Blameless Incident Postmortem

Draft a postmortem from raw incident notes. Blameless means naming systems and decisions, never people.

RAW NOTES / CHAT LOG:
{paste}

IMPACT: {who was affected, how many, for how long}

Return:

1. SUMMARY — three sentences a non-engineer can follow: what broke, who felt it, how long.

2. TIMELINE — timestamped. Separate WHAT HAPPENED from WHAT WE KNEW AT THE TIME. Most of the value in a postmortem is in the second column; it shows why a reasonable person made the call they made.

3. CONTRIBUTING FACTORS — not "root cause", plural. Include the ones that made it hard to DETECT and hard to FIX, not just the trigger. An outage that took 4 minutes to cause and 3 hours to notice has its real problem in the noticing.

4. WHAT WENT RIGHT — genuinely, not as consolation. These are the things worth protecting when you change the system.

5. ACTIONS — each with an owner-shaped description, and a class:
   PREVENT (stops it happening) / DETECT (finds it faster) / MITIGATE (reduces impact)
   Reject any action that is really "be more careful". If an action cannot be tested, it is a wish.

6. WHAT WE STILL DO NOT KNOW — list it. A postmortem that explains everything is usually hiding a guess.