/analyze

name: analyze
description: Reverse engineer a codebase into the output behavioral specs with provenance
arguments:
  - name: path
    description: Path to the target (source code, bundle, binary, or installed software)
    required: true
  - name: --exclude
    description: >
      Comma-separated list of source types to exclude from analysis.
      Valid types: source, docs, sdk, community, runtime, binary, git-history, tests, visual, contracts.
      By default, all available sources are analyzed.
    required: false
    default: (none)
  - name: --container-runtime
    description: Container runtime to use for runtime observation mode
    required: false
    default: auto-detect (docker, then podman)
    values: [docker, podman]
  - name: --workspace
    description: Path to the workspace directory. Created if it does not exist.
    required: false
    default: ./analysis-workspace
allowed-tools:
  - Read
  - Glob
  - Grep
  - Write
  - Task
  - Bash
  - Agent
  - TodoWrite
  - LSP

/analyze - Reverse Engineering

Target: $ARGUMENTS

THE APPROACH

**Analyze deeply. Output behaviorally.**

• **Analysis:** Tear apart the target through every available intelligence source. Trace every code path. Observe every runtime behavior. Read every public document.
• **Output:** Write specs using behavioral language. No source identifiers. Every claim carries provenance.

You READ `Ab2()` and trace what it does. You WRITE "entry point parses arguments and routes to mode handler."

EXHAUSTIVE READING (NON-NEGOTIABLE)

**Every line of code must be read. Every routine must be identified.**

• Do NOT skim code. Do NOT skip "boring" sections.
• Grep patterns are for INDEXING - they are NOT a substitute for reading.
• If you haven't read a line, you don't know what it does.
• If you haven't traced a code path, you can't document its behavior.

Agents MUST use the Read tool on every source file. Head/tail samples are not enough.

CLI INTERFACE

/analyze path                              # Discover and consume everything available
/analyze path --exclude source             # Black-box analysis (skip source code)
/analyze path --exclude git-history,tests  # Skip git mining and test suite analysis

EXIT CODES

| Code | Meaning | |------|---------| | 0 | Success. Analysis completed, all gates passed. | | 1 | Failure. Gate failure, workspace conflict, container unavailable, etc. | | 2 | Invalid arguments. Bad mode name, missing path, etc. |

OUTPUT STRUCTURE

workspace/
├── .git/                    # Git repository (initialized by /analyze)
├── .gitignore               # Exclusions
├── workspace.json           # Workspace metadata
├── inventory.md             # Intelligence source inventory (from discovery)
│
├── public/                  # PUBLIC: From public sources only
│   ├── docs/                # Official documentation findings
│   ├── standards/           # RFC/standard mappings
│   ├── ecosystem/           # SDK analysis, test mining
│   ├── community/           # Tutorials, reviews, forums, issues
│   └── contracts/           # Machine-readable contract definitions
│
├── raw/                 # RAW: Source-derived analysis artifacts
│   ├── source/              # Source code analysis artifacts
│   │   ├── chunks/          # Bundle decomposition output
│   │   ├── analysis/        # Per-chunk analysis files
│   │   ├── functions/       # Extracted function analyses
│   │   ├── manifests/       # Bundle manifests
│   │   ├── exploration/     # Targeted-extractor output per focus area
│   │   └── decompiled/      # Decompiled binary/bytecode output
│   │
│   ├── runtime/             # Runtime observation artifacts
│   │   ├── cli/             # CLI interaction transcripts
│   │   ├── web/             # Web UI screenshots, state maps
│   │   ├── behaviors/       # Observed behaviors
│   │   ├── ux/              # UX capture (output formats, errors, prompts)
│   │   └── visual/          # Visual exploration output
│   │       ├── screenshots/ # Key screen captures
│   │       └── flows/       # UI flow sequences
│   │
│   ├── binary/              # Binary analysis artifacts
│   │   ├── survey/          # Initial triage output
│   │   └── analysis/        # Deep analysis output
│   │
│   ├── project-history/     # Git archaeology findings
│   │
│   ├── test-evidence/       # Test suite analysis output
│   │
│   ├── synthesis/           # Layer 2 synthesized findings
│   │   ├── features/        # Aggregated feature inventory
│   │   ├── architecture/    # Synthesized architecture
│   │   ├── api/             # Synthesized API surface
│   │   └── module-map.md    # All modules identified
│   │
│   ├── specs/               # Layer 3+4 raw specs (pre-sanitization)
│   │   ├── modules/         # Per-module behavioral specs (analysis organization)
│   │   ├── journeys/        # End-to-end user flows
│   │   ├── contracts/       # External interfaces
│   │   ├── protocols/       # Wire protocols
│   │   ├── ui/              # User-visible text
│   │   ├── tests/           # Test specifications
│   │   ├── test-vectors/    # Concrete input/output pairs
│   │   └── validation/      # Acceptance criteria
│   │
│   └── audit/               # Detailed per-finding audit reports from Layers 6 and 7
│
├── output/                   # Sanitized specs for the implementer
│   ├── specs/
│   │   ├── domains/         # Behavioral specs merged by domain (NOT original modules)
│   │   ├── journeys/        # Sanitized user journey specs
│   │   └── contracts/       # External contracts + behavioral integration requirements
│   ├── test-vectors/        # Output test vectors
│   ├── validation/          # Output acceptance criteria
│   ├── audit/               # Top-level PASS/FAIL summaries of Layers 6 and 7
│   └── implementation/      # Implementation output
│
└── provenance/              # AUDIT: Trail and citations
    ├── sessions/            # Subagent JSONL copies
    └── audit-log.md