Session Prompt — WP-007 — 2026-06-02

Paste this as the first message to the executing Claude Code session. The session opens execution for WP-007 against the cached binaries.

Intent

Produce the Phase 0 strings + imports baseline for all four target binaries and land it under Findings in scooby-exe. This unblocks WP-001’s Ghidra session (EC-001 Step 3 becomes a cross-check, not a re-extraction) and lets WP-003’s pre-payload region scan validate any asset-name strings against the dump.

Explicitly NOT in scope for this session: any Ghidra work, behavioral analysis of imports (xrefs to call sites), asset-resolution-strategy determination (Ghidra-only), resource-directory contents, Case File #2 (disc not cached).

Authority chain (read order)

Read these files top-to-bottom before doing any work:

  1. C:\Users\jjensen\.claude\CLAUDE.md — operator preferences (tone, ownership, even-handedness, commercial defaults)
  2. docs/01-VISION — engine-lineage finding, generation discipline
  3. docs/reference/wp-lifecycle — Phase 3 execution discipline + commit hygiene
  4. Paired pre-flight artifact: pre-flight-WP-007-2026-06-02-b — Binary identity table + scope lock + risk review
  5. WP body: WP-007-strings-and-imports — §Execution scripts + §Output specification structure + §Exit criteria
  6. Format doc to update: docs/formats/scooby-exe — Findings sections + cross-title runtime-dependencies table
  7. Cache reference: tools/exes/README — per-title cache state, disc inventories, SHA-256s already recorded

Pre-execution checks

Confirm each before touching files:

If any check fails: STOP. Surface the failure; do not extract against mismatched state.

Execution rules

Scope allowlist (verbatim from pre-flight §Scope lock):

docs/formats/scooby-exe.md
docs/work-packets/WORK_INDEX.md
docs/work-packets/WP-007-strings-and-imports.md
tools/extract_strings.py
tools/extract_imports.py

Allowed but local-only (gitignored under tools/exes/*):

tools/exes/<title>/strings-ansi.txt
tools/exes/<title>/strings-wide.txt
tools/exes/<title>/imports.txt

Forbidden:

Generation discipline (REQUIRED): every Finding subsection labels its title + generation (#### Showdown (Gen 1), etc.). The Cross-title delta bullet in each Conclusions block forces explicit comparison.

Copyright posture: raw strings-ansi.txt / strings-wide.txt / imports.txt live ONLY under tools/exes/<title>/ (gitignored). Into docs/formats/scooby-exe.md go ONLY: structured anchor strings (filenames are functional/factual), a small handful of error-message samples for shape, and the full import table (function names are uncopyrightable interface data). Do NOT paste full strings dumps wholesale.

Commit conventions:

Top risks (imperative form from pre-flight §Risk review):

Session task

Execute WP-007 §Execution in this order:

  1. Write the extraction scripts at the exact paths in the §Scope allowlist:
    • tools/extract_strings.py — Python regex over the binary; ANSI pass ([\x20-\x7E]{6,}) + UTF-16LE pass ((?:[\x20-\x7E]\x00){6,}). Writes strings-ansi.txt and strings-wide.txt to the binary’s parent directory. See WP-007 §1 for the canonical implementation.
    • tools/extract_imports.py — Python pefile walking DIRECTORY_ENTRY_IMPORT. Writes imports.txt to the binary’s parent directory. See WP-007 §2 for the canonical implementation.
    • Both scripts take the binary path as sys.argv[1]. Test against Showdown first.

  2. Run extraction against all four cached binaries. Use the cross-title PowerShell loop in WP-007 §3. Produces 12 local-only files (3 per title × 4 titles), all gitignored.

  3. Author Findings in docs/formats/scooby-exe.md per WP-007 §Output specification:

    a. Binary identity table — copy verbatim from the pre-flight artifact §Repo + disc state. Four rows, one per title.

    b. String literals subsection per title, with subsections: File / asset names · Paths / directories · Error / debug strings (handful only, not full set — copyright) · Registry keys · Other notable strings.

    c. Strings Conclusions block per title — ANSI count, UTF-16LE count, registry usage Y/N, hardcoded paths Y/N, ≥3 filename / data-file anchors for Ghidra (NOT error strings — those fail the WP §Exit criterion 6), cross-title delta vs Showdown.

    d. Import table subsection per title — grouped by category (Win32 File I/O, Memory / Process, Graphics / DirectX, Audio / Video, Input, CRT / Standard Library, Other).

    e. Imports Conclusions block per title — Path API encoding (CreateFileA/W presence), Bink runtime, Smacker runtime, DirectDraw / D3D version, DirectSound, CRT version, cross-title delta vs Showdown.

    f. Update the Cross-title runtime dependencies table — replace every “TBD” / “unverified” / “predicted same” cell with the verdict derived from the imports findings above. This is exit criterion 9.

  4. Commit work as Commit A (docs: WP-007 — strings + imports baseline across four titles).

  5. Update WORK_INDEX — flip WP-007’s Status to ✅ Done. Update the effort estimate cell from “15–30 min” to actual (likely 20–40 min per the WP body). Commit as Commit B (docs: close WP-007 — flip to ✅ Done).

Outputs this session MUST produce:

  1. tools/extract_strings.py (committed, ~30 lines)
  2. tools/extract_imports.py (committed, ~20 lines)
  3. Updated docs/formats/scooby-exe.md with Binary identity table + per-title strings + per-title imports + both Conclusions blocks per title + updated Cross-title runtime dependencies table
  4. Updated docs/work-packets/WORK_INDEX.md with WP-007 row at ✅ Done
  5. Local-only (gitignored): 12 raw extraction files under tools/exes/<title>/

Outputs this session MUST NOT produce (sprawl guard — log as follow-up candidates instead):

Close ritual

When all WP-007 §Exit criteria are satisfied:

  1. Confirm outputs landed. Every file in the §Scope lock allowlist has the expected change. Verify the Binary identity table has all four rows + SHA-256s, both Conclusions blocks have every bullet answered (no TBD), and the Cross-title runtime dependencies table has no remaining “TBD” / “unverified” / “predicted” cells for the four cached titles.
  2. Confirm raw extracts gitignored. git diff --cached --name-only shows zero tools/exes/** content files (only the scripts under tools/ if they’re freshly committed).
  3. Verify the two-commit topology is on the branch (or both commits are clean on main if working directly there). Commit A = findings; Commit B = WORK_INDEX flip.
  4. Propagate to dependent WPs. WP-001 and WP-003 both cite WP-007 as a “recommended” prerequisite — note in WORK_INDEX Current state that the WP-007 baseline is now landed.
  5. Update the lessons-learned section of the pre-flight artifact — either “No lessons learned” if execution was clean, or one line on any preventable gap pre-flight should have caught.
  6. Report back to operator. State: outputs landed, exit criteria satisfied, status flipped. Surface any anomalies that came up but didn’t fit existing WP/EC scope — these become follow-up WP candidates (likely targets: the 4096-byte Showdown↔Phantom size delta, the BK.025 anomaly, the IBSlogo.avi cross-disc timing puzzle).

If any §Exit criterion is NOT met: WP-007 stays 🚧 In Progress. Do NOT flip WORK_INDEX. Document what’s open in WP §Notes and report back honestly.