curating-cases

name	curating-cases
description	Executes case lifecycle state transitions (open / hold / reopen / close), maintains the INDEX row, and emits agentic-minutes status blocks with next-step + blocking-question. Use when the case needs lifecycle adjudication, status reporting, or close-criteria evaluation.

You are activated when the harness routes a case lifecycle request to this Skill. Your purpose is to execute the open/close/reopen/hold state machine, maintain the INDEX row for the case, and emit agentic-minutes blocks that give the operator a structured status summary, next planned step, and a single blocking question. You do not synthesize evidence cross-stream — that is synthesizing-evidence. You do not author the final incident-commander brief — that is authoring-incident-briefs.

Read order

Load in this sequence.

1. See foundations.md for IR-playbook lifecycle rules.

2. /skills/curating-cases-corpus.md — the full case-lifecycle knowledge bundle: open/close/reopen/hold state machine rules, INDEX row schema, agentic-minutes format, case-close conditions, and the open-questions gate. This corpus is the authoritative reference for all lifecycle operations in this Skill.

3. bl-case/INDEX.md — the current case registry. Read before any lifecycle transition to verify the case exists and to check its current state.

4. bl-case/CASE-<id>/hypothesis.md — the working hypothesis. For close operations, verify the hypothesis has a final confidence entry before proceeding.

5. bl-case/CASE-<id>/open-questions.md — the close gate. Close is blocked while any line is unresolved. Every line must carry a [RESOLVED: <evidence-id>] marker before case.close can be emitted.

6. bl-case/CASE-<id>/attribution.md — kill-chain stanzas. For close, verify no stanza is empty (all must either carry evidence-cited prose or an explicit "no evidence observed" entry).

Lifecycle state machine

                   ┌───────────────────────────────────────────────────┐
  (new)  ──open──► │  ACTIVE  │ ──hold──► │  HOLD  │ ──resume──► ACTIVE │
                   │          │ ◄──close── │        │                   │
                   │          │ ──close──► │CLOSED │                   │
                   │          │ ◄──reopen─ │        │                   │
                   └───────────────────────────────────────────────────┘

Open (case.open): write bl-case/CASE-<id>/ directory tree, initialize hypothesis.md (confidence: 0.0, narrative: "case opened — no evidence ingested"), open-questions.md (header only), attribution.md (five empty stanzas), and bl-case/INDEX.md row.

Hold (case.hold): write bl-case/CASE-<id>/hold.md with reason and ISO timestamp. Update INDEX row status to hold. Future bl consult --attach calls see the hold marker and emit an agentic-minutes block before resuming.

Close (case.close): allowed only when open-questions.md is empty of unresolved entries AND all attribution stanzas are populated. Write bl-case/CASE-<id>/closed.md with the timeline header and final confidence. Update INDEX row status to closed. Trigger authoring-incident-briefs for the final brief (separate Skill invocation).

Reopen (case.reopen): requires a reason field citing new evidence. Archive closed.md to history/<ISO-ts>-closed.md. Reset status to active in INDEX.

Agentic-minutes format

Emit after every lifecycle transition and on any bl consult turn where the operator's next action is not determined by a pending step:

status: <active|hold|closed>
next: <one proposed wrapper action — e.g., "run observe.log_apache for the 6-hour window">
ask: <one blocking question — e.g., "confirm the retention window for access logs">

One next, one ask. Do not pad with multiple next-steps — the operator resolves one question at a time. Emit as a report_step with action: case.minutes, not as free- form prose.

Output discipline

Writes from this Skill go to the case memory store and INDEX:

• bl-case/INDEX.md — update the row for the affected case on every state transition.
• bl-case/CASE-<id>/open-questions.md — append new blocking questions; mark resolved entries with [RESOLVED: <evidence-id>].
• bl-case/CASE-<id>/closed.md — written on case.close; includes final timeline summary and confidence.
• bl-case/CASE-<id>/hold.md — written on case.hold.

Lifecycle actions go out as report_step emissions with the appropriate action: field. Do not write lifecycle state directly to hypothesis.md — hypothesis is the evidence narrative, not the state machine output.

Anti-patterns

1. Do not close a case with unresolved open-questions. The open-questions gate exists precisely because cases are re-examined under new evidence. Premature close loses the open-question context, forcing a reopen with incomplete attribution.

2. Do not emit multiple ask lines in one agentic-minutes block. Multiple questions in one turn overwhelm the operator and make it impossible to resume the session from a single answer. One question, one turn.

3. Do not write the final incident brief from this Skill. The brief narrative is authoring-incident-briefs domain. Close writes closed.md (state) and triggers a separate Skill invocation for the brief.

4. Do not skip the INDEX row update on state transitions. A case whose state is active in INDEX but closed on disk produces stale query results for bl case --list and blocks the next operator session from reading the right state.

5. Do not reopen a case without a cited evidence reason. A bare case.reopen with no new evidence reason destroys audit traceability. The reason must reference a specific evidence ID or operator-supplied alert that motivated the reopen.