diff --git a/wizard-work/quill/incident-report-template.md b/wizard-work/quill/incident-report-template.md
new file mode 100644
index 0000000..5cf8585
--- /dev/null
+++ b/wizard-work/quill/incident-report-template.md
@@ -0,0 +1,28 @@
+# Incident Report Template
+
+## Incident ID: [YYYYMMDD-SEQ]
+## Severity: [SEV-1 | SEV-2 | SEV-3 | SEV-4]
+## Status: [Open | Investigating | Identified | Monitoring | Resolved]
+
+### Timeline (UTC)
+- HH:MM — Detection: how it was found.
+- HH:MM — Response: who was paged.
+- HH:MM — Mitigation: what stopped the bleeding.
+- HH:MM — Resolution: root cause confirmed and fixed.
+
+### Impact
+- Services affected: [list]
+- User impact: [count/region/segment]
+- Data loss: [yes/no + scope]
+
+### Root Cause
+One-sentence cause plus the mechanism that let it through.
+
+### Remediation
+1. Immediate fix applied.
+2. Follow-up tasks to prevent recurrence.
+
+### Lessons Learned
+- What broke.
+- What we missed.
+- What we will change.