Incident timeline

Reconstruct what happened during an incident: read-only agents each work through one source of evidence, then one agent merges them into a single timeline with a likely cause. Nobody touches production.

warning

Investigation agents work on exported copies of logs and data, never on live systems. Tell every agent not to run commands against production hosts, databases or cloud accounts.

Gather the evidence

Export what you have into one folder and add it as a workspace:

~/incidents/2026-10-01-checkout/
  logs/        # app and proxy logs for the window
  metrics/     # CSV exports of the relevant dashboards
  deploys.txt  # deploys and config changes in the window

beswarm workspace add --name inc-checkout --path ~/incidents/2026-10-01-checkout

One agent per source

Start these from a terminal in the inc-checkout workspace:

beswarm agent start --name logs --agent claude --group incident \
  --prompt "Read-only. Incident: checkout errors 14:05–14:40 UTC. Go through logs/. Build a timeline of notable events with exact timestamps and log lines. Write to reports/logs.md."
beswarm agent start --name metrics --agent codex --group incident \
  --prompt "Read-only. Same incident. Go through metrics/. When did each metric first deviate, peak and recover? Write timestamps and values to reports/metrics.md."
beswarm agent start --name changes --agent gemini --group incident \
  --prompt "Read-only. Same incident. Go through deploys.txt and the code repo at ~/code/shop. Which changes landed in the 24 hours before 14:05? Summarize each with risk to checkout. Write to reports/changes.md."

Merge into one timeline

beswarm agent wait logs --until done,blocked --timeout 1800
beswarm agent wait metrics --until done,blocked --timeout 1800
beswarm agent wait changes --until done,blocked --timeout 1800
 
beswarm agent start --name timeline --agent claude --group incident \
  --prompt "Merge reports/logs.md, metrics.md and changes.md into reports/timeline.md: one chronological table (time, source, event), then the most likely cause with evidence, then open questions. Mark anything that is inference, not evidence." \
  --wait --timeout 1200

The timeline is the first draft of your postmortem. Check every claim against its source before you share it.

Then hand the fix to one agent in its own worktree, as in Bug hunt.