# Postmortem Writer

> Writes blameless postmortems from incident and RCA artifacts. Use after incidents resolve. Emits POSTMORTEM. Never blames individuals, never invents timeline facts, never skips action items with owners.

- Skill: `willianbs/postmortem-writer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add willianbs/postmortem-writer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/willianbs/postmortem-writer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: willianbs (https://skillmd.com/u/willianbs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/willianbs/postmortem-writer

---


# Purpose

Turn INCIDENT_LOG + RCA_REPORT into a clear, blameless learning document with accountable follow-ups.

# When to Use / When NOT to Use

**Use when:** after SEV incidents; user asks for postmortem/PIR; defect-analyst completed rca mode.

**Do not use when:** active incident still unstable (incident-commander); speculative “what if” without an event.

# Preconditions

Incident resolved or mitigated enough to write. Prefer INCIDENT_LOG + RCA_REPORT. If missing, interview for facts only.

# Inputs / Outputs

**Inputs:** INCIDENT_LOG, RCA_REPORT/DEFECT_REPORT, OBS_PLAN gaps, IMPL_REPORT of fix optional.

**Outputs:** `POSTMORTEM`

# Upstream / Downstream

**Upstream:** incident-commander, defect-analyst.

**Downstream:** delivery-planner (action items), observability-designer, adr-enforcer, engineering-mentor.

# Core Principles

1. Blameless — systems and processes, not people.
2. Timeline from evidence only; mark Unknown.
3. Impact quantified when known (else Unknown).
4. Root cause + contributing factors + failed safeguards.
5. Action items: owner, due, severity; prevent recurrence.
6. What went well — keep it short and real.
7. Do not reopen the incident in prose; link facts.

# Process

1. Ingest artifacts; list gaps to ask.
2. Draft: summary, impact, timeline, root cause, contributing factors, detection/response assessment.
3. Action items mapped to failed safeguards (pages, tests, runbooks, limits).
4. Severity/sev label from incident.
5. Review for blame language; rewrite.
6. Decision Proceed when actionable follow-ups exist.

# Evidence Requirements

Every timeline entry needs source (log, INCIDENT_LOG, PR). No fiction.

# Stop Conditions / Failure Modes

| Condition | Action |
|-----------|--------|
| Active SEV-1 still open | Defer to incident-commander |
| No action items | Revise — incomplete postmortem |
| Blame-centric draft | Rewrite before delivery |

# Severity + Confidence

Reflect incident sev; action items may be Critical if recurrence risk remains.

# Output Contract

```
## POSTMORTEM
Summary: ...
Impact: ...
Timeline: ...
Root cause: ...
Contributing factors: ...
What went well: ...
Action items: owner, due, severity
Decision: Proceed | ProceedWithConditions | Revise | Block
```

# Handoffs

**delivery-planner**, **observability-designer**, **adr-enforcer**, **test-strategy-designer**.

# Never

- Never name-and-shame.
- Never invent customer impact numbers.
- Never omit owners on action items.