Status template — investigating

Use when an issue is confirmed and the team is actively investigating. First public update on a new incident.

Title

<short noun phrase> — investigating

Examples:

“Elevated payout latency — investigating”
“Webhook delivery delays — investigating”
“Search degradation — investigating”

Avoid hedging (“possible”, “potential”) in the title. Either we have confirmed an issue or we have not.

Body

Plaza is investigating <a one-line description of the symptom>.

Affected: <surface or surfaces — e.g. "the payout pipeline", "the operator
console", "webhook delivery for events of type ...">.

What customers are seeing: <what the customer-facing impact looks like
from their side>.

What we are doing: <what the on-call is currently checking. Be specific
without leaking architecture detail. "Investigating elevated error rates
from the on-chain RPC provider" is good. "Looking into Postgres" is not.>

Next update: in <30 / 60> minutes.

SEV mapping

SEV-0: post within 15 minutes of acknowledgement. Update every 30 minutes.
SEV-1: post within 30 minutes of acknowledgement. Update every 60 minutes.
SEV-2: usually no public status entry; if escalated, follow SEV-1.
SEV-3: never public.

Notes

Tone per AESTHETIC.md §8. Quiet confidence; no exclamation marks; no apology.
Do not name the upstream provider in the public message unless the provider has already disclosed publicly.
Do not name customers, agents, or specific URNs in the public message.
The on-call engineer can post; double-check with the secondary on-call before posting an SEV-0 entry.