How to Execute the Canonical Behavior Chain in the reverse‑skill Repository

The canonical behavior chain is a 12‑step ordered sequence defined in RULES.md that enforces authorization, tool verification, and structured reporting before any reverse‑engineering or security operation can run.

The zhaoxuya520/reverse-skill framework uses this chain as its single source of truth. Every agent, script, and workflow must follow it exactly—or risk being blocked by the authorization gate. This guide walks through each step, the files that implement them, and the exact commands to run.

---

What the Canonical Behavior Chain Controls

The chain exists to solve three problems in security automation:

• Authorization leakage – No operation runs without granted status and a valid network profile or approved offline sample.
• Tool drift – Every required tool is verified against skills/tool-index.md before execution.
• Documentation gaps – Formal reports, diagrams, and journal entries are mandatory deliverables, not afterthoughts.

The order matters. Later steps depend on gates established by earlier ones.

---

The 12 Steps of the Canonical Behavior Chain

Each step maps to a concrete action in the repository. Deviations are rejected by case‑guard or the router itself.

1. Identify the Task

A hint containing a security or reverse‑engineering keyword triggers routing. The hint format is free, but must be passed to the master router.

2. Detect the Package Root

The directory containing RULES.md is treated as the repository root. All relative paths resolve from here.

3. Run the Platform‑Native Master Router

The master router selects the PRIMARY skill from skills/config/routing.json.

Platform	Script
Windows	skills/scripts/master-route.ps1
Linux / macOS / Kali	skills/scripts/master-route.sh

# Example: route an APK reverse‑engineering task

bash skills/scripts/master-route.sh --hint "apk reverse"

The router outputs the selected skill directory and immediately halts—the operator must act on that output.

4. Initialize the Case (case-init)

Creates scope.md and enforces the authorization gate. The auth.status=granted field and a valid network_profile (or authorized offline sample) must both be present.

# Offline sample initialization

bash skills/scripts/case-init.sh \
  --hint "offline apk" \
  --case-name "my-sample" \
  --preset offline-sample \
  --sample ./app.apk

case-guard blocks any ACT if this gate is unsatisfied.

5. Open the PRIMARY SKILL.md

The skill file identified in step 3 contains the concrete workflow. The operator must act upon it immediately—no fallback, no delay.

6. Handle Route Mismatches

If no route matches the hint, propose a new skill and amend routing.json. This file is the single source of truth for routing; edits belong nowhere else.

7. Read tool-index.md

Verifies that every required tool is present. skills/tool-index.md is the registry consulted here.

8. Bootstrap Missing Tools

Platform‑specific bootstrap scripts install dependencies and refresh the index.

Platform	Script
Windows	skills/scripts/bootstrap-reverse.ps1
Linux / macOS / Kali	skills/scripts/bootstrap-reverse.sh

After installation:

bash skills/scripts/refresh-tool-index.sh

9. Execute the Skill Workflow

Follow the timeline and workitems in the skill's ops/ directory. Gather evidence and produce findings according to ops/evidence-finding-path.md and ops/scope-contract.md templates.

10. Report Progress Continuously

Silence is prohibited. Log every transition.

11. Complete the Checklist

Generate mandatory artifacts defined in RULES.md section "Completion Checklist":

• Formal report
• Diagram
• Journal entry
• Updated references

The docs-generator skill automates this:

python3 skills/docs-generator/generate_report.py work/my-sample/report

12. Output Final Results

Deliver completed artifacts to the user.

---

Critical Gate: Authorization Enforcement

The case-guard script enforces the hard stop between steps 4 and 9. In skills/scripts/case-guard.sh, the gate checks auth.status and network_profile validity before permitting any ACT against a target.

# Verify gate before acting

bash skills/scripts/case-guard.sh --case-root work/my-sample

If this returns non‑zero, the chain halts. No workaround exists—scope.md must be corrected.

---

Key Files Reference

File	Role in Chain
RULES.md	Defines all 12 steps and the completion checklist
skills/MASTER-ROUTING.md	Router contract and platform entry points
skills/config/routing.json	Editable routing table; step 3 and step 6 touch this
skills/scripts/master-route.sh	Implements step 3
skills/scripts/case-init.sh	Implements step 4
skills/scripts/case-guard.sh	Enforces authorization gate
skills/tool-index.md	Tool registry for step 7
skills/scripts/bootstrap-reverse.sh	Step 8 dependency installer
skills/docs-generator/generate_report.py	Step 11 report generator
ops/scope-contract.md	Template for step 9 scope definition
ops/evidence-finding-path.md	Template for step 9 evidence handling

---

Summary

• The canonical behavior chain is 12 ordered steps from task identification to final delivery, defined in RULES.md.
• Authorization is enforced by case-guard; no tool execution proceeds without auth.status=granted.
• Routing is centralized in skills/config/routing.json; platform scripts in skills/scripts/ handle the transition.
• Tool verification and bootstrapping are mandatory steps, not optional setup.
• Documentation is a deliverable, produced by skills/docs-generator/ according to ops/ templates.

---

Frequently Asked Questions

What happens if I skip step 4 (case-init)?

The case-guard script in skills/scripts/case-guard.sh will block execution. It checks for scope.md, valid auth.status, and a proper network profile or offline sample—any missing element returns a non‑zero exit code that downstream scripts respect.

Can I edit routing rules anywhere besides routing.json?

No. skills/config/routing.json is the single source of truth. The master router (master-route.sh or master-route.ps1) reads only this file. Proposed new skills must be added here, as specified in step 6.

How do I run the chain on Windows instead of Linux?

Use the PowerShell equivalents: skills/scripts/master-route.ps1 for routing, skills/scripts/bootstrap-reverse.ps1 for tool bootstrapping, and skills/scripts/case-init.ps1 for case initialization. The chain steps remain identical; only the script extensions change.

Where is the completion checklist defined?

Section "Completion Checklist" in RULES.md lists the four mandatory artifacts: formal report, diagram, journal entry, and reference updates. The skills/docs-generator/ directory contains generate_report.py and related tools to automate this step.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}