Blameless postmortems

As of: 2025-11 (practice stable)

The format that works

1. Summary — one paragraph: what broke, for whom, how long, how bad (measured: users, requests, revenue).
2. Timeline — UTC timestamps, detection → mitigation → resolution. Include what would have detected it earlier.
3. Contributing factors — systems view: missing alert, single point of failure, deploy gap. "Human error" is rephrased as "the system allowed/encouraged this action."
4. What went well — detection, comms, rollback. Reinforce the good.
5. Action items — each with owner + due date + type (prevent/detect/mitigate). Reviewed monthly until closed.

Rules

• Blameless ≠ accountability-less: actions must land; recurring causes escalate to architecture work.
• Write it within 48h; memory rots fast.
• Publish internally by default — shared incident knowledge compounds.
• For agent-caused incidents: same format, but the "human action" slot holds the agent run — include the transcript reference and the missing gate that would have caught it.