Create Incident Report

Overview

Create a structured incident report that can be used during a live incident for coordination or after resolution for post-mortem analysis. The report separates what happened (timeline) from why it happened (root cause) and what to do about it (action items), with clear severity definitions and impact quantification.

Workflow

1. Read project context — Check .chalk/docs/engineering/ for:

   • Architecture docs (to identify affected systems and dependencies)
   • Previous incident reports (to match format and learn from patterns)
   • Monitoring and alerting docs (to reference dashboards)
   • On-call and escalation procedures

2. Determine incident status — From $ARGUMENTS and conversation:

   • Active incident: The incident is ongoing. Create the report in real-time coordination mode with fields to fill as information becomes available. Mark unknowns explicitly.
   • Post-incident: The incident is resolved. Create a complete retrospective report.
   • Identify what is known so far: symptoms, affected systems, timeline, actions taken