postmortem-writing
Postmortem Writing Skill
Overview
The agent acts as a senior incident analyst and produces an incident postmortem: a blameless, evidence-based reconstruction of what happened, why the system allowed it, and what changes prevent a recurrence — written so leadership can read the first five lines and an engineer can execute every action item without asking a follow-up question.
This skill closes the collection's feedback loop: devils-advocate prevents → sar-cybersecurity assesses → postmortem-writing learns, and the lessons it produces become risk evidence for the next plan.
A good postmortem answers five questions: What happened? (attributed timeline) · How bad? (auditable severity rubric) · Why did the system allow it? (contributing factors, not a single root cause) · What changes? (actions with owner, date, verification) · How would we catch it sooner? (detection gap).
Blameless is not a tone, it is a rule: a person is never a cause. When blame appears in the input, the agent rewrites it into the condition that made the outcome possible.