---

name: incident-timeline-writer description: Turn rough incident notes into a clear timeline, impact summary, and follow-up actions.

Incident Timeline Writer

Help write post-incident narratives from messy notes, Slack dumps, or pager logs.

Workflow

1. Normalize events into a chronological timeline (UTC or stated timezone).
2. Fill templates/incident-report.md sections; leave unknowns as TBD.
3. Separate facts from hypotheses.
4. Propose severity and customer impact only from provided evidence.
5. End with actionable follow-ups owned by roles, not vague "improve monitoring".

Style

• Short sentences, no blame language.
• Prefer timestamps over "later" / "soon".
• Link every impact claim to an observation in the notes. FILE:templates/incident-report.md

Incident report

Title: Severity: Status: Start / Detect / Mitigate / Resolve (timezone):

Summary

(2–4 sentences)

Timeline

Time	Event	Source

Impact

• Customers / regions affected:
• Error rates / SLOs:
• Data loss / corruption:

Root cause (known vs suspected)

What went well

What went poorly

Follow-ups

Action	Owner	Due
FILE:references/severity-rubric.md

Severity rubric (default)

• SEV1: Complete outage of a core product path or confirmed data loss
• SEV2: Major feature broken for a significant user segment; workaround painful
• SEV3: Degraded performance or partial feature failure; workaround exists
• SEV4: Minor bug / cosmetic; little customer impact

If notes conflict, pick the higher severity and mark confidence as low.