Complete Behavior Chain in `RULES.md`: A Deep Dive into the zhaoxuya520/reverse-skill Workflow

The complete behavior chain in RULES.md is a 15-step canonical workflow (numbered 0-14, with step 11 intentionally omitted) that governs how AI assistants execute reverse-engineering and penetration-testing tasks in the zhaoxuya520/reverse-skill repository.

This execution chain serves as the single source of truth for deterministic task processing. Every AI assistant interacting with this repository must follow these exact steps, from mandatory authorization through final result output. This article breaks down each phase of the behavior chain, its implementation files, and how developers can verify compliance programmatically.

What Is the RULES.md Behavior Chain?

The canonical behavior chain resides under the section explicitly labeled "Canonical Behavior Chain (All other files reference THIS version)" at RULES.md#L43-L62. This design choice makes RULES.md the authoritative reference—no other files in the repository may override or redefine these steps.

The chain establishes a client-neutral, deterministic workflow that guarantees four critical properties for every task:

• Proper authorization before any action
• Verified tool availability before execution
• Continuous evidence tracking throughout
• Complete audit trail in final reporting

The 15-Step Behavior Chain Explained

Step	Action	File/Command Reference	Critical Constraint
0	Load mandatory authorization	skills/field-journal/precedent-auth.md (≈80 lines)	Must execute first
1	Identify security/reverse-engineering task type	—	Triggers routing rule
2	Detect package-root path	Locate RULES.md	Establishes $SKILL_ROOT
3	Resolve primary skill	skills/MASTER-ROUTING.md or master-route.ps1	Fall back to skills/routing.md if ambiguous
4	Initialize case scope	case-init.ps1 / scope.md	auth.status=granted and network_profile required before any ACT
5	Assign roles and open skill	ops/role-map.md + PRIMARY SKILL.md	—
6	Propose new skill if unroutable	Web search	Extension mechanism
7	Verify tool availability	skills/tool-index.md	Use template + refresh-tool-index if missing
8	Bootstrap missing tools	bootstrap-reverse.ps1 / bootstrap-reverse.sh (Kali variant)	Platform-specific scripts
9	Execute skill workflow	Timeline → Workitems → Evidence → Finding → Path	Consult precedent-reverse.md, precedent-pentest.md, or agent-obedience-engineering.md when uncertain
10	Research and persist findings	Web search + references/ directory	On difficulty only
11	(Intentionally omitted)	—	Reserved for future extension
12	Continuous progress reporting	—	Never go silent
13	Run Completion Checklist	—	Full evidence chain required in report
14	Output final results	—	Terminal step

Each step includes explicit file references from RULES.md#L45-L74, ensuring reproducibility across different runtime environments.

Critical Dependencies and Implementation Files

The behavior chain delegates to specialized files for each operational phase. Understanding these dependencies is essential for troubleshooting workflow failures or extending the system.

Authorization and Routing (Steps 0-3)

# Step 0: Load mandatory authorization (≈80 lines of policy)

powershell -File "$env:SKILL_ROOT\skills\field-journal\precedent-auth.md"

# Steps 1-3: Task detection and primary skill resolution

$taskType = Get-UserIntent
if ($taskType -match "reverse|pentest") {
    . "$env:SKILL_ROOT\skills\scripts\master-route.ps1" -Hint $taskType
}

The routing system implements a fallback hierarchy: MASTER-ROUTING.md takes precedence, with skills/routing.md serving as the ambiguity resolver. This design prevents routing deadlocks when task classification is uncertain.

Scope Initialization and Tooling (Steps 4-8)

Step 4 enforces the most critical gate in the entire chain: auth.status=granted and network_profile must be set before any ACT operation. This is implemented in skills/scripts/case-init.ps1.

# Steps 7-8: Tool verification and platform-specific bootstrap (Linux/macOS)

if ! grep -q "^jadx.*yes" "$SKILL_ROOT/skills/tool-index.md"; then
    bash "$SKILL_ROOT/skills/scripts/bootstrap-reverse.sh" jadx --start-services
    bash "$SKILL_ROOT/skills/scripts/refresh-tool-index.sh"
fi

The tool-index.md file (with its .template backup) acts as a local registry. The refresh-tool-index scripts update this registry after new installations, maintaining synchronization between actual system state and the chain's internal expectations.

Execution and Compliance (Steps 9-14)

Step 9 implements the core Evidence → Finding → Path workflow defined in ops/evidence-finding-path.md. The chain includes two behavioral guardrails for this phase:

• Hesitation handler: Consult skills/field-journal/precedent-reverse.md or precedent-pentest.md when uncertain about approach
• Excuse rebuttal: Reference skills/llm-security/references/agent-obedience-engineering.md when tempted to skip steps

# Step 9: Primary skill execution with evidence collection

powershell -File "$env:SKILL_ROOT\skills\${primarySkill}.ps1"

# Continuous reporting (step 12) is enforced by the runtime

# Completion Checklist (step 13) validates evidence chain completeness

# Final output (step 14) terminates the workflow

The Omitted Step 11: Design Intentionality

The gap between steps 10 and 12 is deliberate, not an error. The RULES.md source explicitly leaves step 11 undefined, creating a reserved slot for future workflow extensions without requiring renumbering of existing steps. This forward-compatibility mechanism ensures that:

• Existing automation parsing the chain won't break on future updates
• New capabilities can be inserted without disrupting documentation references
• Version detection can identify chain variants by checking step 11's definition status

How to Validate Behavior Chain Compliance

Developers can verify that an AI assistant followed the complete behavior chain by checking for these artifacts:

1. Authorization proof: skills/field-journal/precedent-auth.md timestamp and hash
2. Routing decision: Entry in skills/MASTER-ROUTING.md log or master-route.ps1 output
3. Scope initialization: scope.md with auth.status=granted and populated network_profile
4. Tool verification: Matching entries in tool-index.md for all used tools
5. Evidence chain: Complete timeline in field-journal with workitem-to-finding mappings
6. Completion proof: Checklist validation in final report

Missing any of these artifacts indicates a chain violation, regardless of task success.

Summary

• RULES.md contains the canonical 15-step behavior chain (0-14, with 11 reserved) that serves as the single source of truth for AI assistant execution in zhaoxuya520/reverse-skill
• Authorization (step 0) and scope initialization (step 4) are mandatory gates that must complete before any target action
• The routing system (step 3) implements hierarchical fallback: MASTER-ROUTING.md → master-route.ps1 → skills/routing.md
• Tool availability (steps 7-8) is verified against tool-index.md, with automatic bootstrap via platform-specific scripts
• Evidence tracking (step 9) follows the mandatory Evidence → Finding → Path workflow with consultation fallbacks for hesitation and obedience enforcement
• Step 11 is intentionally omitted for future extension compatibility

Frequently Asked Questions

How does the behavior chain handle ambiguous task routing?

When MASTER-ROUTING.md cannot resolve a definitive primary skill, the chain falls back to skills/routing.md as the full matrix resolver per RULES.md#L51-L53. If routing remains ambiguous after both references, step 6 triggers a web search to propose a new skill definition.

What prevents an AI assistant from skipping authorization or scope initialization?

Step 4's case-init.ps1 enforces that auth.status=granted and network_profile must be set before any ACT operation. Additionally, step 9's consultation with agent-obedience-engineering.md provides an "excuse rebuttal table" specifically designed to counter rationalizations for skipping steps.

Why does step 11 not exist in the behavior chain?

Step 11 is intentionally omitted as a forward-compatibility mechanism. The RULES.md source reserves this number for future workflow extensions, allowing new capabilities to be inserted without renumbering existing steps or breaking automation that parses the chain structure.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}