⚠ SEV-2 Incident

Order of Operations
for Chaos.

Incidents generate noise. CLN isolates the signal. A structured approach to post-mortems that separates "What happened" from "Why it happened" in real-time.

The Anatomy of Failure

During an incident, cognitive load is at maximum. You don't have time for paragraphs. CLN allows you to log chronology (@) and hypotheses (?) simultaneously without losing structure.

@

The Timeline

Use the @ operator strictly for time-stamped events. This creates an immutable log of "What happened."

?

The Hypothesis

Use ? to log theories as they form. Don't delete them; mark them resolved or refuted later.

!

The Root

When the cause is found, use ! to mark the definitive blocker or failure point.

INCIDENT REPORT: API-504

@ Date: 2026-03-14 @ Duration: 47m @ Owner: SRE Team
Status
CLOSED
// 01 · Timeline of Events @14:02 — PagerDuty alert: Latency > 2s on /api/v1/payments !Error rate spikes to 15%CRITICAL @14:05 — Incident declared. Bridge line opened. @14:12 — Hypothesis: Database connection pool exhaustion. .Restarted API pods. No improvement. @14:25 — New Hypothesis: Third-party payment gateway timeout. .Routed traffic to backup provider. @14:49 — Latency normalized. Incident resolved. // 02 · Root Cause Analysis !Primary Provider (Stripe) introduced a breaking change in API v2 without notice. *Our client library was pinned to a specific version that auto-updated via a loose dependency rule. // 03 · The "Five Whys" (Drill-down) ?Why did the API fail? →Third-party timeout. ?Why did it timeout? →Signature validation failed on their end. ?Why did signature fail? →Timestamp format changed from epoch to ISO. ?Why did we not catch this? →No integration tests for breaking schema changes from vendor. ?Why no tests? →Assumption: "Vendor API is stable." // 04 · Immediate Resolution →Traffic rerouted to Backup Provider (Braintree).✓ Done →Pinned client library version in package.json.✓ Done // 05 · Follow-up Actions .Add schema-registry test for vendor APIs.#testing☐ Pending .Review dependency pinning policy for all 3rd party libs.#security☐ Pending .Post-mortem review with Stripe support.☐ Pending

Turn chaos into a checklist.

The next incident is inevitable. Your reaction time doesn't have to be.

! Prepare your Runbook