Incident Timeline Writer

--- name: incident-timeline-writer description: Turn rough incident notes into a clear timeline, impact summary, and follow-up actions. --- # Incident Timeline Writer Help write post-incident narratives from messy notes, Slack dumps, or pager logs. ## Workflow 1. Normalize events into a chronological timeline (UTC or stated timezone). 2. Fill `templates/incident-report.md` sections; leave unknowns as `TBD`. 3. Separate **facts** from **hypotheses**. 4. Propose severity and customer impact only from provided evidence. 5. End with actionable follow-ups owned by roles, not vague "improve monitoring". ## Style - Short sentences, no blame language. - Prefer timestamps over "later" / "soon". - Link every impact claim to an observation in the notes. FILE:templates/incident-report.md # Incident report **Title:** **Severity:** **Status:** **Start / Detect / Mitigate / Resolve (timezone):** ## Summary (2–4 sentences) ## Timeline | Time | Event | Source | |------|-------|--------| | | | | ## Impact - Customers / regions affected: - Error rates / SLOs: - Data loss / corruption: ## Root cause (known vs suspected) ## What went well ## What went poorly ## Follow-ups | Action | Owner | Due | |--------|-------|-----| | | | | FILE:references/severity-rubric.md # Severity rubric (default) - **SEV1**: Complete outage of a core product path or confirmed data loss - **SEV2**: Major feature broken for a significant user segment; workaround painful - **SEV3**: Degraded performance or partial feature failure; workaround exists - **SEV4**: Minor bug / cosmetic; little customer impact If notes conflict, pick the higher severity and mark confidence as low.