# Purpose of RULES.md in reverse-skill: The Authority Behind Secure Reverse Engineering Workflows

> Discover the purpose of RULES.md in reverse-skill. This document enforces secure reverse engineering workflows by orchestrating authorization, tool management, and quality control through a mandatory 14-step agent behavior chain.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-23

---

**[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) serves as the single source of truth that orchestrates routing, authorization, tool management, and quality control for the reverse-skill framework, enforcing a mandatory 14-step canonical behavior chain that every AI agent must follow.**

In the `zhaoxuya520/reverse-skill` repository, [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) functions as the central governance document that defines every mandatory step an AI agent or client must execute before, during, and after any security or reverse-engineering task. Located at the repository root, this file establishes deterministic workflows that prevent arbitrary execution and ensure consistent, secure operations across all downstream scripts and documentation.

## Routing Authority and Hot-Path Execution

[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) acts as the **gatekeeper for routing decisions** within the reverse-skill ecosystem. According to lines 3-19 of the source file, the document declares that [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) is the sole authoritative routing table, while other files like [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) remain strictly advisory.

After an agent reads [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), it must immediately execute the **hot-path** sequence rather than merely acknowledging the rules:

1. **master-route** (`skills/scripts/master-route.ps1` or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh))
2. **case-init** (`skills/scripts/case-init.ps1`)
3. **primary** [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)

This forced progression ensures that no agent operates outside the defined behavior chain, preventing ad-hoc tool invocation or skipped validation steps.

## Authorization Gates and Scope Enforcement

The file embeds a critical **authentication gate** that blocks all activity until proper authorization is confirmed. As specified in lines 20-24 and 48-53, the `case-init` script must generate a [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file containing `auth.status=granted` (or an authorized offline sample) before any ACT step can execute.

**Critical constraint:** The rule explicitly states that `-Force/--force` flags **never bypass** this authorization gate. This hard-coded restriction prevents social engineering attacks where an agent might attempt to override security protocols through command-line arguments.

## Tool Index Coordination and Bootstrapping

[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) mandates strict **tool availability verification** before task execution. Lines 30-38 require every agent to:

- Read [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) for concrete tool paths and installation states
- Execute platform-native bootstrap scripts (such as [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh)) to install missing dependencies
- Run [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) to update the tool index after installation

This ensures that reverse engineering tools like `jadx` are available and correctly referenced before the agent attempts to analyze binaries or APKs.

## The Canonical 14-Step Behavior Chain

Section *Canonical Behavior Chain* (lines 51-66) defines the exact **14-step process** that all reverse-skill operations must follow. This chain serves as the reference standard for:

- Verification scripts like `skills/scripts/verify-routing-coherence.ps1`
- CI/CD pipeline compliance checks
- Documentation consistency across the repository

Any deviation from this sequence triggers validation failures in automated testing, ensuring that manual and automated executions maintain identical security postures.

## Excuse Rebuttal and Self-Audit Mechanisms

To prevent "lazy" execution or step skipping, [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) contains a **baked-in excuse-rebuttal table** (lines 12-18) that forces agents to reject common shortcuts. Before declaring task completion, agents must perform a **self-audit against the embedded checklist** (lines 70-81), verifying that every mandatory item has been ticked off.

This mechanism transforms [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) from passive documentation into an active enforcement layer that maintains workflow integrity.

## Implementing RULES.md: Execution Examples

The following commands demonstrate how agents interact with the behavior chain defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md):

Execute the hot-path master route on Windows:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "<your-task>"

```

Execute the hot-path on Linux/macOS/Kali:

```bash
bash skills/scripts/master-route.sh --hint "<your-task>"

```

Run the mandatory scope authorization gate:

```powershell
powershell -File skills/scripts/case-init.ps1

```

Bootstrap missing tools as required by the rules:

```bash
bash skills/scripts/bootstrap-reverse.sh jadx
bash skills/scripts/refresh-tool-index.sh

```

Verify repository compliance with the canonical chain:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1

```

## Key Files Referenced by RULES.md

The following files implement the architecture mandated by [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md):

- **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** – The sole authoritative routing table; all navigation logic derives from this JSON file.
- **`skills/scripts/master-route.ps1`** – Entry script that initiates the hot-path execution sequence.
- **`skills/scripts/case-init.ps1`** – Implements the authentication gate requiring [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) with granted status.
- **[`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)** – Concrete registry of available reverse engineering tools and their system paths.
- **[`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md)** – Primary skill document accessed only after passing the scope gate.
- **`skills/scripts/verify-routing-coherence.ps1`** – CI verification script that validates compliance with the 14-step canonical chain.

## Summary

- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)** is the single source of truth for the entire reverse-skill behavior chain, located at the repository root.
- The file mandates **hot-path execution** through `master-route` → `case-init` → [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) without deviation.
- **Authorization gates** require `auth.status=granted` in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) before any ACT steps, with `--force` explicitly blocked from bypass.
- **Tool coordination** requires reading [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) and bootstrapping missing tools via native scripts.
- A **14-step canonical behavior chain** (lines 51-66) provides the reference standard for all operations and verification scripts.
- **Self-audit checklists** and excuse-rebuttal tables prevent step skipping and ensure quality control.

## Frequently Asked Questions

### What happens if an agent skips the authentication gate defined in RULES.md?

The agent cannot execute any ACT steps. According to lines 20-24 of [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), the `case-init` script must produce a [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file with `auth.status=granted` before proceeding. Without this authorization token, the workflow halts at the scope enforcement layer, preventing unauthorized access to reverse engineering tools or target binaries.

### Can the `--force` flag override RULES.md authorization requirements?

No. Lines 48-53 explicitly state that `-Force/--force` never bypasses the authentication gate. This is a hard-coded rule in the behavior chain designed to prevent privilege escalation through command-line arguments, ensuring that even forced executions require proper [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) authorization.

### How does RULES.md ensure tool availability before task execution?

Lines 30-38 mandate that agents read [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) to verify tool paths and states. If tools are missing, the agent must execute bootstrap scripts like [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) to install dependencies and then run [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) to update the index. This verification occurs before any analysis tasks begin.

### Where is the canonical 14-step behavior chain defined in RULES.md?

The canonical behavior chain is defined in lines 51-66 under the section *Canonical Behavior Chain*. This sequence provides the exact execution order that all agents must follow, and it serves as the reference standard for `skills/scripts/verify-routing-coherence.ps1` to ensure repository-wide consistency across scripts, tests, and documentation.