# How to Create Timelines and Workitems for Case Tracking in Reverse-Skill > Learn to create timelines and workitems for case tracking in Reverse-Skill. Initialize a case directory and manage chronological actions and discrete tasks efficiently in markdown files. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-06 --- **To create timelines and workitems for case tracking, initialize a case directory using `case-init.ps1`, then maintain an append-only [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) for chronological actions and a tabular [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) for discrete tasks, both stored under `work//`.** The `zhaoxuya520/reverse-skill` repository implements a lightweight, file-based workflow for tracking penetration-testing and forensics cases. All case-specific artifacts live under a hidden `work//` folder (ignored by Git) and follow a strict contract defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) and [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md). ## Initialize the Case Structure Use the PowerShell helper `skills/scripts/case-init.ps1` to scaffold the folder hierarchy and populate empty template files. This script requires a hint describing the engagement type and a unique case name. ```powershell powershell -File skills\scripts\case-init.ps1 -Hint "full pentest" -CaseName "acme-2026" ``` This command creates `work/acme-2026/` containing three core files: [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md). ## Define the Scope Contract Before tracking begins, populate [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) to record authorized scope, legal constraints, required evidence, and explicitly indicate whether a timeline is required (`timeline: true`). This step satisfies the **Ops contract** defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md), which enforces that all cases declare their logging requirements upfront. ## Create the Timeline The [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) file serves as an append-only, chronological log of actions, commands, results, and artifacts. According to [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md), this file must never be rewritten; entries are strictly additive to preserve audit integrity. ### Timeline Entry Format Each entry uses a markdown block starting with an ISO-8601 timestamp, role abbreviation, and current phase. The block contains key-value pairs for action description, command references, results, and linked artifacts. ```markdown ## 2024-11-05T14:23:00Z | cie | Recon - action: Enumerate public subdomains of target.com - command_or_ref: `sublist3r -d target.com` - result_summary: 23 subdomains discovered, including admin.target.com - artifacts: [evidence/subdomains.txt] - evidence_ids: [] - next: Perform port scan on discovered hosts ``` ### Append-Only Rules Never modify previous `##` blocks. If you must correct an error, append a new block with a `corrects:` field referencing the timestamp of the erroneous entry. This immutability ensures a reproducible audit trail for reviewers and auditors. ## Manage Workitems The [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) file tracks discrete tasks using a tabular format with unique identifiers (WI-XXX). This structure mirrors classic work-item concepts used in penetration-testing frameworks and provides a project management view complementary to the narrative timeline. ### Workitem Table Structure Insert rows for each discrete task, mapping roles to targets and tracking status through completion. ```markdown | ID | title | role | targets | surface | status | evidence | notes | |-------|---------------------|------|-----------|---------|--------|----------|----------------| | WI-001| Port scan edge | cie | 10.0.0.0/24| network | done | E-001 | | | WI-002| Auth bypass check | cpe | /api/login| web | blocked| | need creds | ``` ### Coverage Checklist Append a coverage checklist at the bottom of [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) to ensure the case meets completion criteria before closing. ```markdown - [ ] Recon complete for in_scope assets - [ ] Critical/High candidates triaged - [ ] Validated findings have Evidence - [ ] Path documented (attack/call/solve) - [ ] Timeline continuous (no silent gaps >1 major phase) - [ ] Report exported via docs-generator - [ ] field-journal written (anonymized) ``` ## Link Evidence and Iterate Place raw artifacts (screenshots, PCAPs, logs) under `evidence/` and reference them via relative paths in [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md). When an artifact graduates to a formal **Evidence** entry, add its ID (e.g., `E-001`) to the `evidence_ids` field. Update both [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) after each major phase (Recon, Exploitation, Post-exploitation, Reporting). Consult [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) to determine which role (e.g., `cie`, `cpe`, `op`) owns the next phase and should append the corresponding entries. ## Generate Final Reports Use the `docs-generator` skill to ingest the case folder and emit polished markdown or HTML reports. According to [`skills/docs-generator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/SKILL.md), this tool automatically parses [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) to produce client-ready deliverables without manual copy-pasting. ## Summary - Run `skills/scripts/case-init.ps1` to scaffold case directories under `work//`. - Populate [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) to define contract terms, legal constraints, and timeline requirements. - Append entries to [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) using ISO-8601 timestamps, role abbreviations, and immutable blocks. - Track discrete tasks in [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) using WI-XXX identifiers, status columns, and the coverage checklist. - Link evidence via relative paths and formal IDs to maintain audit compliance. - Generate final deliverables using the `docs-generator` skill to pull timeline and workitem data. ## Frequently Asked Questions ### Where are case files stored in the reverse-skill repository? Case files live under a hidden `work//` folder that is ignored by Git. This location keeps sensitive engagement data out of version control while maintaining local reproducibility and provenance. ### What is the difference between timeline.md and workitems.md? [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) provides a chronological, append-only narrative of actions and commands executed during the engagement, while [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) offers a tabular view of discrete tasks with statuses, assignee roles, targets, and linked evidence IDs for project management and coverage tracking. ### How do I correct an error in the timeline without breaking the audit trail? Do not edit existing entries. Instead, append a new block with a `corrects:` field referencing the timestamp or content of the erroneous entry. This preserves the original record while documenting the correction transparently. ### Can I automate report generation from these files? Yes. The `docs-generator` skill reads the `work//` directory structure, parses [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), and exports polished markdown or HTML reports suitable for client delivery or internal peer review.