joranhonig/grimoire/tome

Tome

Build and maintain a source-backed security research wiki inside grimoire/tomes/. The durable artifact is the repository, not the chat response.

Philosophy

GRIMOIRE.md is the concise map loaded into future context. Tomes are the library: focused pages that preserve evidence, claims, uncertainty, contradictions, and reasoning that would otherwise be lost during compaction.

Cartography tells future agents where things are. A tome tells them what has been learned, why it is believed, what version or scope it applies to, and what remains unknown. Before adding a claim to a tome, cross-check it against code, tests, documentation, traces, deployments, or prior artifacts.

Do not convert inference into fact through repeated summaries. Do not hide contradictions by choosing the most convenient source. If evidence is insufficient, write the evidence gap clearly.

Key Principles

• Keep GRIMOIRE.md concise and link outward to tomes.
• Tomes contain supported conclusions and reasoning; cartography contains navigation.
• Prefer updating existing tomes over creating near-duplicates.
• Preserve useful negative results when they prevent repeated work.
• Mark uncertain material as open questions, not facts.
• Do not change evidence to match a conclusion.
• Documentation describes intent; matching code or observation describes behavior.

Relationship To Grimoire

Use the existing project layout:

project/
  GRIMOIRE.md
  grimoire/
    tomes/
    findings/
    sigil-findings/
    cartography/
    spells/
    tmp/

Tomes live in grimoire/tomes/. They may link to findings, cartography, PoCs, tests, and source files. Do not create a separate security-wiki/ repository unless the user explicitly asks for one.

When a research task needs more structure, create these files under grimoire/tomes/:

grimoire/tomes/
  index.md
  actors/
  components/
  contracts/
  flows/
  mechanisms/
  trust-boundaries/
  risks/
  open-questions/
  notes/
    unverified-claims.md
    contradictions.md
    hypotheses.md

Create only the directories and files that are useful for the task. If they already exist, update them. Prefer the typed directories for human navigation over a flat pile of pages. Use notes/ for durable context that does not cleanly fit a stricter category yet.

Workflow

When this skill is activated and when you're answering a question, follow these steps.

Base

- [ ] 1. Orient to the existing grimoire
- [ ] 2. Define the research question in your own words
- [ ] 3. Answer the question using evidence from tomes if possible
- [ ] 4. Run the research workflow if the wiki is insufficient

Research

- [ ] 1. Identify where tomes lack evidence and what evidence is needed
- [ ] 2. Study related source material to acquire evidence
- [ ] 3. Update the wiki with new evidence-supported conclusions
- [ ] 4. Note unverified claims

The base workflow can use efficient, speed-oriented models. The research workflow should always be executed by the most competent model possible.

Read references/workflow.md for the full procedure and completion criteria.

Reference Files

• references/evidence-model.md — source precedence, support/state/confidence, claim

blocks, and provenance.

• references/tome-format.md — grimoire/tomes/ structure, frontmatter, page types,

and routing.

• references/page-templates.md — templates for general, mechanism, flow, component,

risk, and finding-candidate pages.

• references/workflow.md — base and research workflows with completion criteria.
• references/health-check.md — lint, review, and completion checklist for tome

repositories.

Read only the references needed for the task, but always read evidence-model.md before writing or changing claims.