Incident Timeline Reconstruction Capability Pack Skill

Knowledge Freshness

This capability pack is grounded in OpenTelemetry log and trace semantics, Google SRE postmortem guidance, and common observability platform docs verified on 2026-06-15. Vendor UIs and query languages change; prefer live telemetry sources over cached assumptions.

Retrieval Sources

• https://opentelemetry.io/docs/specs/semconv/general/logs/
• https://opentelemetry.io/docs/concepts/signals/traces/
• https://sre.google/sre-book/postmortem-culture/
• https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging
• https://docs.datadoghq.com/logs/explorer/analytics/

Source Verification Notes

Verified against public OpenTelemetry specification pages, Google SRE book postmortem guidance, and vendor observability documentation on 2026-06-15:

• OpenTelemetry defines log and trace signals with shared resource and span context fields useful for cross-signal correlation.
• Google SRE postmortem culture emphasizes blameless review, actionable items, and timelines grounded in evidence rather than narrative alone.
• Deploy and CI timestamps from GitHub Actions or release systems provide anchor points when service telemetry clocks are skewed.

Scope Note

This pack focuses on reconstructing an evidence-backed incident timeline for review and postmortem drafting. It complements log-parsing skills by adding deploy correlation, hypothesis tracking, and privacy-safe stakeholder output.

Core Workflow

1. Define the incident window, severity, customer impact scope, and data sources.
2. Collect anchor events: alerts, deploys, config changes, feature flags, and traffic shifts.
3. Build an ordered UTC timeline with one evidence link or query per row.
4. Correlate logs and traces using shared trace IDs, request IDs, and service names.
5. Separate verified facts from hypotheses; mark gaps and missing telemetry explicitly.
6. Assess blast radius, duration, and customer-facing symptoms with conservative wording.
7. Produce a privacy-safe stakeholder summary and an internal detailed appendix.

Capability Scope

• Incident window scoping and severity framing.
• Multi-signal timeline reconstruction.
• Deploy and config change correlation.
• Hypothesis tracking with supporting/contradicting evidence.
• Privacy-safe post-incident communication drafts.

Compatibility

Native

• Claude Code / Claude: use as an Agent Skill during incident review, postmortem authoring, or on-call handoff documentation.

Manual Adaptation

• Codex, Cursor, Windsurf, Generic AGENTS: apply the workflow as a deterministic checklist for any observability stack with logs and traces.

Required Inputs

• Incident ticket or chat channel with approximate start and mitigation times.
• Service map for affected components and dependencies.
• Access paths to logs, traces, metrics, deploy history, and alert timelines.
• Customer impact definition and external communication constraints.

Production Rules

• Use UTC timestamps in the canonical timeline; note local time only in footnotes.
• Never treat correlation as causation without independent confirmation.
• Flag missing telemetry instead of inventing intermediate events.
• Keep raw credential-bearing log lines out of shared documents.
• Separate customer-safe wording from internal root-cause detail.
• Capture follow-up items as measurable action tickets, not vague tasks.

Review Matrix

Output Contract

1. Incident summary with severity and customer impact scope.
2. Ordered UTC timeline with evidence references.
3. Hypothesis table with confidence notes.
4. Blast-radius and duration assessment.
5. Privacy-safe stakeholder draft plus optional internal appendix.

Troubleshooting

Issue: Log and trace timestamps disagree Fix: Normalize to UTC, check collector clock skew, and anchor on deploy or NTP-synced sources.

Issue: Missing spans for a critical request path Fix: Document sampling limits and supplement with load-balancer or gateway access logs.

Issue: Chat narrative conflicts with telemetry Fix: Prefer instrumented events; annotate human memory as unverified until confirmed.

Issue: Vendor query exports truncate fields Fix: Re-run narrower queries around anchor events instead of exporting wide windows.

Duplicate Check

Checked content/skills/, open PRs, and the live catalog for incident timeline workflows. log-parsing-incident-timeline focuses on parsing raw logs into timelines but does not provide deploy correlation, hypothesis tracking, review matrix, and privacy-safe stakeholder output as a reusable capability pack.

Editorial Disclosure

Submitted as an independent source-backed HeyClaude content entry by kiannidev. It is based on public OpenTelemetry, Google SRE, and observability vendor documentation. No paid placement, referral link, affiliate link, or vendor sponsorship is used.