Incident Postmortem

Incident Postmortem — Incident Post-Analysis Pipeline

An agent team collaborates to perform timeline reconstruction -> root cause analysis -> impact assessment -> remediation planning -> report generation.

Execution Mode

Agent Team — 5 members communicate directly via SendMessage and cross-validate each other.

Agent Composition

Workflow

Phase 1: Preparation (Performed directly by Orchestrator)

1. Extract from user input:
   • Incident Description: What happened and when
   • Evidence (optional): Logs, metric screenshots, chat records, alert records
   • Impact Information (optional): Number of affected users, services, duration
   • Actions Taken (optional): Emergency measures already performed
2. Create _workspace/ directory at the project root
3. Organize input and save to _workspace/00_input.md
4. If existing files are available, copy them to _workspace/ and skip the corresponding Phase
5. Determine execution mode based on the scope of the request (see "Modes by Task Scale" below)

Phase 2: Team Assembly and Execution

Tasks 2a (root cause) and 2b (impact) can be executed in parallel.

Inter-team Communication Flow:

• reconstructor completes -> delivers timeline and trigger candidates to investigator; delivers incident duration and metrics to assessor
• investigator completes -> delivers root cause and contributing factors to planner
• assessor completes -> delivers impact magnitude and SLA violation status to planner
• planner completes -> delivers full countermeasures to reviewer
• reviewer cross-validates all deliverables. Requests fixes for RED Must Fix items (up to 2 times)

Phase 3: Integrated Report Generation

1. Generate _workspace/postmortem_report.md integrating all deliverables
2. Report structure: Summary -> Timeline -> Root Cause -> Impact -> Remediation -> What Went Well -> Lessons Learned
3. Deliver the final report to the user

Modes by Task Scale

Leveraging Existing Files: If the user provides existing timelines, cause analyses, etc., copy the files to the appropriate location in _workspace/ and skip the corresponding agent's step.

Data Transfer Protocol

Error Handling

Test Scenarios

Normal Flow

Prompt: "Yesterday at 2 PM the payment service was down for 30 minutes. It happened right after a deployment and was recovered by rollback. Create a postmortem report." Expected Result:

• Timeline: Deployment -> incident start -> detection -> response -> rollback -> recovery in chronological order
• Root Cause: Specific defect in deployed code, contributing factors like no canary deployment
• Impact: User count, revenue loss, SLA impact estimates
• Remediation: SMART action items like canary deployment adoption, auto-rollback, alert improvements
• Integrated Report: Complete postmortem ready for executive reporting

Existing File Utilization Flow

Prompt: "Review this postmortem report" + report attached Expected Result:

• Copy existing report to _workspace/
• Execute in review mode
• Verify consistency, completeness, and blameless culture adherence
• Provide improvement suggestions

Error Flow

Prompt: "The API server was slow this morning. Analyze the cause." Expected Result:

• Collect incident details through additional questions (time, impact, actions, etc.)
• Execute RCA mode with collected information
• Clearly mark uncertain parts

Agent Extension Skills