Incident bundle format

A bundle is one JSON file holding the telemetry around an incident. Export it from your own systems, upload it on the home page, and Hindsight investigates it the same way it investigates the samples. Uploaded bundles are never graded, and nothing in them is sent to web search.

Build one from what you already have

The command line reads commits (with diffs) from each service's git repository and log lines from plain-text or JSON-lines files, covering the 24 hours before the incident:

python -m copilot bundle     --start 2026-10-01T10:00:00Z --end 2026-10-01T10:20:00Z     --repo api=../api --repo web=../web     --logs api=logs/api.log --logs web=logs/web.log     --services services.json --out incident.json

services.json maps each service to what it depends on, for example {"web": ["api"], "api": []}. Config changes, infrastructure events and traces can be added with --extra. Or write the file by hand:

Required

Key	What it holds
`service_graph`	Each service mapped to the services it depends on.
`services`	One entry per service: `name`, and optionally `status` and `error_rate_during_incident`.
`incident_window`	`start` and `end` as ISO 8601 timestamps.
`logs`	Each service mapped to a list of log lines: `id`, `timestamp`, `level`, `message`.

Optional, and worth including

Key	Fields per entry
`commits`	`hash`, `service`, `timestamp`, `author`, `message`, `diff`
`config_changes`	`config_id`, `service`, `timestamp`, `key`, `old_value`, `new_value`, `description`
`infra_events`	`event_id`, `timestamp`, `type`, `description`
`traces`	`trace_id`, `timestamp`, `spans` (each: `service`, `operation`, `duration_ms`, `status`, `error`)
`task_description`	One paragraph on what was observed. Shown as the incident brief.

Hindsight can only name a root cause that appears in commits, config_changes or infra_events, so include every change from the day before the incident. Prefix the IDs with commit-, cfg- and infra-.

Smallest working example

{
  "task_description": "Checkout returned 503s for 20 minutes.",
  "service_graph": { "web": ["db"], "db": [] },
  "services": [
    { "name": "web", "status": "degraded", "error_rate_during_incident": 41.0 },
    { "name": "db", "status": "down", "error_rate_during_incident": 96.5 }
  ],
  "incident_window": { "start": "2026-10-01T10:00:00Z", "end": "2026-10-01T10:20:00Z" },
  "logs": {
    "db": [
      { "id": "db-1", "timestamp": "2026-10-01T10:01:00Z", "level": "ERROR",
        "message": "FATAL: remaining connection slots are reserved" }
    ],
    "web": []
  },
  "config_changes": [
    { "config_id": "cfg-17", "service": "db", "timestamp": "2026-10-01T09:55:00Z",
      "key": "max_connections", "old_value": "400", "new_value": "40",
      "description": "Lowered max_connections during cost review" }
  ]
}