Incidents

Every note the investigator writes belongs to an incident: one run of trouble on one service. Later notes about the same trouble join it, and in Slack they arrive as replies in the incident’s thread.

The incident note

What is failing, in a sentence.
The likely cause, tied to the evidence.
The next step to take.
The evidence the agents read: the log lines, metrics, alerts and deploys behind the note.
A chart of the service’s errors, marked with its deploys.

Take it, resolve it

An incident is open (nobody is on it), on it (someone took it) or resolved.

Where	What you can do
Slack	I’m on it, Resolve, Reopen, and Worth raising or Not worth it. The message updates and its thread says who did it.
Console	The same buttons on Home and on the incident’s page.
Your coding agent	`mark_incident` with `on_it`, `resolved` or `open`.

A change in one place shows in the others. An incident someone is already on cannot be taken by someone else; the page says who has it.

The Incidents page

Incidents by state: open, someone on it, and the 20 latest resolved, each with who has it and for how long. An incident’s page holds the note, the evidence, the chart with deploys, the Slack message with its link, who was on it, and Was this worth raising?