incident timeline audit derived

{
  "input": {
    "body": {
      "events": [
        {
          "at": "2026-09-30T02:10:00Z",
          "phase": "began",
          "description": "deploy of 1.4.0 begins"
        },
        {
          "at": "2026-09-30T02:55:00Z",
          "phase": "acknowledged",
          "description": "on call acknowledges"
        },
        {
          "at": "2026-09-30T03:02:00Z",
          "phase": "detected",
          "description": "alert fires"
        },
        {
          "at": "2026-09-30T04:35:00",
          "description": "rollback starts"
        },
        {
          "at": "2026-09-30T04:50:00Z",
          "phase": "resolved",
          "description": "error rate normal"
        }
      ],
      "targets": {
        "detect_minutes": 10,
        "resolve_minutes": 60,
        "acknowledge_minutes": 5
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxLines": 20000,
        "maxSpans": 10000,
        "maxFields": 500,
        "maxSamples": 20000,
        "maxFindings": 500,
        "maxJsonBytes": 2097152
      },
      "passed": false,
      "coherent": false,
      "complete": true,
      "findings": [
        {
          "code": "TIMESTAMP_WITHOUT_OFFSET",
          "detail": "events[3] has a time with no UTC offset. During an incident people write times in their own zone, and a timeline that mixes zones silently produces durations that are hours wrong."
        },
        {
          "code": "PHASE_MISSING",
          "phase": "mitigated",
          "detail": "No mitigated event is recorded, so the durations that depend on it cannot be derived."
        },
        {
          "code": "PHASES_OUT_OF_SEQUENCE",
          "phase": "acknowledged",
          "detail": "acknowledged is recorded 7 minutes before detected, which cannot have happened. One of the two times was backfilled, and every duration derived from them is fiction."
        }
      ],
      "last_event": "2026-09-30T04:50:00.000Z",
      "request_id": "example-request",
      "service_id": "incident_timeline_audit",
      "assumptions": [
        "A time with no UTC offset is reported rather than assumed, because during an incident people write times in their own zone and a timeline that mixes them silently produces durations hours wrong.",
        "A phase out of sequence is reported as a backfilled time rather than as an impossible event, because that is what it is, and every duration derived from it is fiction.",
        "The earliest event of a repeated phase is the one used, and the repetition is reported so the choice is visible."
      ],
      "event_count": 5,
      "first_event": "2026-09-30T02:10:00.000Z",
      "limitations": [
        "The events supplied. What happened in an unrecorded gap, and whether a recorded time is accurate, are outside this.",
        "coherent is true only when every phase is present, in sequence, and every target the caller supplied was met."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 6,
      "phases_recorded": [
        "began",
        "acknowledged",
        "detected"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "PHASE_MISSING": 1,
        "UNRECORDED_GAP": 1,
        "TARGET_EXCEEDED": 2,
        "PHASES_OUT_OF_SEQUENCE": 1,
        "TIMESTAMP_WITHOUT_OFFSET": 1
      },
      "total_span_minutes": 160,
      "largest_gap_minutes": 93,
      "time_to_detect_minutes": 52,
      "time_to_resolve_minutes": 160,
      "time_to_mitigate_minutes": null,
      "time_to_acknowledge_minutes": -7
    }
  }
}