reverse-engineering-anything/experiments/analysis-efficiency/native-load-image-views.md

Native load-image delivery verification

native-load-image-views.mjs runs the compiled production stdio MCP server with a caller-selected Ghidra and JDK. It compares complete delivery with a summary plus selected relocation pages, then exports and authenticates the complete parent. Every call uses its actual advertised SDK contract. Both cold and warm reads run in one fresh server; OS file caches are not declared cold.

Build each selected runtime with the pinned toolchain. Use absolute paths or paths relative to the verifier's launch directory, and new output directories:

node experiments/analysis-efficiency/native-load-image-views.mjs \
  --runtime /path/to/baseline --mode complete \
  --target /usr/lib/x86_64-linux-gnu/libcrypto.so.3 \
  --ghidra /path/to/ghidra_12.1.4_PUBLIC --java /path/to/jdk-21 \
  --output /new/baseline-report
node experiments/analysis-efficiency/native-load-image-views.mjs \
  --runtime /path/to/feature --mode summary \
  --target /usr/lib/x86_64-linux-gnu/libcrypto.so.3 \
  --ghidra /path/to/ghidra_12.1.4_PUBLIC --java /path/to/jdk-21 \
  --output /new/summary-report --control /new/baseline-report

The question is the verification state, all collection counts, and the first four relocation addresses/statuses. The summary path additionally checks the last relocation's recorded bytes and unavailable independent verification checks. It never treats ELF observations as verified. Complete delivery can exceed the MCP response limit: the baseline then follows the reported retained reference, exports its source and selects facts locally. That recovery is an extra workflow, not a successful complete inline MCP reply. Include its calls and local reads when comparing completed tasks.

The independent GNU readelf -Wr oracle checks that every file-table relocation coordinate survives, including multiplicity. readelf -Wl supplies the original PT_LOAD base independently of Ghidra's chosen import base. Producer order can differ. Additional provider observations are retained and reported separately; this oracle does not independently verify their origin. Full observation digests and selected facts must agree with the control run.

The target SHA-256, native oracle output, raw catalog, arguments/replies, complete Evidence and phase durations stay in the output directory. Measure whole-process-family elapsed time, CPU and peak memory externally, with bounded CPU/heap and a memory stop condition. The child requests a 1.5 GiB Ghidra heap and a 3 GiB Node heap; neither is a whole-family RSS bound. Estimate tokens over catalog discovery, arguments, all replies and local recovery facts using a named tokenizer. Raw serialized schema estimates are not actual model usage; protocol framing, prompts and client rendering remain unmeasured.

The shared receipt finalizer closes both transports, removes its owned workspace after successful cleanup, and preserves cleanup/publication failures in the report. Its phase elapsed field precedes final receipt publication; external whole-family measurements must include that finalization.

Recorded Linux x64 verification

One fresh cold/warm session per revision used Node 24.22.1, Ghidra 12.1.4, two CPUs and the system libcrypto.so.3 with SHA-256 76dd3d93e5ee48950a92a58d59b94de8143847f91a80d9682c938767b991577d. Baseline 42382651b has the same tree as main fc43e285e; feature 7a53a4a7f. Both retained the same parent ID and 21,118 observations. GNU readelf declared 21,117 relocation coordinates, all present; one provider-only coordinate at relative 0x47dc60 remained visible without an independently established origin.

Whole two-capture harness	Complete + local recovery	Summary + selected reads
Direct capture reply	Refused at the 10 MiB boundary	9,787 bytes
Complete parent Evidence	9,114,888 bytes	9,114,888 bytes
Raw serialization, cl100k_base estimate	912,927 tokens	936,730 tokens
Elapsed	164.93 s	169.88 s
Process-family CPU	281.75 s	293.06 s
Sampled process-family RSS peak	2.01 GiB	2.30 GiB

Token estimates include one raw catalog discovery, call arguments/replies and baseline local recovery facts. Local command text, prompts, protocol framing and client rendering were not measured; these are not model-usage totals. The summary harness also checks tail bytes and unavailable checks through additional RPCs. Neither lower task tokens, faster analysis nor lower memory is established by this single pair. The benefit is direct bounded MCP access to facts that previously required an export and local selection. RSS summed the owned process family every 100 ms; shared pages can be double-counted and short peaks missed. OS caches were warm.

The real CLI published the same complete parent with summary delivery, then a separate CLI process read selected first/last rows from that bundle without configured Ghidra/JDK. That file-page read took 4.83 s, 5.89 CPU seconds and 0.51 GiB sampled family RSS. This verifies historical projection independently of reopening a native provider. Other hosts, engines and formats were not verified in this experiment.