v1.0.0 - First packaged release

First tagged release of the Cybersecurity Skills Router / Reverse-Engineering Skill Routing Pack.

What's included

• Evolution control plane (skills/evolution/): Goal Contract -> capability graph -> macro/micro route -> TraceCard -> oracle -> promotion gate. Wraps, does not replace, domain skills.
• 22 domain skills: apk-reverse, ida-reverse, ghidra-reverse, js-reverse, radare2, malware-analysis, mobile-reverse, firmware-pentest, pwn-chain, patch-diff-exploit, binary-diff, edr-bypass-re, supply-chain-security, llm-security, api-security, pentest-tools, attack-chain, browser-automation, reverse-engineering, docs-generator, diagram-generator, and the field-journal memory system itself.
• Field-journal memory tiers (skills/field-journal/): validated / candidate / forensic, each entry requires provenance (source trace, tool versions, verification time, environment).
• MCP/wheel integration examples: kali/mcp-kali-example.json (kali-server, metasploit-mcp, hexstrike, pentestswarm, jshook, anything-analyzer, idapro, ghidra), burp-mcp-full/ (Burp Suite MCP bridge), .kiro/settings/mcp.json (live client config example).
• Routing tables: skills/routing.md / skills/routing.json (+ zh variant), skills/CONTRIBUTING.md skill-addition criteria.

New in this release

• ghidra-reverse skill: new skill for GhydraMCP (starsong-consulting/GhydraMCP), sourced from upstream README/code. Flags a real discrepancy found in the pre-existing but previously undocumented .kiro/settings/mcp.json ghidra entry (configured port/transport does not match GhydraMCP's documented defaults) so it doesn't get silently trusted.
• js-reverse CDP tool mapping: documents the mcp__plugin_ecc_chrome-devtools__* tool surface alongside the existing js-reverse_*/jshookmcp mappings.
• Field-journal methodology entry (candidate tier): generalized lessons from a private-API reverse-engineering session -- treat a target's own front-end column/grid-definition JS as a higher-signal field-semantics source than guessing from network traffic, live-probe the real endpoint and diff against the inferred spec rather than trusting it blindly, parse by column name not position, fail loudly on missing/malformed fields.
• Fleet sync script (skills/scripts/fleet-sync.ps1): collision-safe additive sync of field-journal candidate/validated entries, capability-graph.json, and tool-index.md between two machines over SSH/SCP. Never overwrites, never deletes; reports collisions for manual resolution.