# Incident timeline and postmortem

## Summary and impact

- Incident title / reference:
- Review date / author role:
- Status (ongoing, recovered, under review):
- Affected service alias / user-visible symptom:
- Impact start / end (timestamp with UTC offset):
- Scope and duration (observed / estimated / unknown):
- Evidence reference (sanitized; no private URLs or logs):

## Timeline

Use YYYY-MM-DDTHH:mm:ssZ for UTC, or an explicit offset such as +02:00.
Mark each entry Observed, Action, Hypothesis (unverified), or Unknown.
Do not invent timestamps; label approximate times and clock uncertainty.

- [timestamp + offset] | [type] | [observation or action] | [owner role] | [evidence reference]
- [timestamp + offset] | [type] | [observation or action] | [owner role] | [evidence reference]
- [timestamp + offset] | [type] | [observation or action] | [owner role] | [evidence reference]

## Recovery and validation

- Mitigation / action / owner role:
- Recovery check and observation window:
- Evidence of restored user-visible behavior:
- Remaining risk / rollback condition:

## Contributing factors and unknowns

- Confirmed factor and supporting evidence:
- Hypothesis (unverified) / supporting and contradicting observations:
- What evidence would confirm or reject it:
- Unknown / next investigation / owner role:
  Do not treat events happening together as proof of cause. Root cause may remain unknown.

## Follow-up evidence

- Action / owner role / due date:
- Measurable completion criterion / evidence reference:
- Verification result / reviewed date:
- Next review / unresolved questions:

Before sharing: remove credentials, hostnames, IP addresses, customer identifiers,
private links and raw logs. Use roles and service aliases. Review exports yourself;
this template does not detect or redact secrets.