# Complete Behavior Chain in `RULES.md`: A Deep Dive into the zhaoxuya520/reverse-skill Workflow

> Explore the complete behavior chain in zhaoxuya520/reverse-skill's RULES.md. Understand the 15-step AI workflow for reverse-engineering and penetration testing.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-16

---

**The complete behavior chain in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) is a 15-step canonical workflow (numbered 0-14, with step 11 intentionally omitted) that governs how AI assistants execute reverse-engineering and penetration-testing tasks in the zhaoxuya520/reverse-skill repository.**

This execution chain serves as the single source of truth for deterministic task processing. Every AI assistant interacting with this repository must follow these exact steps, from mandatory authorization through final result output. This article breaks down each phase of the behavior chain, its implementation files, and how developers can verify compliance programmatically.

## What Is the [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) Behavior Chain?

The **canonical behavior chain** resides under the section explicitly labeled *"Canonical Behavior Chain (All other files reference THIS version)"* at `RULES.md#L43-L62`. This design choice makes [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) the authoritative reference—no other files in the repository may override or redefine these steps.

The chain establishes a **client-neutral, deterministic workflow** that guarantees four critical properties for every task:

- Proper authorization before any action
- Verified tool availability before execution
- Continuous evidence tracking throughout
- Complete audit trail in final reporting

## The 15-Step Behavior Chain Explained

| Step | Action | File/Command Reference | Critical Constraint |
|------|--------|------------------------|---------------------|
| **0** | Load mandatory authorization | [`skills/field-journal/precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-auth.md) (≈80 lines) | Must execute first |
| **1** | Identify security/reverse-engineering task type | — | Triggers routing rule |
| **2** | Detect package-root path | Locate [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Establishes `$SKILL_ROOT` |
| **3** | Resolve primary skill | [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) or `master-route.ps1` | Fall back to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) if ambiguous |
| **4** | Initialize case scope | `case-init.ps1` / [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) | `auth.status=granted` and `network_profile` required before any **ACT** |
| **5** | Assign roles and open skill | [`ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/role-map.md) + PRIMARY [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) | — |
| **6** | Propose new skill if unroutable | Web search | Extension mechanism |
| **7** | Verify tool availability | [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | Use template + `refresh-tool-index` if missing |
| **8** | Bootstrap missing tools | `bootstrap-reverse.ps1` / [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) (Kali variant) | Platform-specific scripts |
| **9** | Execute skill workflow | Timeline → Workitems → Evidence → Finding → Path | Consult [`precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-reverse.md), [`precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-pentest.md), or [`agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-obedience-engineering.md) when uncertain |
| **10** | Research and persist findings | Web search + `references/` directory | On difficulty only |
| **11** | *(Intentionally omitted)* | — | Reserved for future extension |
| **12** | Continuous progress reporting | — | Never go silent |
| **13** | Run Completion Checklist | — | Full evidence chain required in report |
| **14** | Output final results | — | Terminal step |

Each step includes explicit file references from `RULES.md#L45-L74`, ensuring reproducibility across different runtime environments.

## Critical Dependencies and Implementation Files

The behavior chain delegates to specialized files for each operational phase. Understanding these dependencies is essential for troubleshooting workflow failures or extending the system.

### Authorization and Routing (Steps 0-3)

```powershell

# Step 0: Load mandatory authorization (≈80 lines of policy)

powershell -File "$env:SKILL_ROOT\skills\field-journal\precedent-auth.md"

# Steps 1-3: Task detection and primary skill resolution

$taskType = Get-UserIntent
if ($taskType -match "reverse|pentest") {
    . "$env:SKILL_ROOT\skills\scripts\master-route.ps1" -Hint $taskType
}

```

The routing system implements a **fallback hierarchy**: [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) takes precedence, with [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) serving as the ambiguity resolver. This design prevents routing deadlocks when task classification is uncertain.

### Scope Initialization and Tooling (Steps 4-8)

Step **4** enforces the most critical gate in the entire chain: `auth.status=granted` and `network_profile` must be set before any **ACT** operation. This is implemented in `skills/scripts/case-init.ps1`.

```bash

# Steps 7-8: Tool verification and platform-specific bootstrap (Linux/macOS)

if ! grep -q "^jadx.*yes" "$SKILL_ROOT/skills/tool-index.md"; then
    bash "$SKILL_ROOT/skills/scripts/bootstrap-reverse.sh" jadx --start-services
    bash "$SKILL_ROOT/skills/scripts/refresh-tool-index.sh"
fi

```

The [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) file (with its `.template` backup) acts as a local registry. The `refresh-tool-index` scripts update this registry after new installations, maintaining synchronization between actual system state and the chain's internal expectations.

### Execution and Compliance (Steps 9-14)

Step **9** implements the core **Evidence → Finding → Path** workflow defined in [`ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/evidence-finding-path.md). The chain includes two behavioral guardrails for this phase:

- **Hesitation handler**: Consult [`skills/field-journal/precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-reverse.md) or [`precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-pentest.md) when uncertain about approach
- **Excuse rebuttal**: Reference [`skills/llm-security/references/agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/references/agent-obedience-engineering.md) when tempted to skip steps

```powershell

# Step 9: Primary skill execution with evidence collection

powershell -File "$env:SKILL_ROOT\skills\${primarySkill}.ps1"

# Continuous reporting (step 12) is enforced by the runtime

# Completion Checklist (step 13) validates evidence chain completeness

# Final output (step 14) terminates the workflow

```

## The Omitted Step 11: Design Intentionality

The gap between steps 10 and 12 is **deliberate**, not an error. The [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) source explicitly leaves step 11 undefined, creating a reserved slot for future workflow extensions without requiring renumbering of existing steps. This forward-compatibility mechanism ensures that:

- Existing automation parsing the chain won't break on future updates
- New capabilities can be inserted without disrupting documentation references
- Version detection can identify chain variants by checking step 11's definition status

## How to Validate Behavior Chain Compliance

Developers can verify that an AI assistant followed the complete behavior chain by checking for these artifacts:

1. **Authorization proof**: [`skills/field-journal/precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-auth.md) timestamp and hash
2. **Routing decision**: Entry in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) log or `master-route.ps1` output
3. **Scope initialization**: [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) with `auth.status=granted` and populated `network_profile`
4. **Tool verification**: Matching entries in [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) for all used tools
5. **Evidence chain**: Complete timeline in field-journal with workitem-to-finding mappings
6. **Completion proof**: Checklist validation in final report

Missing any of these artifacts indicates a chain violation, regardless of task success.

## Summary

- [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) contains the **canonical 15-step behavior chain** (0-14, with 11 reserved) that serves as the single source of truth for AI assistant execution in zhaoxuya520/reverse-skill
- **Authorization (step 0)** and **scope initialization (step 4)** are mandatory gates that must complete before any target action
- The **routing system (step 3)** implements hierarchical fallback: [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) → `master-route.ps1` → [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)
- **Tool availability (steps 7-8)** is verified against [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md), with automatic bootstrap via platform-specific scripts
- **Evidence tracking (step 9)** follows the mandatory Evidence → Finding → Path workflow with consultation fallbacks for hesitation and obedience enforcement
- **Step 11 is intentionally omitted** for future extension compatibility

## Frequently Asked Questions

### How does the behavior chain handle ambiguous task routing?

When [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) cannot resolve a definitive primary skill, the chain falls back to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) as the full matrix resolver per `RULES.md#L51-L53`. If routing remains ambiguous after both references, step 6 triggers a web search to propose a new skill definition.

### What prevents an AI assistant from skipping authorization or scope initialization?

Step 4's `case-init.ps1` enforces that `auth.status=granted` and `network_profile` must be set before any **ACT** operation. Additionally, step 9's consultation with [`agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-obedience-engineering.md) provides an "excuse rebuttal table" specifically designed to counter rationalizations for skipping steps.

### Why does step 11 not exist in the behavior chain?

Step 11 is intentionally omitted as a forward-compatibility mechanism. The [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) source reserves this number for future workflow extensions, allowing new capabilities to be inserted without renumbering existing steps or breaking automation that parses the chain structure.