Purpose of workitems.md in Case Management: Task Tracking for Reverse Engineering

workitems.md serves as the central checklist that records every work-item and its coverage status for penetration-testing or reverse-engineering cases in the reverse-skill framework.

In the zhaoxuya520/reverse-skill repository, case management relies on structured markdown files to track progress through complex security assessments. Understanding the purpose of workitems.md in case management is essential for maintaining audit trails and ensuring no critical phase is overlooked during reconnaissance or exploit development.

What is workitems.md?

workitems.md is a task registry and coverage tracker that lives inside each case directory. It functions as the operational backbone of the case management workflow, documenting concrete activities—from port scans to authentication bypass attempts—along with their current state, assigned roles, and associated evidence.

The file operates as part of the "Z3r0 timeline" and "WorkItem" concepts defined in skills/ops/timeline-workitem.md, keeping case data in pure text format that remains diff-friendly for version control and easily parseable by both human analysts and automated agents.

File Location and Structure

According to the directory layout documented in skills/ops/timeline-workitem.md, workitems.md resides in the case-specific folder:

work/<case>/
├── scope.md
├── timeline.md
└── workitems.md

This placement ensures that workitems.md works alongside scope.md (defining targets) and timeline.md (tracking chronological progress) to provide a complete operational picture.

The file contains two primary sections:

1. Work Items Table: A structured list of tasks with columns for ID, title, role, targets, surface, status, evidence, and notes.
2. Coverage Checklist: A verification list ensuring all essential phases reach completion.

Core Functions

The purpose of workitems.md in case management spans three critical domains:

Task Tracking

The work items table provides granular visibility into every actionable task. Each entry links an activity to specific targets and tracks its progression through defined states.

Status values include:

• pending – Task queued but not started
• in_progress – Currently being executed
• blocked – Impeded by dependencies or external factors
• done – Completed and ready for evidence promotion
• cancelled – Deprioritized or out of scope

Coverage Verification

The Coverage section acts as a quality gate, ensuring the case progresses through required phases without gaps. This checklist verifies that reconnaissance is thorough, critical findings are documented, and the final report is exportable.

Key milestones include:

• Recon completion for in-scope assets
• Critical/High severity candidate triage
• Evidence validation for all findings
• Attack path documentation
• Timeline continuity checks (no silent gaps exceeding one major phase)
• Report generation via docs-generator
• Field journal completion (anonymized)

Integration Point

workitems.md drives the downstream Evidence → Finding → Path workflow. When a work-item reaches done status, it becomes eligible for promotion to an Evidence entry, which later feeds into formal Findings and documented attack Paths. This creates an audit trail linking raw activities to final deliverables.

The Coverage Checklist Template

The coverage checklist in workitems.md follows a standardized format to ensure consistent case closure criteria:

## Coverage

- [ ] Recon complete for in_scope assets
- [ ] Critical/High candidates triaged
- [ ] Validated findings have Evidence
- [ ] Path documented (attack/call/solve)
- [ ] Timeline continuous (no silent gaps >1 major phase)
- [ ] Report exported via docs‑generator
- [ ] field‑journal written (anonymized)

Integration with the Evidence Workflow

The workflow documented in skills/ops/evidence-finding-path.md consumes data from workitems.md to generate the final report chain. When phases finish, the system updates both timeline.md and workitems.md simultaneously to maintain synchronization between chronological records and task completion states.

This integration enables:

1. Evidence generation – Completed work-items (status done) promote to Evidence entries
2. Finding creation – Evidence entries mature into formal security Findings
3. Path documentation – The final chain references specific work-items that produced the underlying evidence

Practical Implementation

Work Items Table Template

The standard template for workitems.md, as defined in skills/ops/timeline-workitem.md, uses a markdown table structure:

# Work Items

| ID     | title               | role | targets   | surface | status   | evidence | notes |
|--------|---------------------|------|-----------|---------|----------|----------|-------|
| WI-001 | Port scan edge      | cie  | {ip}      | network | done     | E-001    |       |
| WI-002 | Auth bypass check   | cpe  | /api/login| web     | blocked  |          | need creds |

The role column references responsibilities defined in skills/ops/role-map.md, ensuring clear accountability for each task.

Automating Updates with PowerShell

The initialization script skills/scripts/case-init.ps1 demonstrates programmatic interaction with workitems.md. The following excerpt appends new work items while maintaining UTF-8 encoding:

# Append a new work item line to workitems.md

$workItem = "| WI-003 | Web enum | pentester | https://target | web | pending | | |"
[System.IO.File]::AppendAllText((Join-Path $caseRoot 'workitems.md'), "`n$workItem`n", $utf8)

After execution, the script updates timeline.md to reflect the new task, keeping both records synchronized as required by the "attack-chain / pentest挂钩" workflow.

Summary

• workitems.md lives in work/<case>/ and functions as the central task registry for penetration-testing and reverse-engineering cases.
• It combines a structured work items table (tracking status, roles, and evidence) with a coverage checklist (verifying phase completion).
• The file integrates with timeline.md and drives the Evidence → Finding → Path workflow for automated report generation.
• Status values (pending, in_progress, blocked, done, cancelled) provide clear state management for every task.
• Role assignments reference skills/ops/role-map.md, while the template structure is defined in skills/ops/timeline-workitem.md.

Frequently Asked Questions

Where is workitems.md located in the reverse-skill repository?

workitems.md resides in the case-specific directory at work/<case>/workitems.md, alongside scope.md and timeline.md. This location is established by the case initialization process documented in skills/ops/timeline-workitem.md and automated through skills/scripts/case-init.ps1.

What status values can a work-item have?

Work-items support five status values: pending (queued), in_progress (active), blocked (impeded), done (completed), and cancelled (deprioritized). Only items marked done are eligible for promotion to Evidence entries in the downstream workflow.

How does workitems.md integrate with evidence generation?

When a work-item reaches done status, it can be promoted to an Evidence entry as documented in skills/ops/evidence-finding-path.md. This Evidence then feeds into formal Findings and documented Paths, creating a traceable chain from initial task execution to final report delivery.

What is the Coverage checklist used for?

The Coverage checklist ensures all essential case phases complete without gaps. It verifies reconnaissance coverage, triage of critical findings, evidence validation, attack path documentation, timeline continuity, report export, and field journal completion before case closure.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}