"What changed?" is the first question
When something breaks, the first question in the incident channel is almost always the same: what changed? In a small team the answer is spread across CI logs, a chat thread about a hotfix and someone's memory of a config tweak made on Friday afternoon.
We looked at the incidents beta teams wrote up in Orvane over the summer. Roughly two thirds started within an hour of a deploy or a configuration change. Most of the rest were outside the team's control: a provider outage, an expired certificate, a DNS change.
Put changes and symptoms on one line
The fix isn't sophisticated tooling. It's putting deploys and failing checks on the same timeline, with times that line up. When the first alert comes in, the deploy eleven minutes earlier is right there, with its commit range and the person who shipped it.
Make marking a deploy free
A timeline is only useful if it's complete, so recording a deploy has to cost nothing: one command at the end of the pipeline, no extra step for people to forget. That's why the Orvane CLI is a single binary and the GitHub Actions step is three lines.