agent-incident-postmortem

# Agent Incident Postmortem Skill AI incidents differ from outages: the system didn't go down — it did something wrong, confidently, and maybe only once. This skill adapts blameless postmortem practice to nondeterministic systems, where "can we reproduce it?" needs traces, not just steps. ## What This Skill Produces - A **blameless postmortem document** with timeline and user/business impact - A **trace reconstruction** of what the agent saw, decided, and did - A **root-cause analysis across the AI failure layers** (not "the model hallucinated" as a conclusion) - **Corrective actions** — always including a new permanent case in the regression suite ## Required Inputs Ask for (if not already provided): - **What the agent did** and what it should have done - **The trace** — the full request: system prompt, context, tool calls and results, output. If no trace exists, that absence is itself a finding - **Blast radius** — how many users/requests, over what window, and whether it's ongoing - **Detection** — how it was noticed (user report? monitor? luck?) and how long after it started ## Root-Cause Layers Walk the layers in order; the root cause is usually the *earliest* layer that could have prevented the outcome. "The model was wrong" is a starting point, never the conclusion — models are known to be fallible, so the question is what let a fallible output become an incident. | Layer | Ask | |---|---| | **Input / context** | Was the context wrong, stale, contradictory, or ...