Does Rothalyx require an internet connection or a hosted AI provider to work? No. AI is an optional layer; the analysis pipeline runs fully in heuristic-only mode, and the desktop app can stay offline.

Which binary formats does the loader support? PE, ELF, and Mach-O, with address-space mapping, rebasing, and symbol resolution handled by core/memory.

What disassembly engine does it use? Capstone is a listed toolchain dependency; disassembly runs through core/disasm with architecture metadata. The full enumerated architecture set is not published (Additional validation required).

How is analysis state persisted, and can I inspect it outside the app? Projects, annotations, AI output, and artifacts persist to SQLite via core/database; a .sqlite project can be opened directly by the desktop app and read through the SDK.

Can the CLI produce the same results as the desktop app? By design yes, because both consume the same core pipeline. Published cross-surface equivalence tests are not available (Additional validation required).

How do I run AI-assisted analysis from the CLI? Set ROTHALYX_AI_BACKEND, the provider key, and model as environment variables, then run the ai-model subcommand against a binary and optional project database.

Where are my AI provider API keys stored? In the OS keyring: Windows Credential Manager, macOS Keychain, or Linux Secret Service via secret-tool. Rothalyx does not silently store keys in plaintext settings.

What happens if the OS keyring is unavailable on Linux? Rothalyx declines to save the key in the clear; you fall back to environment variables or install host keyring tooling (secret-tool).

Which AI providers and modes are supported? OpenAI (Responses API), Anthropic (Messages API), Gemini (generateContent), OpenAI-compatible gateways, local LLM endpoints, plus heuristic-only and an auto backend.

How does Rothalyx keep AI costs and data egress bounded? It bounds request size, not pricing: max functions per run, request timeout, and an optional daily remote-request cap; billing stays with your own key.

What happens when a model returns a malformed or unusable response? The parser is conservative and falls back to the heuristic path; analysis still completes and persists.

Can I run Rothalyx with a local LLM instead of a hosted provider? Yes. Local LLM mode uses a local OpenAI-compatible endpoint with the same bounded function selection and structured parsing, and no hosted billing.

What language and toolchain do I need to build it? A C++20 compiler, CMake 3.26+, Ninja, SQLite3 dev files, Qt 6 Widgets dev files for the desktop build, and Capstone plus cURL for the full toolchain.

How do I build and run the desktop app from source? cmake --preset dev then cmake --build --preset dev, then run ./build/dev/apps/desktop_qt/rothalyx_desktop_qt, optionally passing a binary or .sqlite path.

How is the decompiler produced from raw instructions? Disassembly lifts to IR, transforms to SSA, runs analysis and type recovery, then core/decompiler emits structured C-like output. Internal pass details are not published (Additional validation required).

How does Rothalyx handle hostile or malformed input files? Two sanitizer-backed corpus runners (loader and trace) build under the asan-fuzz preset; malformed inputs must be rejected cleanly, and any crash or sanitizer finding is a release-blocking failure.

Why does LeakSanitizer fail to start in my fuzzing sandbox? Under a tracer or restricted sandbox LSan may refuse to run; keep ASan and UBSan enabled and set ASAN_OPTIONS=detect_leaks=0 for that session.

How do I integrate Rothalyx into my own tooling? Through the C ABI in core/sdk/include/rothalyx/sdk/api.h, consumable from Python, Rust, Go, or other FFI targets; core calls are analyze_binary, open_project, get_latest_run, and the function/insight enumerators.

What is the SDK string-lifetime rule I need to respect? Strings inside result structs are owned by the project handle and stay valid only until the next call that refreshes the same cached collection or until close_project; copy them if you need them longer.

How do I report a security vulnerability? Use GitHub private vulnerability reporting (or contact the maintainer privately); include affected version/commit, platform and package type, reproduction steps, impact, and a safe PoC. In-scope classes include hostile-binary parser bugs, sandbox escapes, debugger attachment issues, distributed-worker auth/transport flaws, and credential or model-backend leakage.