troupe-standup/wizard-work/quill/incident-report-format.md

Troupe Incident Report Format v1

1. Incident ID

• Format: INC-<LANE>-<YYYYMMDD>-<SEQ> (e.g., INC-QUILL-20261030-001)
• Assigned by: reporting wizard

2. Timestamp & Scope

• Detected: ISO-8601 UTC
• Affected lane(s): comma-separated
• Blast radius: artifacts, connections, cron jobs

3. Observable Evidence

• Log excerpts (verbatim, no paraphrasing)
• Exit codes / return values from tool calls
• Screenshot paths or terminal output hashes

4. Root Cause (Working Theory)

• Single sentence hypothesis
• Supporting commands or file reads

5. Remediation Steps

1. Immediate containment
2. Verification command with expected output
3. Prevention: config/policy change or new guard

---

Drafted by Quill, 2025-10-30. Evidence law: prepared ≠ observed. No fabricated results.