Case Files

Case awareness — the file grows up (v0.3.0e — Build 2, #199)

The manifest carries the fields an investigation actually triages by: a one-line summary (it makes the case list scannable, and it is the first thing Navi reads), a type (incident / investigation / research / hunt / locate), a priority, freeform tags, an owner, related case slugs, and — when a case closes — a closed date with a one-line outcome. Older cases read with safe defaults; nothing already filed changes meaning. A case can be marked sensitive: through the DHD door its list entry shows as present-and-sensitive with its counts, but its name, summary, client and scope stay home, and Sync's case index badges it as sensitive.

Four registers ride in the case folder as plain markdown, in the timeline's own idiom: entities.md (the cast — people, orgs, accounts, systems, places, each with its role), observables.md (the IOC register — IPs, domains, URLs, hashes, files, wallets), evidence.md (the custody register, below), and tasks.md (next steps — Navi proposes, you check off). Being plain files in the folder, they ride Sync, backups and DHD exactly as the rest of the case does. The observables register is also the Wire's case-terms source: matching reads the values an investigator actually wrote down — observables, entity names, tags — not words scraped from the manifest.

Evidence has a chain of custody now. When a file is filed as evidence, the bridge computes its SHA-256 at filing time and writes its register entry in the same act — description, when/from/how it was acquired, and a custody note. Files filed before the register existed are backfilled on first sight, and the entry says so honestly: the hash is the file's hash as found, its acquisition unrecorded.

Navi logs as she sees it. In a case's own chat — only there — she may end a reply with a structured log block naming the new, specific, checkable details the work surfaced: entities, observables, events, leads, tasks. The block never renders; the bridge parses, validates, dedupes and writes it — she never edits files. Everything she logs lands unverified (state: lead), badged LOGGED BY NAVI with its provenance (the message it answers, the timestamp). Findings carry the same state: yours default to confirmed, hers to lead. One tap promotes or strikes an unverified entry in the case view; a strike removes the entry and notes the strike in the timeline — an audit trail, not a memory hole. Her own case brief labels the states back to her: she may reason from leads, never cite them as established. Caps keep a talkative turn from flooding the file: at most six log entries and two findings per reply. A detail belonging to a different case is flagged on her message in chat, never written across.

Awareness flows in. A Wire story or a KEV CVE matching one of the case's observables or entities is surfaced two ways: in the case chat, the matched records ride her context named as matches, not findings; in the case view, a Wire matches card badges them the same way. A match is a lead to check — the product never promotes it to a finding on its own.