nw-post-mortem-framework

# Post-Mortem Framework ## Principles - **Blameless**: focus on systems/processes, not individuals. People make reasonable decisions given available info. - **Evidence-based**: every finding backed by logs, metrics, or documented actions - **Action-oriented**: every finding produces concrete, assigned action item - **Learning-focused**: capture what worked alongside what failed ## Post-Mortem Document Structure ```markdown # Post-Mortem: [Incident Title] **Date**: [incident date] **Duration**: [start to resolution] **Severity**: [P0-P3] **Author**: [analyst] ## Summary [2-3 sentence overview: what happened, impact, resolution] ## Timeline | Time | Event | Source | |------|-------|--------| | HH:MM | [event] | [log/metric/report] | ## Impact - Users affected: [number/percentage] - Duration of impact: [time] - Business impact: [quantified if possible] - Systems affected: [list] ## Root Cause Analysis [5 Whys analysis with evidence at each level] ## Detection and Response - Time to detect: [duration] -- [how detected] - Time to respond: [duration] -- [first action] - Time to mitigate: [duration] -- [mitigation applied] - Time to resolve: [duration] -- [permanent fix] ## What Went Well - [positive observations about detection, response, recovery] ## What Could Be Improved - [areas where detection, response, recovery fell short] ## Action Items | ID | Action | Owner | Priority | Due Date | |----|--------|-------|----------|----------| | 1 | [specific action] | [team/p...