postmortem-writing

what it does

Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem documents, or improving incident response processes.

by Seth Hobson · Seth Hobson, MIT · version 1 · license MIT

Verified Before and after: 2 models 1 try per case View source Download .zip

Compare the answers

Answers from Claude Sonnet 5.5 and GPT-6.1 Sol · try 1 of 1

Same request, same model, once with the skill and once without. Read both and judge for yourself.

“My manager says this postmortem draft is too blamey. Can you rewrite the root cause and action items?”

Source material given with the request

Fernway postmortem draft: mobile API outage, 2026-10-03 Impact: iOS and Android apps could not connect to api.fernway.example from 07:50 to 10:00 UTC (2 h 10 min). About 18,000 users saw "connection error". Root cause: Tom forgot to renew the TLS certificate for api.fernway.example. This is the second time Tom has missed a renewal (the first was 2025-09). Expiry warning emails went to certs@fernway.example, an alias that was deleted in the June mailbox cleanup. Other facts: the certificate is bought yearly and installed by hand on the load balancer. Our uptime monitor checks that the API returns HTTP 200; it does not check certificate expiry. The staging certificate is issued automatically by Let's Encrypt and has never lapsed. Action items: - Tom to set a calendar reminder. - Tom to be more careful with renewals.

with the skill

## Root cause The TLS certificate for `api.fernway.example` expired, preventing iOS and Android apps from connecting between 07:50 and 10:00 UTC on 2026-10-03. Approximately 18,000 users saw a “connection error.” Production certificate management depended on an annual manual purchase and installation on the load balancer, without a reliable backup control to ensure renewal before expiry. Renewal warnings were sent to `certs@fernway.example`, an alias deleted during the June mailbox cleanup. The uptime monitor checked for an HTTP 200 response but did not provide advance warning of certificate expiry. A previous missed renewal in September 2025 indicates that this failure mode had occurred before; the renewal process still depended on manual follow-through rather than automated renewal and independent expiry monitoring. Staging already uses automated issuance through Let’s Encrypt and has had no reported certificate lapses, providing an existing approach to evaluate for production. ## Action items *Proposed owners and deadlines below should be confirmed during the postmortem review. Deadlines are relative to approval.* | Priority | Action | Proposed owner | Due | Completion criteria | |---|---|---|---|---| | P0 | Verify the currently served production certificate’s expiry date and establish a monitored renewal contact. Restore or replace the deleted alias, and verify delivery. | Platform on-call + IT/mail administrator | Within 1 business day | Expiry date recorded; test notification reaches the responsible team. | | P0 | Add independent expiry monitoring for the certificate served by `api.fernway.example`, with alerts at 30, 14, and 7 days before expiry and escalation if unacknowledged. | Observability owner | Within 3 business days | A test demonstrates that alerts and escalation reach the on-call team. | | P1 | Automate production certificate issuance, renewal, and deployment to the load balancer. Evaluate the staging Let’s Encrypt approach for production

Show the rest (5 more lines)

compatibility. | Platform engineering | Within 30 days | An end-to-end renewal and deployment test succeeds; renewal failures alert the responsible team. | | P1 | Document team ownership, backup coverage, and a renewal/recovery runbook for production certificates until automation is verified. | Platform lead | Within 5 business days | Certificate inventory lists owners, expiry dates, and renewal methods; a backup responder validates the runbook. | | P1 | Add a dependency check before deleting operational mail aliases, including certificate renewal contacts. | IT/mail administrator | Within 10 business days | Mailbox cleanup procedure requires dependent services to be identified and notification delivery verified before deletion. | These changes replace reliance on individual memory with automated renewal, independent detection, and verified notification paths.

without

## Root cause The TLS certificate for `api.fernway.example` expired, preventing iOS and Android clients from connecting from 07:50 to 10:00 UTC on 2026-10-03. Production certificate renewal depended on a yearly manual purchase and installation on the load balancer, without reliable supporting controls. Expiry warnings were sent to `certs@fernway.example`, an alias deleted during the June mailbox cleanup. The uptime monitor checked for an HTTP 200 response but did not provide advance warning of certificate expiry. A similar missed renewal occurred in September 2025. The renewal process remained dependent on individual follow-through rather than automated renewal, monitored notifications, and escalation. Staging already uses automated issuance through Let’s Encrypt; that approach should be evaluated for production. ## Action items *Assign a named owner and target date to each item before closing the postmortem.* | Action | Completion criteria | |---|---| | **Automate production certificate renewal and deployment.** Evaluate the Let’s Encrypt approach used in staging, or another suitable managed solution. | Renewal and load-balancer deployment run without manual intervention; renewal failure alerts reach the on-call team; the process is tested end to end. | | **Add independent certificate-expiry monitoring.** | External checks alert at agreed thresholds, such as 30, 14, and 7 days before expiry, with escalation for unresolved alerts. | | **Restore and verify certificate notifications.** Replace the deleted alias with a maintained team destination. | The certificate provider’s contact details are updated and delivery is verified with a test notification. | | **Document ownership and the interim renewal procedure.** Until automation is complete, track renewal centrally with a primary owner, backup owner, and escalation path. | The runbook includes renewal, installation, and validation steps; the next renewal is tracked with sufficient lead time. | | **Protect

Show the rest (1 more line)

operational notification destinations during mailbox cleanup.** | The cleanup checklist requires checking for service dependencies and migrating or verifying notification delivery before deleting an address. |

Answers are shown exactly as the model wrote them, from the first try, and nothing is picked by hand.

The models

2 models

Claude Sonnet 5.5

made by Anthropic

claude-sonnet-5-5 · revision not reported by the provider

1 try per case · tested 3 Nov 2026

GPT-6.1 Sol

made by OpenAI

gpt-6.1-sol · revision not reported by the provider

1 try per case · tested 3 Nov 2026

The tasks

written by Carte Blanche

blameless-rewrite-tls

“My manager says this postmortem draft is too blamey. Can you rewrite the root cause and action items?”

fix-weak-action-items

“Our postmortem's action items feel weak. Can you rewrite them?”

full-postmortem-from-notes

“Write the postmortem for yesterday's incident from these notes.”

quick-sev3-writeup

“Can you write a short postmortem for this small incident? We don't need the full template, just something for the incident log.”

root-cause-past-disk-full

“Our draft root cause just says 'disk filled up on search-node-3'. Is that enough? Help me write a better root cause section.”

Install

Download the .zip and unzip it. Put its files, in a folder named postmortem-writing, here:

Claude Code~/.claude/skills/Every project. For one project only, use .claude/skills/ inside it.

Codex~/.agents/skills/Every project. For one repository only, use .agents/skills/ inside it.

Cursor~/.cursor/skills/Cursor also reads the Claude Code and Codex folders above.

Then start a new session and ask for what the skill does. Other agents that read SKILL.md have their own skills folder; check their docs.

Coming after launch: get skills from inside your agent, no download needed.