Incident Postmortem

• You need to write a P1/P2/P3 or SEV-level incident report after a production outage or degradation event.
• You have rough notes from an incident and want them structured into a professional, blameless postmortem format.
• You need a consistent RCA document that can be shared with both technical engineers and non-technical leadership.
• Your team runs post-incident reviews and wants a structured format that enforces blameless language, real action item owners, and systemic gap analysis.

• You need a real-time incident runbook or on-call response guide — this skill is for post-incident documentation, not live response.
• The incident is still ongoing and unresolved; wait until detection, mitigation, and resolution details are available.

The skill uses passive and system-focused language throughout the timeline and root cause sections, explicitly avoiding blame-focused wording. The quality checklist flags any language that attributes fault to individuals rather than systemic gaps.

Produces a primary root cause statement in plain technical language, plus a list of contributing factors and an honest explanation of why existing safeguards failed — the core of a useful RCA.

Generates a timestamped timeline of events from first symptom through detection, escalation, hypothesis testing, fix, and resolution confirmation — including time gaps between key events.

Action items are categorized as Prevent Recurrence, Improve Detection, or Improve Response, with specific owners and due dates. Vague items like 'improve monitoring' are rejected in favor of testable, closeable tasks.

The executive summary is written for non-technical stakeholders with no jargon, while the technical sections provide depth for engineering teams — making the same document useful across the organization.

Every generated postmortem includes a self-review checklist covering timeline language, root cause specificity, action item completeness, and executive summary readability before the document is shared.

After a service goes down, paste your on-call notes and Slack thread into the skill. It structures them into a complete postmortem with a timeline, impact table, and root cause — ready to post to your incident management tool or wiki within minutes.

Leadership needs a briefing on a major incident. The skill generates a non-technical executive summary alongside the full technical document, so you send one report to the entire audience.

Use the 'What Went Well' and 'Lessons Learned' sections to drive a team retrospective. The structured format ensures the conversation covers both response improvements and knowledge worth sharing across teams.

When an incident breaches a customer SLA, the postmortem's impact table and communication log sections provide the structured evidence needed for customer-facing reporting and remediation tracking.