How to Create Timelines and Workitems for Case Tracking in Reverse-Skill

To create timelines and workitems for case tracking, initialize a case directory using case-init.ps1, then maintain an append-only timeline.md for chronological actions and a tabular workitems.md for discrete tasks, both stored under work/<case>/.

The zhaoxuya520/reverse-skill repository implements a lightweight, file-based workflow for tracking penetration-testing and forensics cases. All case-specific artifacts live under a hidden work/<case>/ folder (ignored by Git) and follow a strict contract defined in skills/ops/scope-contract.md and skills/ops/timeline-workitem.md.

Initialize the Case Structure

Use the PowerShell helper skills/scripts/case-init.ps1 to scaffold the folder hierarchy and populate empty template files. This script requires a hint describing the engagement type and a unique case name.

powershell -File skills\scripts\case-init.ps1 -Hint "full pentest" -CaseName "acme-2026"

This command creates work/acme-2026/ containing three core files: scope.md, timeline.md, and workitems.md.

Define the Scope Contract

Before tracking begins, populate scope.md to record authorized scope, legal constraints, required evidence, and explicitly indicate whether a timeline is required (timeline: true). This step satisfies the Ops contract defined in skills/ops/scope-contract.md, which enforces that all cases declare their logging requirements upfront.

Create the Timeline

The timeline.md file serves as an append-only, chronological log of actions, commands, results, and artifacts. According to skills/ops/timeline-workitem.md, this file must never be rewritten; entries are strictly additive to preserve audit integrity.

Timeline Entry Format

Each entry uses a markdown block starting with an ISO-8601 timestamp, role abbreviation, and current phase. The block contains key-value pairs for action description, command references, results, and linked artifacts.

## 2024-11-05T14:23:00Z | cie | Recon

- action: Enumerate public subdomains of target.com
- command_or_ref: `sublist3r -d target.com`
- result_summary: 23 subdomains discovered, including admin.target.com
- artifacts: [evidence/subdomains.txt]
- evidence_ids: []
- next: Perform port scan on discovered hosts

Append-Only Rules

Never modify previous ## blocks. If you must correct an error, append a new block with a corrects: field referencing the timestamp of the erroneous entry. This immutability ensures a reproducible audit trail for reviewers and auditors.

Manage Workitems

The workitems.md file tracks discrete tasks using a tabular format with unique identifiers (WI-XXX). This structure mirrors classic work-item concepts used in penetration-testing frameworks and provides a project management view complementary to the narrative timeline.

Workitem Table Structure

Insert rows for each discrete task, mapping roles to targets and tracking status through completion.

| ID    | title               | role | targets   | surface | status | evidence | notes          |
|-------|---------------------|------|-----------|---------|--------|----------|----------------|
| WI-001| Port scan edge     | cie  | 10.0.0.0/24| network | done   | E-001    |                |
| WI-002| Auth bypass check  | cpe  | /api/login| web     | blocked|          | need creds |

Coverage Checklist

Append a coverage checklist at the bottom of workitems.md to ensure the case meets completion criteria before closing.

- [ ] Recon complete for in_scope assets
- [ ] Critical/High candidates triaged
- [ ] Validated findings have Evidence
- [ ] Path documented (attack/call/solve)
- [ ] Timeline continuous (no silent gaps >1 major phase)
- [ ] Report exported via docs-generator
- [ ] field-journal written (anonymized)

Link Evidence and Iterate

Place raw artifacts (screenshots, PCAPs, logs) under evidence/ and reference them via relative paths in timeline.md. When an artifact graduates to a formal Evidence entry, add its ID (e.g., E-001) to the evidence_ids field.

Update both timeline.md and workitems.md after each major phase (Recon, Exploitation, Post-exploitation, Reporting). Consult skills/ops/role-map.md to determine which role (e.g., cie, cpe, op) owns the next phase and should append the corresponding entries.

Generate Final Reports

Use the docs-generator skill to ingest the case folder and emit polished markdown or HTML reports. According to skills/docs-generator/SKILL.md, this tool automatically parses timeline.md and workitems.md to produce client-ready deliverables without manual copy-pasting.

Summary

• Run skills/scripts/case-init.ps1 to scaffold case directories under work/<case>/.
• Populate scope.md to define contract terms, legal constraints, and timeline requirements.
• Append entries to timeline.md using ISO-8601 timestamps, role abbreviations, and immutable blocks.
• Track discrete tasks in workitems.md using WI-XXX identifiers, status columns, and the coverage checklist.
• Link evidence via relative paths and formal IDs to maintain audit compliance.
• Generate final deliverables using the docs-generator skill to pull timeline and workitem data.

Frequently Asked Questions

Where are case files stored in the reverse-skill repository?

Case files live under a hidden work/<case>/ folder that is ignored by Git. This location keeps sensitive engagement data out of version control while maintaining local reproducibility and provenance.

What is the difference between timeline.md and workitems.md?

timeline.md provides a chronological, append-only narrative of actions and commands executed during the engagement, while workitems.md offers a tabular view of discrete tasks with statuses, assignee roles, targets, and linked evidence IDs for project management and coverage tracking.

How do I correct an error in the timeline without breaking the audit trail?

Do not edit existing entries. Instead, append a new block with a corrects: field referencing the timestamp or content of the erroneous entry. This preserves the original record while documenting the correction transparently.

Can I automate report generation from these files?

Yes. The docs-generator skill reads the work/<case>/ directory structure, parses timeline.md and workitems.md, and exports polished markdown or HTML reports suitable for client delivery or internal peer review.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}