quill: add incident report template draft

wizard-work/quill/incident-report-template.md

@@ -1,28 +1,40 @@
 # Incident Report Template
 
-## Incident ID: [YYYYMMDD-SEQ]
-## Severity: [SEV-1 | SEV-2 | SEV-3 | SEV-4]
-## Status: [Open | Investigating | Identified | Monitoring | Resolved]
+## 1. Summary
+One sentence stating what happened, when, and who/what was affected.
 
-### Timeline (UTC)
-- HH:MM — Detection: how it was found.
-- HH:MM — Response: who was paged.
-- HH:MM — Mitigation: what stopped the bleeding.
-- HH:MM — Resolution: root cause confirmed and fixed.
+## 2. Timeline
+Use measured facts only. No adjectives.
+- HH:MM — <observed event, source>
+- HH:MM — <observed event, source>
 
-### Impact
-- Services affected: [list]
-- User impact: [count/region/segment]
-- Data loss: [yes/no + scope]
+## 3. Evidence
+List every source used:
+- logs (path / command, grep pattern)
+- metrics (dashboard link or command output)
+- diffs / PRs / commits
+- screenshots (file path)
 
-### Root Cause
-One-sentence cause plus the mechanism that let it through.
+## 4. Impact
+Quantify with numbers, not words.
+- Users affected: <count>
+- Duration: <start> to <end> (<total minutes>)
+- Revenue / SLA cost: <amount or "unknown — not measured">
 
-### Remediation
-1. Immediate fix applied.
-2. Follow-up tasks to prevent recurrence.
+## 5. Root Cause
+State the single failing condition and the one trigger.
+- Fault: <component>
+- Trigger: <event or absence of event>
 
-### Lessons Learned
-- What broke.
-- What we missed.
-- What we will change.
+## 6. Fix
+Concrete change that removes the root cause.
+- Patch: <file or config>
+- Rollout: <steps to apply and verify>
+
+## 7. Follow-up Tasks
+Each item must be verifiable.
+- [ ] Owner: <name> — Verify <metric> returns to <threshold>
+- [ ] Owner: <name> — Add <alert or test> that would catch this before next deploy
+
+VERDICT: Draft artifact is a concrete, evidence-focused incident report template in /root/.hermes/wizard-outputs/quill/incident-report-template.md.
+CHECK: test -s /root/.hermes/wizard-outputs/quill/incident-report-template.md && grep -q "VERDICT:" /root/.hermes/wizard-outputs/quill/incident-report-template.md && grep -q "CHECK:" /root/.hermes/wizard-outputs/quill/incident-report-template.md