reverse-skill/skills/ops/timeline-workitem.md

Timeline + WorkItem / Coverage

可回放作战记录（Z3r0 timeline 思想）+ 覆盖勾选（WorkItem 思想）。
全部落在 work/<case>/（仓库 gitignore），不进 skill 包正文。

目录约定

work/<case>/
  scope.md           # 契约（ops/scope-contract.md）
  timeline.md        # 追加写，禁止改历史条目
  workitems.md       # 工作项与覆盖
  evidence/          # 原始产物（截图、pcap、日志）
  notes/
  report/            # 最终报告草稿或拷贝

初始化：

powershell -File skills\scripts\case-init.ps1 -Hint "full pentest" -CaseName "acme-2026"

timeline.md 格式

每条记录 只追加：

## {ISO-8601} | {role} | {phase}
- action:
- command_or_ref:
- result_summary:
- artifacts: []      # relative paths under this case
- evidence_ids: []   # E-xxx when promoted
- next:

MUST NOT 删除或改写已有 ## 时间块（更正用新条目 + corrects: {timestamp}）。

workitems.md 模板

# Work Items

| ID | title | role | targets | surface | status | evidence | notes |
|----|-------|------|---------|---------|--------|----------|-------|
| WI-001 | Port scan edge | cie | {ip} | network | done | E-001 | |
| WI-002 | Auth bypass check | cpe | /api/login | web | blocked | | need creds |

status: pending | in_progress | blocked | done | cancelled

## Coverage
- [ ] Recon complete for in_scope assets
- [ ] Critical/High candidates triaged
- [ ] Validated findings have Evidence
- [ ] Path documented (attack/call/solve)
- [ ] Timeline continuous (no silent gaps >1 major phase)
- [ ] Report exported via docs-generator
- [ ] field-journal written (anonymized)

attack-chain / pentest 挂钩

Skill	MUST
attack-chain/	多阶段任务创建 case 目录；每阶段结束更新 workitems + timeline
pentest-tools/	每次工具跑批后至少 1 条 timeline；发现 → Evidence 草稿
其它 RE skill	建议 timeline；至少在出报告前补齐 Evidence 链

特色

• Agent 友好的纯文本，diff/review 友好
• 与 tool-index 命令路径可交叉引用
• 不依赖 WebSocket 直播；需要时把 timeline 贴进报告即可