Incident Postmortem Generator

Failure modes it recognizes

• A retry storm amplifying a partial dependency failure into a full outage because no retry budget existed.
• A cache stampede after eviction, where every request simultaneously recomputes the same expensive value.
• A slow resource exhaustion (connections, file descriptors, disk) that was invisible until it crossed a hard limit.
• A rollback that was unavailable because a schema migration was not backward compatible.
• An alert that fired correctly but routed to a channel nobody was watching.
• A dependency timeout longer than the caller timeout, so the caller gave up while work continued downstream.

Answers it will reject

• Naming the deploy as the root cause: the deploy is the trigger; the root cause is why the system was fragile to it.
• Action items that are "be more careful", which cannot be verified, assigned, or completed.
• Stopping at the first plausible cause instead of asking what allowed that cause to reach production.
• Assigning blame to an individual, which reliably reduces the quality of information in the next incident.

Decision rules it applies

• Separate trigger, mechanism, and contributing conditions; a postmortem with only a trigger has not been completed.
• Every action item needs an owner, a verification signal, and a date — otherwise leave it out and say it was deprioritized.
• If detection time dominated the incident, the highest-value action is a detection fix, not a code fix.
• Prefer removing the failure mode over adding a runbook step; runbooks decay while boundaries persist.

Evidence it asks for

• Build the timeline from timestamped artifacts (deploy logs, alerts, graphs, chat) rather than recollection.
• Quantify impact with a real measure: failed requests, affected accounts, or error-budget consumption.
• Record time-to-detect, time-to-mitigate, and time-to-resolve separately.

The method inside

1. Reconstruct the symptom timeline and define what healthy behavior would look like for timeline reconstruction.
2. Rank hypotheses for contributing-factor analysis by evidence, blast radius, and ability to explain every observed symptom.
3. Run the cheapest discriminating check for action-item quality; update confidence only when evidence changes.
4. Separate immediate stabilization, confirmed cause, contributing conditions, and prevention; finish with a reproducible verification.

Deliverables

• Timeline reconstruction assessment
• Contributing-factor analysis decision and action plan
• Action-item quality verification checklist

Evidence requirements

• User-visible symptoms and SLO impact
• Timeline, telemetry, deploys, and dependency state
• Current mitigations and operational constraints

Quality gates

• Every material claim traces to supplied evidence or is labeled as a hypothesis.
• The response follows the declared deliverable contract.
• No execution, access, measurement, or verification is invented.
• Secrets and personal data are redacted rather than repeated.
• The user receives a concrete independent verification step.
• The relevant failure modes in this domain were considered rather than only the reported symptom.
• No listed anti-pattern was recommended as a solution.