RCA Report

Produce post-mortems that are reproducible, layered, and operationally useful — not just narrative. A good RCA lets a future engineer (or future you) understand the incident, verify the fix held, and avoid repeating it. This skill covers both the investigation flow (what to gather while the incident is fresh) and the report itself.

When this skill applies

• A production incident, outage, or near-miss has occurred and needs documenting
• A pipeline, service, or system silently failed and the user just resolved it
• The user wants a post-mortem, RCA, or incident write-up
• Mid-investigation: the user is debugging something and wants help structuring evidence as it comes in

If the incident is still actively burning and the user just wants help fixing it, skip this skill — fix first, document after.

Output location

Save the report to <topic>-rca-<YYYY-MM-DD>.md in the current working directory, where:

• <topic> is a short kebab-case identifier of the failing system (e.g. debezium, auth-service, kafka-consumer-lag)
• <YYYY-MM-DD> is the incident date (when it occurred), not necessarily today