engineer-postmortem

What it does and when to use it

Turn raw incident notes (chat logs, timelines, alerts) into a blameless postmortem with an ISO UTC timeline, root causes, the closest public outage precedent and owned action items that each carry a revisit trigger. Use when asked to "write the postmortem", "turn these notes into an incident review", "RCA for this outage" or "postmortem action items".

Triggers from the description

How it works

SKILL.md has no level-two headings · 25 lines, 205 words

---
name: engineer-postmortem
description: 'Turn raw incident notes (chat logs, timelines, alerts) into a blameless postmortem with an ISO UTC timeline, root causes, the closest public outage precedent and owned action items that each carry a revisit trigger. Use when asked to "write the postmortem", "turn these notes into an incident review", "RCA for this outage" or "postmortem action items".'
license: MIT
metadata:
  plugin: twistor-engineer
  version: 1.1.0
  summary: 'Incident notes in, blameless postmortem with owned, triggered action items out.'
---

# Engineer postmortem

Fill in `../reliability-incident-response/references/postmortem-template.md` (a sibling skill
folder). Read `../reliability-incident-response/references/case-studies.md` only to match this
incident to a known pattern.

1. **Gather.** If a path was given, read it. If the notes are thin, list what is missing (start and
   end time, detection source, customer impact, the triggering change) and ask once. Then proceed,
   marking unknowns as `unknown`.
2. **Timeline** in ISO 8601 UTC, one event per line, from first trigger to all-clear. Separate
   detection, mitigation and resolution times.
3. **Root causes**, plural. Name the trigger and the conditions that let it spread (no staged
   rollout, no validation of generated input, no kill switch, retries without jitter). Systems and
   processes, never people.
4. **Precedent.** Name the closest public incident from the case studies and the shared lesson,
   with its source link. If none fits, say so.
5. **Action items.** Each has an owner role, priority, the ceiling it raises (what failure it now
   prevents or contains) and a revisit trigger. Flag any item without a trigger `no-trigger`.
   Prefer items that prevent a class of failure over one-off fixes.
6. **Write** to `postmortems/<YYYY-MM-DD>-<slug>.md` in the current repo unless the user named
   another place, then print the path and the action-item table.

Tone: plain, factual, blameless.

Versions

The database has no other skills named engineer-postmortem.

Database snapshot: 13.11.2026 · package version 0e17bd911a62 (SHA-256 digest of the entire package)

Downloads in the last 30 days: 0 · ranking

Report a problem with this skill: harmful content, incorrect descriptions or an author’s removal request.

Similar skills

• 100incident-postmortem
  Write a blameless postmortem from incident notes, chat logs, alerts and deploy history, with a UTC timeline, impact numbers, root cause and contributing factors, and owned, dated action items. Use after an outage or security incident is resolved, when the user shares incident…
• 90incident-postmortem
  Write a blameless postmortem or incident report from logs, alerts, chat transcripts, tickets and notes. Use when the user says "write the postmortem", "incident report", "RCA", "what happened during the outage", or pastes an incident timeline or Slack thread.
• 90incident-postmortem
  Facilitates blameless incident postmortems by reconstructing a precise timeline, identifying root cause and contributing factors, and producing tracked, owned action items. Use this skill when an incident, outage, SEV, or production failure has been resolved and someone needs to…
• 100postmortem-writing
  Writes blameless postmortems with root cause analysis, incident timelines, contributing factors, and action items. Use when conducting incident reviews or when the user mentions postmortem, root cause analysis, or blameless review.
• 100incident-postmortem
  Facilitates blameless incident postmortems by reconstructing an accurate timeline from logs, alerts, deploys and chat, analyzing contributing factors, and producing owned, measurable action items. Use after an outage, production incident, data issue or near miss, or when the…
• 100incident-postmortem
  Write a blameless postmortem after a production incident is resolved. Use for an RCA, or when the user says postmortem/RCA/writeup. Produces timeline, 5-whys root cause, and tracked action items.