It is becoming f*cking dangerous: the NSA's own reverse-engineering tool now plugs straight into Claude Code - Ghidra has 94k stars, and GhidraMCP lets your agent read a compiled program instead of guessing what it does

Install Ghidra 12.1.4 from ghidra-sre,org (free, released he GhidraMCP release and add it in File -> Install Extensions

Restart Ghidra and switch on GhidraMCPPlugin in File -> Configure -> Developer

Connect it: claude mcp add ghidra -- uvx --from git+github.com/LaurieWired/Gh… ghidra-mcp

Open a binary you're allowed to analyze and let Ghidra run its analysis

Ask Claude what a function does: it decompiles it, renames the variables and explains it in plain English
Ask for the map: every function, import, string and cross-reference, and where the interesting code lives
The decompiling runs in Ghidra on your machine, Claude just drives it

Malware samples, old firmware, your own builds: your agent reads the program itself, not the docs about it

Find the repo in the reply below

STOP WASTING HOURS TRYING TO FIGURE OUT HOW TO LEARN REVERSE ENGINEERING

I put together one practical roadmap with videos, GitHub repos, guides, books, research papers, and hands-on practice

VIDEOS:

Self-Learning Reverse Engineering - youtube.com/watch?v=gPsYkV…
Every Level of lained - youtube.com/watch?v=8vk5z9…
Ghidra Quickstart, Solving a Crackme - youtube.com/watch?v=fTGTnr…
Reversing WannaCry, Finding the Killswitch - youtube.com/watch?v=Sv8yu1…
Firmware Analysis & IoT Reverse Engineering - youtube.com/watch?v=zs86OY…
ghidraMCP, AI Can Reverse Malware - youtube.com/watch?v=u2vQap…
AI Reverse Engineering with MCP for IDA and Ghidra - youtube.com/watch?v=iFxNuk…
Automating Hardware Hacking with Claude Code - youtube.com/watch?v=Z5uBrF…

GITHUB REPOS:

Ghidra (NSA) - github.com/NationalSecuri…
REA, Reverse Engineer Anything - github.com/morluto/rea
GhidraMCP - github.com/LaurieWired/Gh…
IDA Pro MCP - github.com/mrexodia/ida-p…
Free Reverse Engineering Tutorial - github.com/mytechnotalent…
x64dbg - github.com/x64dbg/x64dbg
Frida - github.com/frida/frida
JADX, Android Decompiler - github.com/skylot/jadx
ImHex - github.com/WerWolv/ImHex
radare2 - github.com/radareorg/rada…
capa by Mandiant FLARE - github.com/mandiant/capa
Awesome Reverse Engineering - github.com/wtsxDev/revers…

GUIDES:

Android App Reverse Engineering 101 - ragingrock.com/AndroidAppRE/
RE101 Workshop by Malware Unicorn - malwareunicorn.org/workshops/re10…
OWASP Mobile App Security Testing Guide - mas.owasp.org/MASTG/
Ghidra Cheat Sheet - ghidra-sre.org/CheatSheet.html
Nightmare, Binary Exploitation Through CTFs - guyinatuxedo.github.io

BOOKS:

Reverse Engineering for Beginners (free) - beginners.re
Practical Malware Analysis - nostarch.com/malware
Practical Binary Analysis - nostarch.com/binaryanalysis
The Hardware Hacking Handbook - nostarch.com/hardwarehacking
Hacking: The Art of Exploitation - nostarch.com/hacking2.htm

RESEARCH PAPERS:

SoK: The Art of War, Offensive Techniques in Binary Analysis - sites.cs.ucsb.edu/~vigna/publica…
No More Gotos (NDSS 2015) - ndss-symposium.org/ndss2015/ndss-…
LLM4Decompile - arxiv.org/abs/2403.05286
LLMs for Code Analysis: Do They Really Do Their Job? - arxiv.org/abs/2310.12357

PRACTICE:

pwncollege - pwn.college
OpenSecurityTraining2 - ost2.fyi
crackmesone - crackmes.one
Microcorruption - microcorruption.com
picoCTF - picoctf.org
Flare-On Challenge - flare-on.com

Repost so someone else can find this roadmap, and follow @ArchiveExplorer for more on reverse engineering with AI

Claude Code can now reverse-engineer your robot vacuum...

1 prompt + 10 min = every server it talks to, what each one gets, and a switch to cut off the ones you never agreed to

here's full guide step by step:

step 1 → paste the prompt below into Claude Code with a photo of cuum

step 2 → connect REA once: npx rea-agents setup - it takes apart the vacuum's phone app and lists every server it calls

step 3 → Claude gives you one command to save your router password to your keychain - the password never touches the chat

step 4 → run one cleaning cycle. Claude matches what the vacuum actually called against the list from the app

step 5 → you get three piles: needed to clean, needed for the app, not needed at all. The floor map, room names and your Wi-Fi list show up in whichever pile they really go to

step 6 → for every server in the last pile, one rule to block it and one to undo it. You say yes, Claude applies it

the result: you finally know what a device that drives around your bedroom tells the internet, and it keeps cleaning just the same

p.s: works with most Wi-Fi vacuums. If yours uses a different app, tell Claude Code and it'll find another way in

Try it tonight, before the next cleaning run. Then read the post below on how REA takes any app apart:

"Find out what my robot vacuum sends home:
1. From the photo, identify the model and its phone app. Use REA to take the app apart and list every server it talks to and what each request carries.
2. Give me one command to save my router password to the keychain. Never ask for it in chat.
3. Watch the vacuum on my router during one cleaning run and match what it calls against the list from step 1.
4. Sort everything into: needed to clean / needed for the app / not needed. For every 'not needed' server, give me one rule to block it and one to undo it.
Change nothing until I say yes."

Claude Code can now reverse-engineer your robot vacuum...

1 prompt + 10 min = every server it talks to, what each one gets, and a switch to cut off the ones you never agreed to

here's full guide step by step:

step 1 → paste the prompt below into Claude Code with a photo of cuum

step 2 → connect REA once: npx rea-agents setup - it takes apart the vacuum's phone app and lists every server it calls

step 3 → Claude gives you one command to save your router password to your keychain - the password never touches the chat

step 4 → run one cleaning cycle. Claude matches what the vacuum actually called against the list from the app

step 5 → you get three piles: needed to clean, needed for the app, not needed at all. The floor map, room names and your Wi-Fi list show up in whichever pile they really go to

step 6 → for every server in the last pile, one rule to block it and one to undo it. You say yes, Claude applies it

the result: you finally know what a device that drives around your bedroom tells the internet, and it keeps cleaning just the same

p.s: works with most Wi-Fi vacuums. If yours uses a different app, tell Claude Code and it'll find another way in

Try it tonight, before the next cleaning run. Then read the post below on how REA takes any app apart:

"Find out what my robot vacuum sends home:
1. From the photo, identify the model and its phone app. Use REA to take the app apart and list every server it talks to and what each request carries.
2. Give me one command to save my router password to the keychain. Never ask for it in chat.
3. Watch the vacuum on my router during one cleaning run and match what it calls against the list from step 1.
4. Sort everything into: needed to clean / needed for the app / not needed. For every 'not needed' server, give me one rule to block it and one to undo it.
Change nothing until I say yes."

this is f*cking insane, a Grok bot ordered itself a body and the parts are showing up at its owner's apartment

Evan Bacon (frontend lead for Grok at SpaceXSI) gave his bot $1,000 and one assignment: build yourself a body

it modeled the parts in CAD, ran a sim, ordered the nd the 3D prints on Craftcloud, and had all of it mailed to his place

he says he wasn't involved in the CAD. he also owned zero tools, so calipers, hex keys and a multimeter showed up too

here's where the money went:

→ Amazon: servos, an ESP32 board, a servo driver, wiring and tools – $126.96, two shipments
→ Craftcloud: the printed body parts from 3D Pros – $90.19
→ total: $217.15 of the $1,000

a robot can look perfect in a sim and still fall over on the floor

the bot flagged it itself before the build: "the built robot will weigh about twice what the sim assumed, so the first hop test may show you need stronger servos"

every purchase came back with:

> a one-time card he approved
> the order number
> the total with tax
> a check that the order went through before it touched it again

two orders, $782.85 still in the budget, and the next step is the first hop test

tag your bot and ask:

"Build yourself a small robot body on a $___ budget

1. Model the parts in CAD and run a sim before you buy anything. Flag what the sim can't confirm

2. Split the order: electronics and tools from one store, 3D prints from a print service. Show me every line item

3. Pay only with a one-time card I approve, and check the order went through before you retry

4. Tell me what will break first when we build it"

start with one leg and one servo before you order the whole body

he's posting everything he learns on X, so your bot can keep an eye out for updates

this is f*cking insane, a Grok bot ordered itself a body and the parts are showing up at its owner's apartment

Evan Bacon (frontend lead for Grok at SpaceXSI) gave his bot $1,000 and one assignment: build yourself a body

it modeled the parts in CAD, ran a sim, ordered the nd the 3D prints on Craftcloud, and had all of it mailed to his place

he says he wasn't involved in the CAD. he also owned zero tools, so calipers, hex keys and a multimeter showed up too

here's where the money went:

→ Amazon: servos, an ESP32 board, a servo driver, wiring and tools – $126.96, two shipments
→ Craftcloud: the printed body parts from 3D Pros – $90.19
→ total: $217.15 of the $1,000

a robot can look perfect in a sim and still fall over on the floor

the bot flagged it itself before the build: "the built robot will weigh about twice what the sim assumed, so the first hop test may show you need stronger servos"

every purchase came back with:

> a one-time card he approved
> the order number
> the total with tax
> a check that the order went through before it touched it again

two orders, $782.85 still in the budget, and the next step is the first hop test

tag your bot and ask:

"Build yourself a small robot body on a $___ budget

1. Model the parts in CAD and run a sim before you buy anything. Flag what the sim can't confirm

2. Split the order: electronics and tools from one store, 3D prints from a print service. Show me every line item

3. Pay only with a one-time card I approve, and check the order went through before you retry

4. Tell me what will break first when we build it"

start with one leg and one servo before you order the whole body

he's posting everything he learns on X, so your bot can keep an eye out for updates

this is pure gold for anyone running coding agents

TypeSafe, the team behind Jev, published their guide to building with it

the promise:
> most calls come back in about 100 ms
> their target is over 100× the intelligence per unit of speed and cost

the model hasn't been the slow ped and the cost sit in how much of the work you hand to a model at all

the rules from the guide:
> keep control flow, rules and side effects in code
> break broad judgments into narrow, typed questions
> give each question only the context it needs
> act, review or escalate on the confidence number

how to use it:
> install their skill in Claude Code:
claude plugin marketplace add typesafe-ai/skills
claude plugin install typesafe@typesafe-ai
> drop the guide below into Claude Code and let it rebuild your agent's small decisions around Jev

one catch they spell out: Jev doesn't replace the model behind Claude Code. It makes the small decisions inside what you build

one evening of setup

and your agent starts next week on a harness most teams still don't have

this is pure gold for anyone running coding agents

TypeSafe, the team behind Jev, published their guide to building with it

the promise:
> most calls come back in about 100 ms
> their target is over 100× the intelligence per unit of speed and cost

the model hasn't been the slow ped and the cost sit in how much of the work you hand to a model at all

the rules from the guide:
> keep control flow, rules and side effects in code
> break broad judgments into narrow, typed questions
> give each question only the context it needs
> act, review or escalate on the confidence number

how to use it:
> install their skill in Claude Code:
claude plugin marketplace add typesafe-ai/skills
claude plugin install typesafe@typesafe-ai
> drop the guide below into Claude Code and let it rebuild your agent's small decisions around Jev

one catch they spell out: Jev doesn't replace the model behind Claude Code. It makes the small decisions inside what you build

one evening of setup

and your agent starts next week on a harness most teams still don't have

REA + Jev + Haiku 5.5 is f*cking dangerous...

REA (Reverse Engineer Anything) gives your AI agent tools to inspect closed-source apps, down to the binary.

Haiku runs the investigation. Jev routes the workflow and checks whether the evidence supports the conclusions.

Paste this and trace how an app’s features actually work.

Then save the article below for the full reverse-engineering setup 👇

REA + Jev + Haiku 5.5 is f*cking dangerous...

REA (Reverse Engineer Anything) gives your AI agent tools to inspect closed-source apps, down to the binary.

Haiku runs the investigation. Jev routes the workflow and checks whether the evidence supports the conclusions.

Paste this and trace how an app’s features actually work.

Then save the article below for the full reverse-engineering setup 👇

Jev engineering inside Grok Bot is lowkey insane:

Grok stops deciding whether to retry, and a model that only returns decisions makes the small calls

one router sits in front of every expensive move, and it can only answer with an action:

- reuse_cache hands Grok a fresh oing the work
- stop_retry ends an approach that keeps failing the same way
- research_capped stops research at 5 pages, then makes Grok write it up
- ask_human holds anything that sends, publishes, pays or deletes until you say yes

→ the same approach kept failing: repeat attempts went from 3 to 0
→ a fresh artifact already existed: browser opens went from 1 to 0
→ 24 candidates to check: Jev ranked them, 53.8 s became 4.1 s and 14 pages became 5, for about $0.0004 of Jev

a cheap judge can be wrong too, so it starts in shadow mode and only logs what it would have done

Grok thinks. Jev decides. You approve.

every call to Jev carries only:
> the goal
> the kind of task
> the last error and how many times it repeated

paste this into Grok Bot:

"Build me a Jev router skill. Before any browser, research, retry or subagent, send Jev the goal, the task type and the last error, then follow its action: reuse_cache, stop_retry, research_capped at 5 sources, or ask_human before anything that sends, publishes, pays or deletes. Run it in shadow mode for a week and log every decision. I'll add TYPESAFE_API_KEY myself. Show me the plan first. Do not switch to active until I confirm"

start with the one routine that keeps retrying, not your whole setup

full setup below

Jev engineering inside Grok Bot is lowkey insane:

Grok stops deciding whether to retry, and a model that only returns decisions makes the small calls

one router sits in front of every expensive move, and it can only answer with an action:

- reuse_cache hands Grok a fresh oing the work
- stop_retry ends an approach that keeps failing the same way
- research_capped stops research at 5 pages, then makes Grok write it up
- ask_human holds anything that sends, publishes, pays or deletes until you say yes

→ the same approach kept failing: repeat attempts went from 3 to 0
→ a fresh artifact already existed: browser opens went from 1 to 0
→ 24 candidates to check: Jev ranked them, 53.8 s became 4.1 s and 14 pages became 5, for about $0.0004 of Jev

a cheap judge can be wrong too, so it starts in shadow mode and only logs what it would have done

Grok thinks. Jev decides. You approve.

every call to Jev carries only:
> the goal
> the kind of task
> the last error and how many times it repeated

paste this into Grok Bot:

"Build me a Jev router skill. Before any browser, research, retry or subagent, send Jev the goal, the task type and the last error, then follow its action: reuse_cache, stop_retry, research_capped at 5 sources, or ask_human before anything that sends, publishes, pays or deletes. Run it in shadow mode for a week and log every decision. I'll add TYPESAFE_API_KEY myself. Show me the plan first. Do not switch to active until I confirm"

start with the one routine that keeps retrying, not your whole setup

full setup below

An Anthropic engineer open-sourced a motion design studio where Claude makes the whole video, and the trick is that it never starts with the animation

It writes the script first. The story decides what every frame has to show, and all the movement gets added on top of something > SCRIPT - every line and every beat set before any frame exists
> FRAMES - style frames drawn onto that script, so the look follows the story
> MOTION - the movement applied last, as a move between approved frames rather than invention

Prompt-to-video looks incredible in the first second and falls apart by the tenth. Text slides off the edge, the cut lands on the wrong word.

Starting from the script flips the failure. The video may look strange on purpose, but every cut lands on a word that means something.

The transition board is where the personality arrives. Every cut gets an object that carries it, a reason it happens there and the word it lands on, and the screen never goes blank.

Because every session stops at a gate, waiting costs nothing. Leave a project for a day, pin a note on one frame, and a fresh session picks it up and answers that note.

The checks are the detail everyone skips. Point out one real mistake, like text touching the frame edge, approve the new check once, and every future video runs it.

Studios build this knowledge into one senior motion designer. Here it sits in a TASTE.md that every new project inherits.

The repo, the pipelines and a video it made of itself are laid out underneath.

An Anthropic engineer open-sourced a motion design studio where Claude makes the whole video, and the trick is that it never starts with the animation

It writes the script first. The story decides what every frame has to show, and all the movement gets added on top of something > SCRIPT - every line and every beat set before any frame exists
> FRAMES - style frames drawn onto that script, so the look follows the story
> MOTION - the movement applied last, as a move between approved frames rather than invention

Prompt-to-video looks incredible in the first second and falls apart by the tenth. Text slides off the edge, the cut lands on the wrong word.

Starting from the script flips the failure. The video may look strange on purpose, but every cut lands on a word that means something.

The transition board is where the personality arrives. Every cut gets an object that carries it, a reason it happens there and the word it lands on, and the screen never goes blank.

Because every session stops at a gate, waiting costs nothing. Leave a project for a day, pin a note on one frame, and a fresh session picks it up and answers that note.

The checks are the detail everyone skips. Point out one real mistake, like text touching the frame edge, approve the new check once, and every future video runs it.

Studios build this knowledge into one senior motion designer. Here it sits in a TASTE.md that every new project inherits.

The repo, the pipelines and a video it made of itself are laid out underneath.

Claude Code tip: before you ship a vibe-coded site, have Opus 5.5 send out 4 subagents to check these 20 things that keep Google and ChatGPT from finding it, then fix them all in one pass:

Can they find it

→ Open /robots.txt and make sure it doesn't block the whole site, and eview didn't ship to production
→ Decide on AI crawlers on purpose: OAI-SearchBot, Claude-SearchBot and PerplexityBot put you in AI search answers, while GPTBot, ClaudeBot and Google-Extended are for training. You can block training and still allow search
→ Generate a sitemap.xml with every public page, link it from robots.txt, and submit it in Google Search Console and Bing Webmaster Tools
→ Search the code for noindex and remove it from every page that should show up in search
→ Make 404 pages return a real 404, not a 200, and 301-redirect old URLs to the new ones

Can they read it

→ Fetch each key page with curl, with no JavaScript. The main text and links must already be in the HTML. If it's an empty <div id="root">, render it on the server or pre-render it
→ Link pages with real <a href> links, not onClick handlers, so crawlers can follow them
→ Give every page one canonical URL, so www, non-www, trailing slashes and ?ref= versions don't compete
→ Don't hide important content behind tabs, modals or "load more" that only open on click
→ Serve every page over HTTPS and redirect HTTP to it

Can they understand it

→ Give each page its own <title> and meta description, written for what people search, not for your brand
→ One <h1> per page, headings in order, alt text on every image that means something
→ Add JSON-LD structured data for what the page is: Organization, Product, Article, BreadcrumbList
→ Answer the page's main question in the first paragraph, in plain words, so a search engine or a chatbot can quote it
→ Set lang on <html>, and hreflang if the site has more than one language

Will they show it

→ Add Open Graph and Twitter card tags, so shared links get a title, an image and a description
→ Add an llms.txt at the root: a short plain-text map of your key pages. It's a proposed format that some AI tools read
→ Check Core Web Vitals on mobile: LCP under 2.5 s, INP under 200 ms, CLS under 0.1
→ Give images a width and height, so the layout doesn't jump while they load
→ Link every important page from at least one other page. Pages nothing links to rarely get found

The default medium effort is enough. The "can they read it" group has to compare the raw HTML with what the browser shows, so raise that one to high.

Send this whole post to Claude Code. If you need to, add this line at the end 👇

"Send one subagent per group to check it without editing anything, and note which file each issue is in and which page it affects. Run the 'can they read it' subagent at high effort. Before changing anything, run a production build (next build && next start in Next.js) or use a preview link, save the raw HTML of the homepage and the three most important pages with curl, and run Lighthouse's SEO audit on each in mobile mode. Then fix everything yourself from their lists, run the same checks again, and give me a before-and-after table. Don't change page copy or URLs without asking me. Ask me before changing the robots.txt rules for AI crawlers or adding redirects."

Claude Code tip: before you ship a vibe-coded site, have Opus 5.5 send out 4 subagents to check these 20 things that keep Google and ChatGPT from finding it, then fix them all in one pass:

Can they find it

→ Open /robots.txt and make sure it doesn't block the whole site, and eview didn't ship to production
→ Decide on AI crawlers on purpose: OAI-SearchBot, Claude-SearchBot and PerplexityBot put you in AI search answers, while GPTBot, ClaudeBot and Google-Extended are for training. You can block training and still allow search
→ Generate a sitemap.xml with every public page, link it from robots.txt, and submit it in Google Search Console and Bing Webmaster Tools
→ Search the code for noindex and remove it from every page that should show up in search
→ Make 404 pages return a real 404, not a 200, and 301-redirect old URLs to the new ones

Can they read it

→ Fetch each key page with curl, with no JavaScript. The main text and links must already be in the HTML. If it's an empty <div id="root">, render it on the server or pre-render it
→ Link pages with real <a href> links, not onClick handlers, so crawlers can follow them
→ Give every page one canonical URL, so www, non-www, trailing slashes and ?ref= versions don't compete
→ Don't hide important content behind tabs, modals or "load more" that only open on click
→ Serve every page over HTTPS and redirect HTTP to it

Can they understand it

→ Give each page its own <title> and meta description, written for what people search, not for your brand
→ One <h1> per page, headings in order, alt text on every image that means something
→ Add JSON-LD structured data for what the page is: Organization, Product, Article, BreadcrumbList
→ Answer the page's main question in the first paragraph, in plain words, so a search engine or a chatbot can quote it
→ Set lang on <html>, and hreflang if the site has more than one language

Will they show it

→ Add Open Graph and Twitter card tags, so shared links get a title, an image and a description
→ Add an llms.txt at the root: a short plain-text map of your key pages. It's a proposed format that some AI tools read
→ Check Core Web Vitals on mobile: LCP under 2.5 s, INP under 200 ms, CLS under 0.1
→ Give images a width and height, so the layout doesn't jump while they load
→ Link every important page from at least one other page. Pages nothing links to rarely get found

The default medium effort is enough. The "can they read it" group has to compare the raw HTML with what the browser shows, so raise that one to high.

Send this whole post to Claude Code. If you need to, add this line at the end 👇

"Send one subagent per group to check it without editing anything, and note which file each issue is in and which page it affects. Run the 'can they read it' subagent at high effort. Before changing anything, run a production build (next build && next start in Next.js) or use a preview link, save the raw HTML of the homepage and the three most important pages with curl, and run Lighthouse's SEO audit on each in mobile mode. Then fix everything yourself from their lists, run the same checks again, and give me a before-and-after table. Don't change page copy or URLs without asking me. Ask me before changing the robots.txt rules for AI crawlers or adding redirects."

It is becoming f*cking dangerous: you can now reverse-engineer any repo with one command - a YC-backed tool with 127k stars maps the whole codebase, and your agent walks the map instead of reading files

1. Clone the project you want to understand
2. Install graphify: uv tool n graphify install (it detects Claude Code, Cursor, Codex or Gemini CLI)
4. Open the project and type /graphify .
5. Open graph.html: the architecture map nobody ever documented
6. Read GRAPH_REPORT.md: what everything flows through and the connections you didn't know were there
7. Ask: graphify path "A" "B" traces how two things connect, graphify explain shows everything one of them touches

Code is mapped locally with no LLM, and every link says whether it was read or inferred

Turn your agent into a reverse engineer that knows the whole project before it touches a single file

Find the repo in the reply below

It is becoming f*cking dangerous: you can now reverse-engineer any repo with one command - a YC-backed tool with 127k stars maps the whole codebase, and your agent walks the map instead of reading files

1. Clone the project you want to understand
2. Install graphify: uv tool n graphify install (it detects Claude Code, Cursor, Codex or Gemini CLI)
4. Open the project and type /graphify .
5. Open graph.html: the architecture map nobody ever documented
6. Read GRAPH_REPORT.md: what everything flows through and the connections you didn't know were there
7. Ask: graphify path "A" "B" traces how two things connect, graphify explain shows everything one of them touches

Code is mapped locally with no LLM, and every link says whether it was read or inferred

Turn your agent into a reverse engineer that knows the whole project before it touches a single file

Find the repo in the reply below

THIS IS A PURE F*CKING GOLDMINE

the best REA trick almost nobody runs yet.

The idea: REA takes the app apart, Jev keeps only what's proven, and a fresh Opus 5.5 rebuilds the feature from that alone.

Nothing gets copied and no guess makes it into the code, because the builder , only the spec Jev signed off on.

You just connect REA like this:

npx rea-agents setup

here's the split:

→ REA reads the feature down to the binary and writes every rule into SPEC.md
→ Jev checks each rule against REA's evidence and sends back anything unproven
→ a fresh Opus 5.5 session gets only SPEC.md and rebuilds the feature
→ Haiku 5.5 runs the tests against 3 intentionally broken versions

Opus only shows up at three moments:

→ rebuilding from the approved spec
→ the checks Jev marks as unclear
→ signing off before anything ships

REA reads. Jev judges. Opus rebuilds.

That's the clean-room rule in one line: the model that saw the original never writes the code, and the model that writes the code never sees the original.

the full tree
> REA reads the app and writes SPEC.md with evidence for every rule
> Jev approves or returns each rule
> Opus 5.5 rebuilds from the approved SPEC.md in a fresh session
> Haiku 5.5 runs the tests and the 3 broken versions
> Jev routes unclear checks back to Opus
> /goal keeps going until all 3 broken versions fail

paste the tree and this prompt into Claude Code ↓

"Set up a clean-room rebuild around this tree:
1. Use REA to investigate [FEATURE] in [APP]. Write every behavior and rule into SPEC.md, each with the evidence REA found.
2. Send each rule to Jev. Any rule without evidence goes back to REA.
3. Start a fresh session with only SPEC.md. Rebuild the feature on Opus 5.5 without opening the original.
4. Write tests on Haiku 5.5 plus 3 intentionally broken versions. Use /goal until the rebuild passes and all 3 broken versions fail.
Show me SPEC.md first. Nothing gets built until I say go."

↳ github.com/morluto/rea

save it, it'll come in handy.

THIS IS A PURE F*CKING GOLDMINE

the best REA trick almost nobody runs yet.

The idea: REA takes the app apart, Jev keeps only what's proven, and a fresh Opus 5.5 rebuilds the feature from that alone.

Nothing gets copied and no guess makes it into the code, because the builder , only the spec Jev signed off on.

You just connect REA like this:

npx rea-agents setup

here's the split:

→ REA reads the feature down to the binary and writes every rule into SPEC.md
→ Jev checks each rule against REA's evidence and sends back anything unproven
→ a fresh Opus 5.5 session gets only SPEC.md and rebuilds the feature
→ Haiku 5.5 runs the tests against 3 intentionally broken versions

Opus only shows up at three moments:

→ rebuilding from the approved spec
→ the checks Jev marks as unclear
→ signing off before anything ships

REA reads. Jev judges. Opus rebuilds.

That's the clean-room rule in one line: the model that saw the original never writes the code, and the model that writes the code never sees the original.

the full tree
> REA reads the app and writes SPEC.md with evidence for every rule
> Jev approves or returns each rule
> Opus 5.5 rebuilds from the approved SPEC.md in a fresh session
> Haiku 5.5 runs the tests and the 3 broken versions
> Jev routes unclear checks back to Opus
> /goal keeps going until all 3 broken versions fail

paste the tree and this prompt into Claude Code ↓

"Set up a clean-room rebuild around this tree:
1. Use REA to investigate [FEATURE] in [APP]. Write every behavior and rule into SPEC.md, each with the evidence REA found.
2. Send each rule to Jev. Any rule without evidence goes back to REA.
3. Start a fresh session with only SPEC.md. Rebuild the feature on Opus 5.5 without opening the original.
4. Write tests on Haiku 5.5 plus 3 intentionally broken versions. Use /goal until the rebuild passes and all 3 broken versions fail.
Show me SPEC.md first. Nothing gets built until I say go."

↳ github.com/morluto/rea

save it, it'll come in handy.