feat(native): inspect offline ELF layout through pwntools (#1037)

* feat(native): inspect offline ELF layout through pwntools

* fix(build): prepare offline ELF verification on clean runners

* fix(native): preserve snapshot acquisition cancellation

* fix(native): handle sectionless ELF and retain decoder diagnostics

* test(native): verify malformed symbol table entry sizes

* fix(native): respect inherited limits and unused segment fields

* fix(native): preserve packed relocations and decoder launch constraints

* fix(native): validate symbol spans and preserve resource failures

* fix(native): preserve diagnostic completeness and memory failures

* fix(native): guard bridge imports against allocation failures

* fix(native): validate relocation symbol and section references

* fix(native): retain diagnostics through compounded cleanup failures

* fix(native): preserve unresolved relocation section references

* fix(native): bound linkage evidence and preserve CPU signal diagnostics

* fix(native): preserve file-size resource failure evidence

* fix(native): retain opaque linkage names and late cancellation output

* test(native): make CPU-limit fixture robust across runners

* fix(native): verify resource failure branches before interpreting exits

* fix(native): validate declared ELF string references

* fix(native): validate section-name table before decoding

* fix(native): enforce canonical ELF name-table escapes

src/application/binaryDiagnostics/BinaryLayoutService.ts

@@ -0,0 +1,91 @@
+import { isAbsolute } from "node:path";
+import type { ExecutionOptions } from "../AnalysisProvider.js";
+import type { BinaryLayoutPort } from "./BinaryLayoutPort.js";
+import type { AnalysisError } from "../../domain/analysisErrorBase.js";
+import {
+  AnalysisCancelledError,
+  AnalysisInputError,
+  AnalysisOutputError,
+} from "../../domain/analysisErrorCore.js";
+import { createEvidence, type Evidence } from "../../domain/evidence.js";
+import {
+  inspectBinaryLayoutInputSchema,
+  binaryLayoutSchema,
+} from "../../domain/native/binaryLayout.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok, type Result } from "../../domain/result.js";
+
+const OPERATION = "inspect_binary_layout";
+
+/** Shared CLI/MCP validation and Evidence composition for offline layout inspection. */
+export class BinaryLayoutService {
+  constructor(readonly provider: BinaryLayoutPort) {}
+
+  /** Bind complete observations to the caller-selected artifact before creating Evidence. */
+  async inspect(
+    rawInput: unknown,
+    options?: ExecutionOptions,
+  ): Promise<Result<Evidence, AnalysisError>> {
+    if (options?.signal?.aborted)
+      return err(new AnalysisCancelledError(OPERATION));
+    const input = inspectBinaryLayoutInputSchema.safeParse(rawInput);
+    if (!input.success)
+      return err(
+        new AnalysisInputError(
+          OPERATION,
+          { cause: input.error },
+          projectInputIssues(input.error.issues, rawInput),
+        ),
+      );
+    if (!isAbsolute(input.data.path))
+      return err(
+        new AnalysisInputError(OPERATION, undefined, [
+          {
+            path: ["path"],
+            reason: "invalid_format",
+            message: "Expected an absolute filesystem path on this host.",
+          },
+        ]),
+      );
+    const inspected = await this.provider.inspect(input.data, options);
+    if (!inspected.ok) return inspected;
+    const diagnostics = binaryLayoutSchema.shape.diagnostics.safeParse(
+      inspected.value.diagnostics,
+    );
+    const outputOptions = diagnostics.success
+      ? { capturedOutput: diagnostics.data }
+      : undefined;
+    if (options?.signal?.aborted)
+      return err(new AnalysisCancelledError(OPERATION, outputOptions));
+    const report = binaryLayoutSchema.safeParse(inspected.value);
+    if (!report.success || report.data.artifact.path !== input.data.path)
+      return err(
+        new AnalysisOutputError(
+          OPERATION,
+          "Binary layout provider returned malformed evidence or changed the selected artifact identity.",
+          outputOptions,
+        ),
+      );
+    const value = report.data;
+    return ok(
+      createEvidence(
+        {
+          path: value.artifact.path,
+          format: "elf",
+          architecture: "x86_64",
+          sha256: value.artifact.sha256,
+        },
+        this.provider.identity,
+        {
+          operation: OPERATION,
+          parameters: input.data,
+          result: value,
+          rawResult: value,
+          confidence: "observed",
+          limitations: value.limitations,
+          locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        },
+      ),
+    );
+  }
+}