Squash merge startup-hang-fix into main

Prefix research patch comparison doc and normalize root markdown names

Rename research root markdown files to scoped topic names

skills/kernel-analysis-vphone600/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: kernel-analysis-vphone600
+description: Analyze vphone600 kernel artifacts using the local symbol database and XNU source tree. Use when working on kernel reverse engineering, address-to-symbol lookup, release-vs-research kernel comparison, or patch analysis for vphone600 variants in this repository.
+---
+
+# Kernel Analysis Vphone600
+
+Use the local `research/kernel_info` dataset as the first source of truth for symbol lookup.
+Use `research/reference/xnu` as the source-level reference for semantics and structure.
+
+## Required Paths
+
+- `research/kernel_info/kernel_symbols.db`
+- `research/kernel_info/kernel_index.tsv`
+- `research/kernel_info/json/kernelcache.release.vphone600.bin.symbols.json`
+- `research/kernel_info/json/kernelcache.research.vphone600.bin.symbols.json`
+- `research/reference/xnu`
+
+If `research/reference/xnu` is missing, create it with a shallow clone:
+
+```bash
+mkdir -p research/reference
+git clone --depth 1 https://github.com/apple-oss-distributions/xnu.git research/reference/xnu
+```
+
+## Workflow
+
+1. Confirm scope is `vphone600` only.
+2. Query `kernel_symbols.db` to select `release` or `research` dataset by name.
+3. Load the linked JSON symbol file and perform symbol/address lookups.
+4. Cross-reference candidate code paths in `research/reference/xnu`.
+5. Report findings with explicit kernel name, symbol path, and address.
+
+## Standard Queries
+
+- List known kernels:
+  - `sqlite3 research/kernel_info/kernel_symbols.db "select kernel_name, json_path from kernel_symbols order by kernel_name;"`
+- Find one kernel by name:
+  - `sqlite3 research/kernel_info/kernel_symbols.db "select * from kernel_symbols where kernel_name='kernelcache.release.vphone600';"`
+- Search symbol by substring in release JSON:
+  - `rg -n 'symbol_name_fragment' research/kernel_info/json/kernelcache.release.vphone600.bin.symbols.json`
+- Search symbol by address in research JSON:
+  - `rg -n '0xfffffe00...' research/kernel_info/json/kernelcache.research.vphone600.bin.symbols.json`
+
+## Output Rules
+
+- Always include which kernel was used: `kernelcache.release.vphone600` or `kernelcache.research.vphone600`.
+- Always include exact symbol name and address when available.
+- Always distinguish fact from inference when mapping symbols to XNU behavior.
+- Avoid claiming coverage outside vphone600 unless explicitly requested.
+
+## References
+
+- Read `references/kernel-info-queries.md` for reusable SQL and shell query snippets.

skills/kernel-analysis-vphone600/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Kernel Analysis vphone600"
+  short_description: "Use vphone600 kernel symbol DB and XNU source for analysis."
+  default_prompt: "Analyze vphone600 kernel artifacts using the local symbol database and XNU reference tree."

skills/kernel-analysis-vphone600/references/kernel-info-queries.md

@@ -0,0 +1,39 @@
+# Kernel Info Queries
+
+Use these commands from repo root (`vphone-cli`).
+
+## Database Introspection
+
+```bash
+sqlite3 research/kernel_info/kernel_symbols.db ".schema kernel_symbols"
+sqlite3 research/kernel_info/kernel_symbols.db "select count(*) from kernel_symbols;"
+sqlite3 research/kernel_info/kernel_symbols.db "select kernel_name, matched, missed, percent, total from kernel_symbols order by kernel_name;"
+```
+
+## Resolve JSON Path By Kernel Name
+
+```bash
+sqlite3 research/kernel_info/kernel_symbols.db \
+  "select json_path from kernel_symbols where kernel_name='kernelcache.release.vphone600';"
+```
+
+```bash
+sqlite3 research/kernel_info/kernel_symbols.db \
+  "select json_path from kernel_symbols where kernel_name='kernelcache.research.vphone600';"
+```
+
+## Fast Symbol Search
+
+```bash
+rg -n 'panic' research/kernel_info/json/kernelcache.release.vphone600.bin.symbols.json
+rg -n 'mach_trap' research/kernel_info/json/kernelcache.research.vphone600.bin.symbols.json
+rg -n '0xfffffe00' research/kernel_info/json/kernelcache.release.vphone600.bin.symbols.json
+```
+
+## Use XNU Source Reference
+
+```bash
+rg -n 'function_or_symbol_fragment' research/reference/xnu/{bsd,osfmk,iokit,security}
+```
+
+Prefer direct source matches in `research/reference/xnu` for behavioral explanations.