Using Field-Journal for Experience Accumulation and Knowledge Reuse in Reverse-Skill

The reverse-skill repository implements a self-evolving workflow where the field-journal automatically captures execution history, commands, and resolutions into structured markdown entries, enabling AI agents to retrieve and reuse prior solutions across reverse-engineering tasks.

The reverse-skill repository provides a Skill-Router and Tool-Orchestration platform designed for complex security and reverse-engineering workflows. At its core lies the field-journal system, a persistent knowledge base that transforms ad-hoc analysis into reusable institutional memory. This article examines how the field-journal enables experience accumulation and knowledge reuse across tasks, automatically evolving with every execution according to the source code in zhaoxuya520/reverse-skill.

Architecture of the Field-Journal System

The field-journal operates within a five-layer architecture defined in docs/ARCHITECTURE.md. While the Routing Layer (skills/SKILL.md reading skills/routing.md) initiates task classification, it critically interfaces with the journal before execution begins via the CheckJournal node. After task completion, the WriteJournal node persists new knowledge back to the storage layer.

Knowledge Storage Structure

Journal entries reside in skills/field-journal/ as individual markdown files following the naming convention seed-XXX_descriptive-name.md or YYYY-MM-DD_specific-technique.md. Example entries include seed-008_apk-okhttp-ssl-pin-bypass.md and 2026-08-06_cortex-m-msc-firmware-self-keyed-rotate-xor.md.

Each entry documents:

• Task – Description of the reverse-engineering objective
• Commands – Executable snippets used during analysis
• Issue – Pitfalls or errors encountered
• Solution – Final resolution and reusable experience snippets

The _index.md file maintains a fast-lookup index of all entries, regenerated by scripts/refresh-tool-index.sh or scripts/refresh-tool-index.ps1.

The Automatic Evolution Mechanism

As implemented in the "自动进化机制" section of docs/ARCHITECTURE.md, the system employs two explicit feedback loops:

1. CheckJournal (Read-Before-Execute) – Before invoking Skill workflows (e.g., skills/ida-reverse/, skills/radare2/, skills/apk-reverse/), the router queries the journal index. If the task signature matches a prior entry, the system injects the stored solution directly.
2. WriteJournal (Write-After-Execute) – Upon completion, the execution layer appends a new markdown entry and updates _index.md, capturing novel techniques for future reuse.

Implementing Experience Accumulation

The field-journal drives continuous improvement through platform-agnostic persistence mechanisms that function identically across Windows, Kali Linux, and macOS environments.

Read-Before-Execute Pattern

When a user submits a request, the Skill-Router first checks skills/field-journal/_index.md for semantic matches. If the task involves previously solved challenges—such as APK SSL pinning bypass or custom firmware decryption—the router retrieves the specific markdown file (e.g., seed-012_log4shell-jndi-rce.md) and prepends the solution context to the current execution plan.

This eliminates redundant tool invocation and prevents repeated analysis of identical binary patterns or vulnerability classes.

Write-After-Execute Pattern

After the Execution Layer completes a task—whether through local binaries, MCP servers, or browser automation—the system triggers the WriteJournal node. This appends a new entry to skills/field-journal/ and executes the refresh script:

bash skills/scripts/refresh-tool-index.sh

The script updates _index.md with the new entry's metadata, ensuring the knowledge base remains indexed for the next CheckJournal query.

Practical Usage and Code Examples

Three operational patterns demonstrate how agents interact with the field-journal for experience reuse.

Refreshing the Tool Index

Ensure the system recognizes new journal entries and updated tool availability:

# From repository root

bash skills/scripts/refresh-tool-index.sh

Executing a Skill with Journal Lookup

Run a reverse-engineering workflow that automatically checks the journal before execution:

# Windows host example

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "Analyze APK signature verification"

The master-route.ps1 script consults skills/routing.md, then queries the field-journal index for prior APK analysis entries before invoking the skills/apk-reverse/ workflow.

Manually Adding Field-Journal Entries

When a task uncovers a novel technique, manually append a markdown file:

# seed-999_custom-encryption-shim.md

## Task

Analyze a custom encryption routine in a .so library.

## Commands

objdump -d libcustom.so | grep -i decrypt

## Issue

The routine used a non-standard calling convention causing crashes.

## Solution

Wrap the routine with a shim that normalises the stack layout before calling.

Place this file in skills/field-journal/ and run refresh-tool-index.sh to index it.

Cross-Platform Journal Consistency

The field-journal functions identically across supported platforms:

• Windows: RULES.md and skills/scripts/master-route.ps1 manage journal paths
• Kali Linux: kali/RULES-kali.md with kali/scripts/bootstrap-reverse.sh ensures skills/field-journal/ exists
• Generic Linux/macOS: platforms/linux.md and platforms/macos.md define compatible paths

Bootstrap scripts (bootstrap-reverse.ps1 or bootstrap-reverse.sh) verify the journal directory structure during initialization, regardless of whether dependencies are installed via winget, apt, brew, or pip.

Summary

• The field-journal in skills/field-journal/ stores reusable solutions as structured markdown entries indexed by _index.md.
• The CheckJournal node enables read-before-execute patterns, automatically injecting prior solutions into new tasks to prevent redundant analysis.
• The WriteJournal node captures execution results after task completion, updating the knowledge base via scripts/refresh-tool-index.sh.
• Manual entries follow a standard format documenting Task, Commands, Issue, and Solution for complex reverse-engineering scenarios.
• Cross-platform bootstrap scripts ensure journal availability across Windows, Kali Linux, and macOS environments.

Frequently Asked Questions

How does the field-journal prevent duplicate analysis work?

Before executing any Skill, the router queries skills/field-journal/_index.md for task signatures matching the current request. When a match exists, the system retrieves the stored solution from the corresponding markdown file (e.g., seed-008_apk-okhttp-ssl-pin-bypass.md) and injects it into the execution context, bypassing rediscovery of commands or workarounds.

What format should manual field-journal entries follow?

Entries must be markdown files in skills/field-journal/ with four required sections: Task (description), Commands (executable snippets), Issue (problem encountered), and Solution (resolution steps). Files like seed-012_log4shell-jndi-rce.md demonstrate this structure, which the refresh-tool-index scripts parse for indexing.

How is the field-journal indexed for fast retrieval?

The scripts/refresh-tool-index.sh (or PowerShell equivalent) regenerates the tool-index manifest and updates _index.md with metadata from all files in skills/field-journal/. This creates a lookup table that the CheckJournal node queries during the routing phase defined in skills/SKILL.md.

Can the field-journal be used across different operating systems?

Yes. The journal storage mechanism is platform-agnostic, operating identically on Windows (via master-route.ps1), Kali Linux (via kali/scripts/bootstrap-reverse.sh), and macOS. The markdown format ensures portability and human readability, while bootstrap scripts ensure the skills/field-journal/ directory exists regardless of the package manager (winget, apt, or brew).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}