Incident Postmortem Builder
When to invoke
- "Write the postmortem for INC-1234."
- "Draft a blameless postmortem from this Slack timeline."
- "Compute MTTD/MTTR for the May 3 outage."
Inputs needed
- Incident ID / title
- Timeline source — Slack export, PagerDuty incident, or a CSV (timestamp,event,actor)
- Impact data — affected services, % users, revenue impact (if known)
- Detected at / mitigated at / resolved at
Workflow
- Build timeline — normalize timestamps, attach actors and sources.
- Compute metrics — TTD, TTM, TTR, customer-minutes lost.
- Five-whys + contributing factors — guided prompts; never blame people.
- Action items — each must have owner, due date, type (prevent / detect / mitigate).
- Render — Markdown postmortem ready for the doc.
Output format
Standard SRE postmortem: Summary, Impact, Timeline, Detection, Response, Root cause, Contributing factors, What went well, What went wrong, Action items.
Guardrails
- Blameless language — describe systems and decisions, never individuals.
- Every action item MUST have owner + due date + type.
- TTR/TTM/TTD must be computed from timestamps, never approximated.
Reference code
build.py ingests a timeline CSV (or Slack export JSON) and renders the postmortem.
1---2name: incident-postmortem-builder3description: Use after a production incident to build a blameless postmortem. Pulls timeline from PagerDuty/Slack/observability, computes MTTD/MTTR, drafts impact, root cause, contributing factors, and action items.4---56# Incident Postmortem Builder78## When to invoke9- "Write the postmortem for INC-1234."10- "Draft a blameless postmortem from this Slack timeline."11- "Compute MTTD/MTTR for the May 3 outage."1213## Inputs needed141. **Incident ID / title**152. **Timeline source** — Slack export, PagerDuty incident, or a CSV (timestamp,event,actor)163. **Impact data** — affected services, % users, revenue impact (if known)174. **Detected at / mitigated at / resolved at**1819## Workflow201. **Build timeline** — normalize timestamps, attach actors and sources.212. **Compute metrics** — TTD, TTM, TTR, customer-minutes lost.223. **Five-whys + contributing factors** — guided prompts; never blame people.234. **Action items** — each must have owner, due date, type (prevent / detect / mitigate).245. **Render** — Markdown postmortem ready for the doc.2526## Output format27Standard SRE postmortem: Summary, Impact, Timeline, Detection, Response, Root cause, Contributing factors, What went well, What went wrong, Action items.2829## Guardrails30- Blameless language — describe systems and decisions, never individuals.31- Every action item MUST have owner + due date + type.32- TTR/TTM/TTD must be computed from timestamps, never approximated.3334## Reference code35`build.py` ingests a timeline CSV (or Slack export JSON) and renders the postmortem.
sisodiabhumca