 | 134.435 | 9 / 0 |
| PE 2 | 498,322 | 429,056 | 69,266 | 3,038 | 192.373 | 9 / 1 |
All three answers match the selected original digest, address, procedure classification/signature/locals, inclusive body ranges, body byte count, pseudocode prefix and relationship counts. Actual Evidence references were observed in the responses; target bytes remained unchanged, close completed and the copied profiles were removed. DOS additionally matches the verified load status and every supplied load-image metadata field. Manual review preserves static/packed-target and terminal-flow qualifications.
The first grader expected only particular nested JSON shapes. It rejected PE's
equivalent text-page object/inclusive-range label and could not grade DOS's
explicit entry @ 0x10000 display. The updated grader compares exact source
values for those representations without parsing displays into lookup identities.
It still rejects wrong text units, returned lengths, body endpoints and missing
facts. Original answers and first grading attempts remain archived; regrading
does not repeat model calls or change their tokens/times.
The PE agent hit the advertised-but-unimplemented native summary recipe: both
trials attempted view: {kind: "summary"}; the first also tried the invalid
native facet summary. Those failed calls and all subsequent recovery/repeated
reads remain included. The public SDK independently reproduced invalid_request
for native summary on both inputs. This pre-existing contract-description mismatch
is recorded in /tmp/rea-analysis-efficiency-bugs-20261012.md for team repair,
as requested; this branch does not repair it.
Model sampled peaks were 1,318.74 / 1,017.70 / 1,234.92 MiB, with last-observed family CPU 72.956 / 71.534 / 74.089 seconds. SDK/model scopes did not abort and their last-observed limit-event counters were zero. Final cgroup counters remained unavailable after scope teardown: the strict resource-qualified overall grades remain unverified. The selected fact/lifecycle checks pass; no universal latency, OOM absence or CPU/memory saving is inferred from these samples.
Reproduction and next decision
Use the pinned toolchain and build the selected production revision. Keep its runtime copy, matching dependencies, provider settings, binaries and receipts outside the checkout, as described in README.md.
python3 experiments/analysis-efficiency/resource-run.py -- \
node experiments/analysis-efficiency/measure.mjs \
--runtime-root /absolute/frozen-runtime --revision EXACT_PRODUCTION_SHA \
--artifact sharex.exe --path /absolute/ShareX.exe \
--providers /absolute/explicit-providers.json \
--native-question entry-views --schemas selected \
--output /absolute/new-native-measurement
For DOS select --artifact freedos.edlin.exe and the original extracted
EDLIN.EXE. --native-question entry retains the existing compact experimental
answer; entry-views performs additional verification reads and the explicit
summary refusal probe. It does not select summary delivery from analyze_function.
The helper fingerprint participates in comparison, and missing native helper
fingerprints are not treated as a comparable current driver.
The reviewed entry-views answer separates selected facet facts from run-specific
references: evidence_ids.retained_views retains each facet's original view and
parent ID, while retained_views holds its item, coverage, limitations and unknowns.
DOS load-image facts retain their source ID and must match the selected carrier
digest before their entry address can be used; a stale result closes the session
without querying a procedure.
Derived view IDs are checked against every prior producer reference as well as
other derived views. DOS model grades require the actual completed load-image
response and its reported source ID; status, digest, entry and supplied metadata
are checked against that observation. Missing, failed or unreferenced responses
cannot establish load-image verification.
The comparator preserves both runs' reference maps and compares the facts. Existing
entry/entry-and-main answers keep their ID arrays. Historical SDK receipts above
retain their original pre-review representation; no replies or measurements were
rewritten, and no provider/model runs were repeated for this representation fix.
Relevant validation includes the real workflows above, recorded-reply regression,
grader negative probes, JavaScript/Python syntax, formatting/diff checks and
npm run check:fast. The cold type/lint gate passed in 112.602 seconds with
sampled peak 3,220,914,176 bytes and five last-observed memory.high events;
this gate is not a performance-qualified experiment. Unrelated domain suites,
packaging and earlier model cohorts were not rerun for this experiment-only change.
The next useful comparison is question-specific native primitives versus a complete dossier, with identical requested facts and actual model trials. Larger PE functions and another unpacked DOS/COM application can extend the coverage progressively. Preserve existing complete defaults and solve the summary-description bug separately before recommending a native summary route.