add workflow

AGENTS.md

@@ -62,19 +62,35 @@ other licence-restricted vendor files.
 
 ## Analysis workflow
 
+The full reproducible procedure, with commands, is in
+[`docs/WORKFLOW.md`](docs/WORKFLOW.md). Follow it for every binary. In summary:
+
 1. Route the target first: native executables/libraries go through REA
    `open_binary` (never pass a Ghidra project file as the target — pass the
    original binary path under `binaries/`).
 2. Work summary-first: `binary_overview` / summary detail before drilling into
    `analyze_function` or pseudocode. Reuse retained Evidence IDs instead of
    re-running identical analysis.
-3. Export raw decompilation artifacts (pseudocode, listings) into `decomp/`
+3. **Third-party libraries: every time one is discovered** (an imported DLL, a
+   version string, RTTI class prefix, library error strings, or a PDB path),
+   do the following before continuing analysis:
+   - pin its version;
+   - **search online for its source or headers** (official releases, git tags,
+     vendor repos, clean-room equivalents);
+   - download it into `third-party/`, or into the gitignored
+     `third-party/_local/` if its licence forbids redistribution;
+   - record it in `third-party/README.md`.
+
+   If no source exists, record that and the acquisition routes. See
+   `docs/WORKFLOW.md` §3.
+4. Export raw decompilation artifacts (pseudocode, listings) into `decomp/`
    using per-binary subdirectories, e.g. `decomp/GameServer_Release_USA_x64/`.
    Keep filenames stable and function-address-based so results are reproducible.
-4. Track targets, artifact SHA-256 identities, and per-binary status in
+   For full coverage, use the headless scripts in `decomp/scripts/`.
+5. Track targets, artifact SHA-256 identities, and per-binary status in
    `decomp/INVENTORY.md`; keep a per-binary finding ledger in
    `decomp/<name>/evidence.md`.
-5. Close the REA session (`close_binary`) when the investigation is complete.
+6. Close the REA session (`close_binary`) when the investigation is complete.
 
 ## Evidence and claims