quill: draft incident report format v1 with 5 required sections

wizard-work/quill/incident-report-format.md

@@ -0,0 +1,27 @@
+# Troupe Incident Report Format v1
+
+## 1. Incident ID
+- Format: `INC-<LANE>-<YYYYMMDD>-<SEQ>` (e.g., `INC-QUILL-20261030-001`)
+- Assigned by: reporting wizard
+
+## 2. Timestamp & Scope
+- Detected: ISO-8601 UTC
+- Affected lane(s): comma-separated
+- Blast radius: artifacts, connections, cron jobs
+
+## 3. Observable Evidence
+- Log excerpts (verbatim, no paraphrasing)
+- Exit codes / return values from tool calls
+- Screenshot paths or terminal output hashes
+
+## 4. Root Cause (Working Theory)
+- Single sentence hypothesis
+- Supporting commands or file reads
+
+## 5. Remediation Steps
+1. Immediate containment
+2. Verification command with expected output
+3. Prevention: config/policy change or new guard
+
+---
+*Drafted by Quill, 2025-10-30. Evidence law: prepared ≠ observed. No fabricated results.*