agent-incident-postmortem

1# Agent Incident Postmortem Skill
2 
3AI incidents differ from outages: the system didn't go down — it did something wrong, confidently, and maybe only once. This skill adapts blameless postmortem practice to nondeterministic systems, where "can we reproduce it?" needs traces, not just steps.
4 
5## What This Skill Produces
6 
7- A **blameless postmortem document** with timeline and user/business impact
8- A **trace reconstruction** of what the agent saw, decided, and did
9- A **root-cause analysis across the AI failure layers** (not "the model hallucinated" as a conclusion)
10- **Corrective actions** — always including a new permanent case in the regression suite
11 
12## Required Inputs
13 
14Ask for (if not already provided):
15- **What the agent did** and what it should have done
16- **The trace** — the full request: system prompt, context, tool calls and results, output. If no trace exists, that absence is itself a finding
17- **Blast radius** — how many users/requests, over what window, and whether it's ongoing
18- **Detection** — how it was noticed (user report? monitor? luck?) and how long after it started
19 
20## Root-Cause Layers
21 
22Walk the layers in order; the root cause is usually the *earliest* layer that could have prevented the outcome. "The model was wrong" is a starting point, never the conclusion — models are known to be fallible, so the question is what let a fallible output become an incident.
23 
24| Layer | Ask |
25|---|---|
26…