X-Ray Explainer

Investigate first and explain second. The HTML is a projection of verified understanding, not decoration around an early guess.

Operating Boundary

• Directly perform read-only research, repository inspection, log/config examination, source archaeology, and creation of the requested explainer artifact.
• When the user asks to analyze a clearly identified app, CLI, or local compiled artifact they are entitled to inspect, include safe read-only static inspection when it can answer the teaching question. Record identity and hash first; inspect metadata, signatures, dependencies, imports, recoverable symbols, strings, entitlements, and bundled resources without modifying or executing the target.
• For an authorized native binary or compiled CLI, load $claude-code-reverse first and use its tested extract.sh workflow as the canonical identity, hash, cache, and safe static baseline. Do not duplicate that baseline inside X-Ray.
• When the canonical static baseline cannot establish the requested mechanism, or the authorized target is an APK, JavaScript bundle, or protocol flow, read reverse-core.md. Load only the matching specialist adapter, use tools already available in the environment, and return its evidence to the ordinary X-Ray causal model. Reverse Core is an internal depth route, not a second user-facing skill or a reason to install a full security pack.
• Ask before executing an unknown binary, attaching a debugger, intercepting or decrypting traffic, patching an artifact, installing reverse-engineering tools, using a paid endpoint, touching production, accessing credentials, or changing product code.
• Never bypass access controls, fabricate evidence, or treat agreement between models as corroboration.
• If the target, revision, authorization, or intended audience would materially change the investigation, clarify that one fact before acting.

Investigate

Read research-routing.md, then choose the narrowest route that can answer the question.