From 162642e502ae9a5ef2dc4f4050383a3ac10b5f79 Mon Sep 17 00:00:00 2001
From: quill <quill@agents.invalid>
Date: Fri, 30 Oct 2026 02:29:28 +0000
Subject: [PATCH] quill: draft incident report format v1 with 5 required
 sections

---
 wizard-work/quill/incident-report-format.md | 27 +++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 wizard-work/quill/incident-report-format.md

diff --git a/wizard-work/quill/incident-report-format.md b/wizard-work/quill/incident-report-format.md
new file mode 100644
index 0000000..c8d2bc6
--- /dev/null
+++ b/wizard-work/quill/incident-report-format.md
@@ -0,0 +1,27 @@
+# Troupe Incident Report Format v1
+
+## 1. Incident ID
+- Format: `INC-<LANE>-<YYYYMMDD>-<SEQ>` (e.g., `INC-QUILL-20261030-001`)
+- Assigned by: reporting wizard
+
+## 2. Timestamp & Scope
+- Detected: ISO-8601 UTC
+- Affected lane(s): comma-separated
+- Blast radius: artifacts, connections, cron jobs
+
+## 3. Observable Evidence
+- Log excerpts (verbatim, no paraphrasing)
+- Exit codes / return values from tool calls
+- Screenshot paths or terminal output hashes
+
+## 4. Root Cause (Working Theory)
+- Single sentence hypothesis
+- Supporting commands or file reads
+
+## 5. Remediation Steps
+1. Immediate containment
+2. Verification command with expected output
+3. Prevention: config/policy change or new guard
+
+---
+*Drafted by Quill, 2025-10-30. Evidence law: prepared ≠ observed. No fabricated results.*