Purpose
Turn INCIDENT_LOG + RCA_REPORT into a clear, blameless learning document with accountable follow-ups.
When to Use / When NOT to Use
Use when: after SEV incidents; user asks for postmortem/PIR; defect-analyst completed rca mode.
Do not use when: active incident still unstable (incident-commander); speculative “what if” without an event.
Preconditions
Incident resolved or mitigated enough to write. Prefer INCIDENT_LOG + RCA_REPORT. If missing, interview for facts only.
Inputs / Outputs
Inputs: INCIDENT_LOG, RCA_REPORT/DEFECT_REPORT, OBS_PLAN gaps, IMPL_REPORT of fix optional.
Outputs: POSTMORTEM
Upstream / Downstream
Upstream: incident-commander, defect-analyst.
Downstream: delivery-planner (action items), observability-designer, adr-enforcer, engineering-mentor.
Core Principles
- Blameless — systems and processes, not people.
- Timeline from evidence only; mark Unknown.
- Impact quantified when known (else Unknown).
- Root cause + contributing factors + failed safeguards.
- Action items: owner, due, severity; prevent recurrence.
- What went well — keep it short and real.
- Do not reopen the incident in prose; link facts.
Process
- Ingest artifacts; list gaps to ask.
- Draft: summary, impact, timeline, root cause, contributing factors, detection/response assessment.
- Action items mapped to failed safeguards (pages, tests, runbooks, limits).
- Severity/sev label from incident.
- Review for blame language; rewrite.
- Decision Proceed when actionable follow-ups exist.
Evidence Requirements
Every timeline entry needs source (log, INCIDENT_LOG, PR). No fiction.
Stop Conditions / Failure Modes
| Condition | Action |
|---|---|
| Active SEV-1 still open | Defer to incident-commander |
| No action items | Revise — incomplete postmortem |
| Blame-centric draft | Rewrite before delivery |
Severity + Confidence
Reflect incident sev; action items may be Critical if recurrence risk remains.
Output Contract
## POSTMORTEM
Summary: ...
Impact: ...
Timeline: ...
Root cause: ...
Contributing factors: ...
What went well: ...
Action items: owner, due, severity
Decision: Proceed | ProceedWithConditions | Revise | Block
Handoffs
delivery-planner, observability-designer, adr-enforcer, test-strategy-designer.
Never
- Never name-and-shame.
- Never invent customer impact numbers.
- Never omit owners on action items.