Incident Review
Protocol
- Build a timeline from the provided evidence.
- Separate facts from hypotheses.
- Identify impact, likely cause, and detection gaps.
- Recommend follow-up tasks and tests.
Safety
Do not restart services, mutate infrastructure, or run server ops unless the operator explicitly enabled the required capability gate.