0xAF-Re Architecture Map

A terminal-first RE agent: one Go host routes planning, execution, and research to different model seats, narrows workflow context when needed, and keeps evidence collection inside local tools and auditable transcripts.

0xAF-Re architecture map Operator terminal connects to the Go host, which routes role prompts through workflow and policy gates to providers and local reverse-engineering tools. Operator Terminal REPL / CLI / TTY /scan /r2 /queue /workflow /model /prompt edit role mid-turn steering 0xAF-Re host · static Go binary state machine, local policy, stream telemetry, embedded prompts and skills Prompt + Config role system prompts provider/model routing project or home overrides Agent Loop route role -> provider -> model compact context, stream events merge tool results into next turn Live HUD role/provider/model plan rows and task state tokens, timing, tool trace Queue + Editing append work while running edit/cancel before execution expand/collapse task output no restart needed Workflow Modes off / auto specialist route caveman packet plan -> isolated executor Policy Gate workspace-scoped reads write/network approvals sensitive path checks unsafe work is refused Provider seats runtime-selectable adapters Planner Codex / GPT Cyber DeepSeek / custom Executor Claude Code / CVP CLI/API providers tool-call capable Researcher Grok / notes / docs background context /planner /executor /researcher /model role model-name Local evidence layer facts are gathered on disk first, then summarized back into the agent loop Fast local tools scan, hex, entropy, carve, apk RE toolchain r2, Ghidra, JADX, angr, Frida Labs + traffic Unicorn, unidbg, Burp, mitmproxy Memory JSONL sessions, artifacts, skills Legend operator / interface agent runtime / providers workflow and local tools policy and approvals Design: split intent, execution, and evidence so RE work stays visible, local, and steerable.

Terminal-first loop

The REPL is the product surface: prompt queueing, live task expansion, slash commands, and raw shell escapes share one workspace policy.

Composable model seats

Planner, executor, and researcher are independent seats. Each can point at a different provider and model without rebuilding the binary.

Workflow context shaping

Specialist routes keep rich RE context. Caveman mode turns one task into a bounded planner packet plus an isolated read-only executor run.

Local evidence governance

File facts come from scoped local tools. Writes, network, sensitive paths, and destructive commands pass through explicit policy gates.

Built with the Cocoon AI architecture-diagram skill · 0xAF-Re design overview · 中文版本 · export buttons render this page as PNG or PDF