# Purpose of workitems.md in Case Management: Task Tracking for Reverse Engineering

> Understand the purpose of workitems.md in case management. This guide explains how it tracks tasks for reverse engineering and penetration testing in the reverse-skill framework.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-01

---

**workitems.md serves as the central checklist that records every work-item and its coverage status for penetration-testing or reverse-engineering cases in the reverse-skill framework.**

In the `zhaoxuya520/reverse-skill` repository, case management relies on structured markdown files to track progress through complex security assessments. Understanding the purpose of workitems.md in case management is essential for maintaining audit trails and ensuring no critical phase is overlooked during reconnaissance or exploit development.

## What is workitems.md?

[`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) is a **task registry and coverage tracker** that lives inside each case directory. It functions as the operational backbone of the case management workflow, documenting concrete activities—from port scans to authentication bypass attempts—along with their current state, assigned roles, and associated evidence.

The file operates as part of the "Z3r0 timeline" and "WorkItem" concepts defined in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md), keeping case data in pure text format that remains diff-friendly for version control and easily parseable by both human analysts and automated agents.

## File Location and Structure

According to the directory layout documented in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md), [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) resides in the case-specific folder:

```text
work/<case>/
├── scope.md
├── timeline.md
└── workitems.md

```

This placement ensures that [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) works alongside [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) (defining targets) and [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) (tracking chronological progress) to provide a complete operational picture.

The file contains two primary sections:

1. **Work Items Table**: A structured list of tasks with columns for ID, title, role, targets, surface, status, evidence, and notes.
2. **Coverage Checklist**: A verification list ensuring all essential phases reach completion.

## Core Functions

The purpose of workitems.md in case management spans three critical domains:

### Task Tracking

The work items table provides granular visibility into every actionable task. Each entry links an activity to specific targets and tracks its progression through defined states.

**Status values** include:
- `pending` – Task queued but not started
- `in_progress` – Currently being executed
- `blocked` – Impeded by dependencies or external factors
- `done` – Completed and ready for evidence promotion
- `cancelled` – Deprioritized or out of scope

### Coverage Verification

The **Coverage** section acts as a quality gate, ensuring the case progresses through required phases without gaps. This checklist verifies that reconnaissance is thorough, critical findings are documented, and the final report is exportable.

Key milestones include:
- Recon completion for in-scope assets
- Critical/High severity candidate triage
- Evidence validation for all findings
- Attack path documentation
- Timeline continuity checks (no silent gaps exceeding one major phase)
- Report generation via docs-generator
- Field journal completion (anonymized)

### Integration Point

[`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) drives the downstream **Evidence → Finding → Path** workflow. When a work-item reaches `done` status, it becomes eligible for promotion to an Evidence entry, which later feeds into formal Findings and documented attack Paths. This creates an audit trail linking raw activities to final deliverables.

## The Coverage Checklist Template

The coverage checklist in [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) follows a standardized format to ensure consistent case closure criteria:

```markdown

## Coverage

- [ ] Recon complete for in_scope assets
- [ ] Critical/High candidates triaged
- [ ] Validated findings have Evidence
- [ ] Path documented (attack/call/solve)
- [ ] Timeline continuous (no silent gaps >1 major phase)
- [ ] Report exported via docs‑generator
- [ ] field‑journal written (anonymized)

```

## Integration with the Evidence Workflow

The workflow documented in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md) consumes data from [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) to generate the final report chain. When phases finish, the system **updates both [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md)** simultaneously to maintain synchronization between chronological records and task completion states.

This integration enables:

1. **Evidence generation** – Completed work-items (status `done`) promote to Evidence entries
2. **Finding creation** – Evidence entries mature into formal security Findings
3. **Path documentation** – The final chain references specific work-items that produced the underlying evidence

## Practical Implementation

### Work Items Table Template

The standard template for [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md), as defined in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md), uses a markdown table structure:

```markdown

# Work Items

| ID     | title               | role | targets   | surface | status   | evidence | notes |
|--------|---------------------|------|-----------|---------|----------|----------|-------|
| WI-001 | Port scan edge      | cie  | {ip}      | network | done     | E-001    |       |
| WI-002 | Auth bypass check   | cpe  | /api/login| web     | blocked  |          | need creds |

```

The `role` column references responsibilities defined in [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md), ensuring clear accountability for each task.

### Automating Updates with PowerShell

The initialization script `skills/scripts/case-init.ps1` demonstrates programmatic interaction with [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md). The following excerpt appends new work items while maintaining UTF-8 encoding:

```powershell

# Append a new work item line to workitems.md

$workItem = "| WI-003 | Web enum | pentester | https://target | web | pending | | |"
[System.IO.File]::AppendAllText((Join-Path $caseRoot 'workitems.md'), "`n$workItem`n", $utf8)

```

After execution, the script updates [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) to reflect the new task, keeping both records synchronized as required by the "attack-chain / pentest挂钩" workflow.

## Summary

- **workitems.md** lives in `work/<case>/` and functions as the central task registry for penetration-testing and reverse-engineering cases.
- It combines a **structured work items table** (tracking status, roles, and evidence) with a **coverage checklist** (verifying phase completion).
- The file integrates with [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) and drives the **Evidence → Finding → Path** workflow for automated report generation.
- Status values (`pending`, `in_progress`, `blocked`, `done`, `cancelled`) provide clear state management for every task.
- Role assignments reference [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md), while the template structure is defined in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md).

## Frequently Asked Questions

### Where is workitems.md located in the reverse-skill repository?

[`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) resides in the case-specific directory at `work/<case>/workitems.md`, alongside [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md). This location is established by the case initialization process documented in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) and automated through `skills/scripts/case-init.ps1`.

### What status values can a work-item have?

Work-items support five status values: `pending` (queued), `in_progress` (active), `blocked` (impeded), `done` (completed), and `cancelled` (deprioritized). Only items marked `done` are eligible for promotion to Evidence entries in the downstream workflow.

### How does workitems.md integrate with evidence generation?

When a work-item reaches `done` status, it can be promoted to an Evidence entry as documented in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md). This Evidence then feeds into formal Findings and documented Paths, creating a traceable chain from initial task execution to final report delivery.

### What is the Coverage checklist used for?

The Coverage checklist ensures all essential case phases complete without gaps. It verifies reconnaissance coverage, triage of critical findings, evidence validation, attack path documentation, timeline continuity, report export, and field journal completion before case closure.