ai-for-dummies/submitted-skills/Marcos Silva/templates/postmortem.md

Postmortem — Template

Use for incident write-ups. The structure follows the standard blameless format: what happened, what was supposed to happen, why it didn't, what we change.

Sections

• Summary (two or three sentences: who was affected, for how long, by what)
• Impact (the numbers: users, requests, dollars, internal teams)
• Timeline (UTC timestamps, one row per significant event)
• Root cause (the chain of decisions and conditions that produced the incident; not a single "the bug")
• Detection (how we found out, and how long after it started)
• Response (what we did, what worked, what didn't)
• Recovery (what we did to get back to a steady state)
• Lessons (the things we want to remember)
• Action items (table with owner, due date, status)
• Related (links to the incident ticket, runbook, and follow-up docs)

Anti-patterns

• Don't assign blame. The postmortem is about the system, not the person.
• Don't hide the timeline. The reader's first question is "how long"; the timeline is the answer.
• Don't list action items without owners. An action item without an owner is a wish.

Storage template

<h1>{Incident title — short, dated}</h1>
<table>
  <tbody>
    <tr>
      <th>Date</th>
      <td>{YYYY-MM-DD}</td>
    </tr>
    <tr>
      <th>Severity</th>
      <td>{SEV-1 / SEV-2 / SEV-3}</td>
    </tr>
    <tr>
      <th>Duration</th>
      <td>{start} → {end} (UTC)</td>
    </tr>
    <tr>
      <th>Incident commander</th>
      <td>{name}</td>
    </tr>
  </tbody>
</table>

<h2>Summary</h2>
<p>{two or three sentences}</p>

<h2>Impact</h2>
<ul>
  <li>{users affected}</li>
  <li>{requests failed / throttled}</li>
  <li>{internal teams paged}</li>
</ul>

<h2>Timeline (UTC)</h2>
<table>
  <tbody>
    <tr>
      <th>Time</th>
      <th>Event</th>
    </tr>
    <tr>
      <td>{HH:MM}</td>
      <td>{event}</td>
    </tr>
  </tbody>
</table>

<h2>Root cause</h2>
<p>{chain of decisions and conditions}</p>

<h2>Detection</h2>
<p>{how we found out, and how long after the incident started}</p>

<h2>Response</h2>
<p>{what we did}</p>

<h2>Recovery</h2>
<p>{how we got back to steady state}</p>

<h2>Lessons</h2>
<ul>
  <li>{lesson}</li>
</ul>

<h2>Action items</h2>
<table>
  <tbody>
    <tr>
      <th>Action</th>
      <th>Owner</th>
      <th>Due</th>
      <th>Status</th>
    </tr>
    <tr>
      <td>{action}</td>
      <td>{owner}</td>
      <td>{YYYY-MM-DD}</td>
      <td>{OPEN / DONE}</td>
    </tr>
  </tbody>
</table>

Cross-references

• Storage macros: confluence-page/references/macros.md
• BASS / AVP page hierarchy — see the owning team's incident process doc