# Canonical Behavior Chain Followed by AI Agents Using reverse-skill: A 12-Step Technical Deep-Dive

> Explore the canonical behavior chain in reverse-skill. This 12-step AI workflow deterministically routes security tasks through keyword detection, skill execution, and knowledge updates.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-31

---

**The canonical behavior chain in reverse-skill is a deterministic, self-evolving 12-step workflow that routes security tasks through keyword detection, skill execution, and persistent knowledge updates.**

The `reverse-skill` framework by zhaoxuya520 defines how AI-driven agents handle reverse-engineering and security requests. Unlike ad-hoc prompting, this system enforces a structured pipeline that learns from every execution. This article breaks down the complete canonical behavior chain, referencing actual implementation files from the repository.

---

## Understanding the Canonical Behavior Chain

The canonical behavior chain serves as the backbone of every agent interaction in `reverse-skill`. When a user submits a security task—whether Active Directory enumeration, binary analysis, or exploit development—the agent follows the same deterministic sequence documented in [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md).

The chain is designed to be **self-evolving**: each completed task enriches the `field-journal`, which then influences future routing decisions and tool-availability checks.

---

## Step 1: User Prompt Submission

Every interaction begins with the user submitting a security or reverse-engineering task. The system accepts natural language prompts describing the objective, such as "enumerate AD domain" or "analyze this malware sample".

---

## Step 2: Keyword Detection and Routing Trigger

The system inspects the prompt against predefined keywords stored in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). 

- **Match found** → Routing is triggered, proceeding to skill selection.
- **No match** → Request is handled as normal conversation without invoking the specialized pipeline.

This gate ensures the specialized infrastructure only activates for relevant security workloads.

---

## Step 3: Read Routing Rules

When keywords match, the agent loads two critical files:

- [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) — Defines the specific skill's capabilities and entry points
- [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) or [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) — The central routing matrix that maps requests to skill modules

The routing matrix at [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) provides machine-readable decision logic for skill selection.

---

## Step 4: Check Field-Journal for Prior Experience

Before executing new work, the agent queries the `field-journal` directory. This persistent knowledge base contains:

- Past evidence graphs from similar tasks
- Lessons learned from previous executions
- Generated artifacts and tool outputs

This step prevents duplicated effort and enables evidence reuse across sessions.

---

## Step 5: Read Tool Index

The agent obtains the current status of required tools from [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). This file tracks:

- Installed binaries and their versions
- Availability status for platform-specific utilities
- Dependency chains for complex toolsets

---

## Step 6: Tool Availability Gate

The canonical behavior chain branches based on tool status:

- **Missing Tools** → Invoke `bootstrap-reverse.ps1` (Windows) or [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) (Linux/macOS) to install needed dependencies
- **All Tools Present** → Proceed directly to skill execution

The bootstrap scripts are located at `skills/scripts/` and handle automated environment preparation.

---

## Step 7: Skill Execution

The selected skill module runs its internal workflow—enumeration, exploitation, static analysis, or other domain-specific operations. Each skill follows its own defined in `skills/<skill-name>/SKILL.md`.

Execution continues until the skill reports **Task Done**, at which point the workflow proceeds to validation.

---

## Step 8: Case Review and Evidence Validation

The `case-review` component, documented at [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md), audits the complete evidence graph. This validation step ensures:

- All claims are supported by collected data
- Tool outputs are properly correlated
- No critical analysis steps were skipped

---

## Step 9: Report Generation

The `docs-generator` module produces structured deliverables. Optionally, `diagram-generator` creates visual representations of:

- Attack chains
- Data flow graphs
- Evidence timelines

Reports combine narrative explanation with machine-parseable structured data.

---

## Step 10: Journal Write-Back

New findings, lessons learned, and generated artifacts are appended to the `field-journal`. This write-back operation is what makes the system **self-evolving**—knowledge persists across invocations.

---

## Step 11: Update Indexes

The canonical behavior chain refreshes three critical indexes:

- Routing matrix ([`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json))
- Tool index ([`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md))
- Bootstrap manifest

These updates reflect newly acquired tools, improved routing heuristics, and refined skill mappings.

---

## Step 12: Final Output Delivery

The agent returns completed reports and artifacts to the user. The output format depends on the original request and may include:

- Structured markdown reports
- JSON evidence bundles
- Generated diagrams
- Raw tool output archives

---

## Invoking the Canonical Behavior Chain

Trigger the complete 12-step workflow using the master routing scripts:

```bash

# Linux / macOS

bash skills/scripts/master-route.sh --hint "enumerate AD domain"

```

```powershell

# Windows

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "kerberoasting"

```

Both commands execute the full canonical behavior chain: routing rule resolution, tool verification, dependency bootstrapping, skill execution, and report generation.

---

## Self-Evolution Through Iteration

The canonical behavior chain supports **re-execution loops**. Steps 4 through 7 may repeat until the task is fully satisfied. Each iteration:

- Reads updated journal entries from previous passes
- Discovers newly available tools
- Applies refined routing decisions

This design enables progressive task decomposition—complex objectives automatically break into manageable sub-tasks that accumulate shared context.

---

## Summary

- The **canonical behavior chain** in `reverse-skill` is a deterministic 12-step workflow governing all AI agent security operations
- **Self-evolution** occurs through `field-journal` write-backs that persist knowledge across sessions
- **Tool availability gating** ensures environments self-bootstrap missing dependencies via `bootstrap-reverse` scripts
- **Evidence validation** via `case-review` guarantees analytical rigor before report generation
- **Master routing scripts** ([`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh)/`master-route.ps1`) provide the primary entry point for invoking the complete chain

---

## Frequently Asked Questions

### What triggers the canonical behavior chain versus normal conversation?

Keyword detection against [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) determines routing. Security-specific terms activate the 12-step workflow; general queries receive standard conversational responses without invoking the specialized infrastructure.

### How does reverse-skill prevent duplicated analytical work?

The **Check Field-Journal** step (step 4) queries prior executions before starting new work. Existing evidence graphs and lessons learned are reused when task similarity exceeds configured thresholds.

### What happens when required tools are missing?

The **Tool Availability Gate** (step 6) automatically invokes `bootstrap-reverse.ps1` or [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) to install missing dependencies. The agent then proceeds with execution once verification passes.

### Can the canonical behavior chain handle multi-stage security assessments?

Yes—steps 4 through 7 **loop until task satisfaction**. Complex assessments decompose automatically, with each iteration reading updated journal entries and applying refined routing from accumulated context.