What problem does it solve? After an incident is resolved, teams often skip the postmortem or write one that blames individuals, lists vague action items, and gets forgotten — so the same incident recurs. This Skill structures the post-incident review so the learning is captured and the follow-through actually happens. ## Core Features & Use Cases - Artifact-based timeline reconstruction: Builds the timeline from alerts, deploys, chat logs, and dashboards, including the detection gap and decision points, rather than relying on memory. - Contributing factor analysis: Replaces "root cause: human error" with 3-6 system-level factors covering the trigger, missed defenses, slow detection, and slow mitigation. - Actionable follow-through: Enforces owned, ticketed, dated action items split into prevent/detect/mitigate, plus a class-sweep ("where else does this pattern exist?") and a 30-day completion review. - Use Case: After a 31-minute checkout outage caused by a bad config push, use this Skill to produce a postmortem that identifies four systemic factors (no schema validation, no config canary, late alerting, undocumented rollback) and four ticketed action items verified complete 30 days later. ## Quick Start Write the postmortem for yesterday's checkout outage using the incident timeline from our Slack channel and deploy logs.
