Project: stage an evidence-backed incident timeline

Last updated: 6 Oct 20265 min read

project

Extract time phrases and event order from incident updates, then ask a reviewer to resolve conflicts before a timeline is published.

Set the workflow

Incident responders need a sequence of deployment, alarm, rollback and recovery. Each source update has its own author, revision and timestamp. The service proposes event nodes with exact source spans, then edges with supporting text. It may display UNKNOWN order and unresolved local time. A reviewer accepts or corrects the staged timeline; model output never rewrites the source log.

Construct difficult cases

Include updates filed after midnight, cross-zone handoffs, “yesterday” statements, delayed reports and corrections that reverse an earlier claim. Add parallel incidents with similar service names so the extraction system cannot join unrelated events. Group all updates for one incident before splitting the audit. Time grounding handles relative phrases; event order handles partial relations.

Stage, validate and review

Extract candidate events and time phrases, resolve only those with sufficient anchors and check the strict-order graph for cycles. Flag a conflict with both evidence spans and source revisions. Show reviewer edits as an overlay rather than mutating the original claim. A corrected note invalidates derived event edges from the old revision. Keep one incident-scoped timeline version for rollback and reproducibility.

Measure release quality

Report missed critical events, wrong dates, reversed relations, unresolved count and reviewer time. A clean-looking timeline with an omitted rollback is worse than a clearly partial one. Shadow the system on recent incidents before using it for handoff reports. Access controls on the incident must carry through to every timeline node, quotation and cached view.

Implementation

def stage_timeline_edge(earlier, later, source_revision, cycle_check):
    if not source_revision:
        raise ValueError("source revision is required")
    if cycle_check(earlier, later):
        return {"state": "review", "reason": "ordering-conflict",
                "source_revision": source_revision}
    return {"state": "proposed", "earlier": earlier, "later": later,
            "source_revision": source_revision}

proposal = stage_timeline_edge("deploy-47", "alarm-82", "note-r7",
                               lambda earlier, later: False)
assert proposal["state"] == "proposed"

Performance and operating cost

The staging wrapper is O(1) apart from the supplied graph check, which can scan O(v + e) events and edges. Extraction and reviewer inspection dominate cost. Keep timeline edits scoped to one incident so a late correction does not require reprocessing the entire corpus, and measure wrong-order incidents rather than only edge throughput.

Common Mistakes

Publishing an extracted timeline without human review of conflicts.
Using the processing timestamp for every relative expression.
Merging events from incidents with similar wording.
Dropping the old note revision when an event is corrected.