# How to Execute the Canonical Behavior Chain in the reverse‑skill Repository

> Learn to execute the canonical behavior chain in the reverse-skill repository. Follow the 12-step sequence for authorization, tool verification, and structured reporting before operations.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-09-01

---

**The canonical behavior chain is a 12‑step ordered sequence defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) that enforces authorization, tool verification, and structured reporting before any reverse‑engineering or security operation can run.**

The `zhaoxuya520/reverse-skill` framework uses this chain as its single source of truth. Every agent, script, and workflow must follow it exactly—or risk being blocked by the authorization gate. This guide walks through each step, the files that implement them, and the exact commands to run.

---

## What the Canonical Behavior Chain Controls

The chain exists to solve three problems in security automation:

- **Authorization leakage** – No operation runs without granted status and a valid network profile or approved offline sample.
- **Tool drift** – Every required tool is verified against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) before execution.
- **Documentation gaps** – Formal reports, diagrams, and journal entries are mandatory deliverables, not afterthoughts.

The order matters. Later steps depend on gates established by earlier ones.

---

## The 12 Steps of the Canonical Behavior Chain

Each step maps to a concrete action in the repository. Deviations are rejected by `case‑guard` or the router itself.

### 1. Identify the Task

A hint containing a security or reverse‑engineering keyword triggers routing. The hint format is free, but must be passed to the master router.

### 2. Detect the Package Root

The directory containing [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) is treated as the repository root. All relative paths resolve from here.

### 3. Run the Platform‑Native Master Router

The master router selects the **PRIMARY** skill from [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json).

| Platform | Script |
|----------|--------|
| Windows | `skills/scripts/master-route.ps1` |
| Linux / macOS / Kali | [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) |

```bash

# Example: route an APK reverse‑engineering task

bash skills/scripts/master-route.sh --hint "apk reverse"

```

The router outputs the selected skill directory and immediately halts—the operator must act on that output.

### 4. Initialize the Case (`case-init`)

Creates [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and enforces the authorization gate. The `auth.status=granted` field and a valid `network_profile` (or authorized offline sample) must both be present.

```bash

# Offline sample initialization

bash skills/scripts/case-init.sh \
  --hint "offline apk" \
  --case-name "my-sample" \
  --preset offline-sample \
  --sample ./app.apk

```

`case-guard` blocks any **ACT** if this gate is unsatisfied.

### 5. Open the PRIMARY [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)

The skill file identified in step 3 contains the concrete workflow. The operator must act upon it immediately—no fallback, no delay.

### 6. Handle Route Mismatches

If no route matches the hint, propose a new skill and amend [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). This file is the **single source of truth** for routing; edits belong nowhere else.

### 7. Read [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)

Verifies that every required tool is present. [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) is the registry consulted here.

### 8. Bootstrap Missing Tools

Platform‑specific bootstrap scripts install dependencies and refresh the index.

| Platform | Script |
|----------|--------|
| Windows | `skills/scripts/bootstrap-reverse.ps1` |
| Linux / macOS / Kali | [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) |

After installation:

```bash
bash skills/scripts/refresh-tool-index.sh

```

### 9. Execute the Skill Workflow

Follow the timeline and workitems in the skill's `ops/` directory. Gather evidence and produce findings according to [`ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/evidence-finding-path.md) and [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) templates.

### 10. Report Progress Continuously

Silence is prohibited. Log every transition.

### 11. Complete the Checklist

Generate mandatory artifacts defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) section "Completion Checklist":

- Formal report
- Diagram
- Journal entry
- Updated references

The `docs-generator` skill automates this:

```bash
python3 skills/docs-generator/generate_report.py work/my-sample/report

```

### 12. Output Final Results

Deliver completed artifacts to the user.

---

## Critical Gate: Authorization Enforcement

The `case-guard` script enforces the hard stop between steps 4 and 9. In [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh), the gate checks `auth.status` and `network_profile` validity before permitting any **ACT** against a target.

```bash

# Verify gate before acting

bash skills/scripts/case-guard.sh --case-root work/my-sample

```

If this returns non‑zero, the chain halts. No workaround exists—[`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) must be corrected.

---

## Key Files Reference

| File | Role in Chain |
|------|---------------|
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Defines all 12 steps and the completion checklist |
| [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | Router contract and platform entry points |
| [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Editable routing table; step 3 and step 6 touch this |
| [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) | Implements step 3 |
| [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) | Implements step 4 |
| [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh) | Enforces authorization gate |
| [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | Tool registry for step 7 |
| [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) | Step 8 dependency installer |
| [`skills/docs-generator/generate_report.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/generate_report.py) | Step 11 report generator |
| [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) | Template for step 9 scope definition |
| [`ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/evidence-finding-path.md) | Template for step 9 evidence handling |

---

## Summary

- The **canonical behavior chain** is 12 ordered steps from task identification to final delivery, defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).
- **Authorization is enforced** by `case-guard`; no tool execution proceeds without `auth.status=granted`.
- **Routing is centralized** in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json); platform scripts in `skills/scripts/` handle the transition.
- **Tool verification and bootstrapping** are mandatory steps, not optional setup.
- **Documentation is a deliverable**, produced by `skills/docs-generator/` according to `ops/` templates.

---

## Frequently Asked Questions

### What happens if I skip step 4 (case-init)?

The `case-guard` script in [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh) will block execution. It checks for [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), valid `auth.status`, and a proper network profile or offline sample—any missing element returns a non‑zero exit code that downstream scripts respect.

### Can I edit routing rules anywhere besides [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json)?

No. [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) is the single source of truth. The master router ([`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) or `master-route.ps1`) reads only this file. Proposed new skills must be added here, as specified in step 6.

### How do I run the chain on Windows instead of Linux?

Use the PowerShell equivalents: `skills/scripts/master-route.ps1` for routing, `skills/scripts/bootstrap-reverse.ps1` for tool bootstrapping, and `skills/scripts/case-init.ps1` for case initialization. The chain steps remain identical; only the script extensions change.

### Where is the completion checklist defined?

Section "Completion Checklist" in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) lists the four mandatory artifacts: formal report, diagram, journal entry, and reference updates. The `skills/docs-generator/` directory contains [`generate_report.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/generate_report.py) and related tools to automate this step.