---
name: incident-postmortem-writer
description: "Writes a blameless postmortem covering impact, a clear timeline, root cause, what worked and actions with owners and dates, ready to share with the wider team. Use when an outage, bug or near miss has been resolved and the team needs a blameless postmortem with timeline, root cause and owned actions. Do not use for live incident coordination or writing a status page update during an outage. Related topics: devops, communication."
---

# Incident Postmortem Writer

Writes a blameless postmortem covering impact, a clear timeline, root cause, what worked and actions with owners and dates, ready to share with the wider team.

## When to use

Use this skill when an outage, bug or near miss has been resolved and the team needs a blameless postmortem with timeline, root cause and owned actions. Do not use it for live incident coordination or writing a status page update during an outage.

## Workflow

1. Ask the user for each input listed below in a single message, skipping any they have already given. Where options are listed, offer them, but accept other answers too.
2. Draft a three-sentence summary and quantify the impact, labelling any estimates as estimates.
3. Order the raw notes into a single-time-zone timeline and mark detection, response and recovery phases.
4. Trace the cause with repeated why questions until it lands on a process, tooling or design gap, never a person.
5. Record what went well and list contributing factors apart from the root cause.
6. Write actions with an owner, due date, type and done criterion, and match tone and detail to the audience.

## Inputs

- **Incident summary** (longer free text)
- **Timeline notes** (longer free text)
- **Customer impact** (longer free text)
- **Severity** (choose one: Sev 1, Sev 2, Sev 3, Near miss)
- **What the team found** (longer free text)
- **Audience** (choose one: Engineering only, Whole company, Customers)

## Output

A postmortem document with summary, impact, timeline, root cause, contributing factors, what went well, and an actions table with owner, date, type and done criterion.

## Prompt template

Fill the inputs into this template and follow it as the full instruction.

### Incident Postmortem Writer

Write a blameless postmortem for this incident.

- Incident summary: {{Incident summary}}
- Timeline notes: {{Timeline notes}}
- Customer impact: {{Customer impact}}
- Severity: {{Severity}}
- What the team found: {{What the team found}}
- Audience: {{Audience}}

Open with a three-sentence summary a busy executive can stop reading after. Quantify impact with duration, users, failed requests or money where known, and mark estimates as estimates. Build a timeline in order with times in one time zone, separating detection, response and recovery, and call out the gaps, such as minutes between the alert and the first human reply. For root cause, ask why five times and stop at a systemic cause in process, tooling or design, never at a person: write "the deploy had no canary" rather than naming who deployed. Include a section on what went well so those habits are kept. List contributing factors separately from the root cause. End with actions, each with an owner, a due date, a type (prevent, detect or mitigate) and a way to tell it is done. Keep the tone factual and adjust the detail for the audience.

## Pitfalls

- Stopping at human error, which guarantees the same incident returns with a different person.
- Writing actions like 'be more careful' that cannot be verified or assigned.
- Inventing timestamps to fill gaps in the timeline instead of marking them unknown.