groundwork

AGENTS.md

@@ -39,7 +39,10 @@ primary evidence.
 3. Export raw decompilation artifacts (pseudocode, listings) into `decomp/`
    using per-binary subdirectories, e.g. `decomp/GameServer_Release_USA_x64/`.
    Keep filenames stable and function-address-based so results are reproducible.
-4. Close the REA session (`close_binary`) when the investigation is complete.
+4. Track targets, artifact SHA-256 identities, and per-binary status in
+   `decomp/INVENTORY.md`; keep a per-binary finding ledger in
+   `decomp/<name>/evidence.md`.
+5. Close the REA session (`close_binary`) when the investigation is complete.
 
 ## Evidence and claims
 
@@ -59,6 +62,13 @@ primary evidence.
 - Do not install Ghidra, Java, Node, or REA prerequisites ad hoc — they are
   provisioned via `mise.toml` and `/opt/ghidra`; repair configuration instead.
 - Version-pin REA at `rea-agents@6.5.0` as declared in `opencode.json`.
+- Do not add npm `devEngines`/`packageManager` constraints to `package.json` —
+  they make `npx` exit `EBADDEVENGINES` in this directory and break the REA MCP
+  launch (this happened once; `devEngines` was removed).
+- Keep the REA registration **project-local**: `opencode.json` in this repo is
+  the source of truth. Do not write global client config
+  (`~/.config/opencode/…`) or run `rea setup` against global paths —
+  `rea doctor` may report global registration drift; that is accepted here.
 - When tooling is missing or an MCP call is blocked, diagnose the specific
   blocker (registration vs. restart vs. provider) rather than re-running setup
   wholesale — see the REA skill's connection-and-recovery reference.