Reconstruct an Incident Timeline: UTC Milestones, Evidence and Owned Actions
Normalize authorized event records, calculate intervals from explicit milestones and preserve reports and hypotheses. Build a replayable review without inventing a root cause or contacting participants.
Fastest way
Ask your AI to do it
Paste this into the AI agent you already use:
Use Incident Replay Studio to reconstruct my authorized event export with original offsets, source rows and evidence IDs. Review four explicit milestones, calculate exact intervals and distinguish observed, reported and hypothesis records. Keep unknown causes visible, define owned follow-ups and verify actual delivery hashes. Ask before assuming a missing timezone; do not contact people, change production, infer losses or certify source truth.
What can Incident Replay Studio establish from an export?
Incident Replay Studio v1.0.0 turns an authorized events CSV, reviewed brief and local text evidence into an offline incident room, normalized timeline, review Markdown and owned action CSV. The individual package costs USD 4.99 and runs with Python 3.10+ standard library only. No incident-management account, paid API or dependency installation is required.
The workflow reconstructs what supplied records say; it does not prove them true. Preserve observed, reported and hypothesis status. An integrity hash does not verify the source account, root cause, customer count, SLA breach or business loss. Use a separate debugging workflow for reproducing or repairing code.
Preserve source rows, timezone offsets and evidence IDs
Read references/input.md. Supply at most 2000 UTF-8 event rows in a CSV up to 2 MiB with the required columns below, in any order. IDs must be unique. Timestamps need seconds and Z or an explicit offset; do not infer a missing offset from the computer clock. The builder preserves original timestamps and row numbers while sorting UTC instants; tied instants retain source order.
The brief specifies four milestone event IDs, a cause statement with hypothesis/reviewed status, local evidence references and actions. Each action needs an owner, valid due date, acceptance check and supporting event. Owner and date fields are authored planning data: they do not contact a person, obtain consent or schedule a reminder. Keep supplied evidence paths inside the brief directory.
id,timestamp,service,phase,status,summary,evidence_idRun Relay and reconcile the actual milestone arithmetic
From the complete installed package, generate a fresh fictional practice room and run its file verifier. Open incident-room/index.html. Relay has 12 events and an authored checkout interruption; its people, impact and source log are fictional. Do not reuse its old practice due dates as a current operational plan.
| Interval | UTC endpoints | Expected duration |
|---|---|---|
| Impact to detection | 09:00 → 09:04 UTC | 4 minutes |
| Detection to mitigation | 09:04 → 09:15 UTC | 11 minutes |
| Impact to resolution | 09:00 → 09:24 UTC | 24 minutes |
python3 scripts/quickstart.py --preset relay --output ./incident-room
python3 scripts/verify-delivery.py ./incident-roomFollow a timeline event back to its copied source
Select the detection event, inspect its original 11:04+02:00 timestamp, normalized 09:04Z instant and source row 4, then open the copied evidence. Replay the sequence and filter hypotheses. A filtered view does not recalculate milestone durations or certify a cause. The full event span can include notes before impact or after recovery and need not equal the impact duration.
Milestones must have matching impact/detected/mitigated/resolved phases, chronological order and observed or reported status. A hypothesis cannot define a milestone. Reported milestones remain reported. Review these source choices before presenting any duration as an incident metric.
Generate a new review after changing the brief or events
Use the loopback-only studio below for CSV import, brief editing and real fresh deliveries. It starts with exercise evidence and prints its local URL; Ctrl+C stops it. For your own evidence files, keep authorized text beside the brief and use the CLI build command. The studio does not upload private evidence to a remote service.
python3 scripts/start-studio.py --output ./incident-studio
# For your reviewed source files:
python3 scripts/build-replay.py --input ./brief.json --events ./events.csv --output ./review-02Keep uncertain causes and failed input checks visible
An input with a missing offset, unknown evidence, a hypothesis milestone or reversed milestone order must fail without creating a delivery. Only add assumeOffset after the source owner explicitly confirms the intended offset; retain its affected-row annotations. Never silently repair a timezone to make a desired duration appear.
Deliver the matching room, incident.json, timeline.json, original/normalized CSVs, review.md, actions.csv, copied evidence, handoff and manifest. Rebuild an edited brief beside its evidence into a fresh folder. verify-delivery.py checks bytes and inventory, not factual truth or correctness of the proposed cause. Record remaining reproduction, policy and stakeholder review before operational changes.
Reproduce a suspected defect with before-and-after evidence
Turn recurring handoff failures into an owned service blueprint