postmortemlisted

# Postmortem Skill Produce a complete blameless incident postmortem. The goal is organizational learning, not attribution. Every finding targets systems and process — never people. Impact is quantified, the timeline includes detection and each mitigation attempt, analysis goes beyond a single root cause to contributing factors, and every action item has an owner, a due date, and a prevent/detect/mitigate classification. This skill operates in two modes: - **Author mode** (default) — construct a postmortem from an incident description and artifacts. - **Review mode** — rate an existing draft against the quality checklist and suggest fixes. ## Step 1: Determine Mode and Gather Inputs If the argument is a path to an existing markdown file that already contains postmortem sections (summary, timeline, root cause), enter **Review mode** — skip to Step 5. Otherwise enter **Author mode**. Collect what you can without asking the user: - The incident summary from the argument or the conversation brief. - Any artifact paths mentioned (log files, timeline notes, chat transcripts, alert exports). Read or `grep` them for timestamps, error signatures, deploy markers, and alert fire/resolve times. - Scan the working directory for obvious artifacts: `*.log`, `incident*.md`, `timeline*`, `*.json` alert exports. Only ask the user (via AskUserQuestion, 2-3 questions max) if the **core facts are missing**: what broke, when it started and ended, and the user-facing impact. Do not interro