myoung34/dotfiles/incident-report

# {Incident Title}
 
-**Date:** {date +%F}
-**Author:** {git config user.name}
-**Severity:** {SEV1–4 or your scale — state the scale}
-**Status:** {Investigating | Mitigated | Resolved}
-**Service:** {customer-facing service affected}
-**Customer(s):** {impacted customers/tenants, or "all"}
 
## Summary
 
{What broke and the customer-visible effect — one paragraph.}
 
## Timeline
 
All times UTC.
 
| Time      | Event                                        |
| --------- | -------------------------------------------- |
| {ts}      | Incident began (first bad behaviour)         |
| {ts}      | Detected ({how — alert, customer report})    |
| {ts}      | Mitigated ({what stopped the bleeding})      |
| {ts}      | Resolved                                     |
 
## Impact
 
{Who was affected, how many, for how long. Data loss? Correctness?
Availability? Quantify where the session gives numbers.}
 
## Root Cause
 
{The underlying cause, not the symptom. One subsection per distinct
cause if there are several.}
 
### Evidence
 
{Logs, HAR captures, metrics that pin the cause — in fenced `txt`
blocks with timestamps. Quote the exact error strings.}
 
### Affected Code
 
-`path/to/file.go:LINE` — {what this does in the failure}
 
## Remediation
 
### Mitigation (short-term)
 
{What was or should be done immediately to stop customer impact —
rollback, feature flag, rate limit, config change.}
 
### Long-term Fix
 
{The durable fix that prevents recurrence — code change, concurrency
guard, schema change. Link to a plan if one exists:
`docs/plans/...`.}
 
### Prevention
 
{Detection, tests, or process gaps that let this reach customers —
missing alert, absent integration test, no canary. What closes them.}
 
## Notes & Caveats
 
-{Open questions, unrelated findings, unverified assumptions.}