version: 0.1.0

production-incident-playbook

Overview

A production incident has two distinct lifecycles:

1. In-flight (minutes to hours): you're debugging live, the system is broken, users are affected. The work is operational — find the cause, mitigate, communicate.
2. After-action (days to weeks): you're writing the postmortem. The work is learning — what happened, why, how to prevent recurrence.

This skill ships runbook templates for the in-flight phase (what to do when the alert fires) and postmortem templates for the after-action phase (what to write 5 days later). Together they form the playbook that turns an outage into a system improvement.

Distinct from: