# Recipe: incident postmortem, timeline, causes and actions

A copy-paste prompt: after a fix, your agent turns commits, deploys and your notes into a blameless postmortem with a timeline, root causes and actions.

> [!info]
> **For:** whoever was on call, or whoever fixed it. **When:** the day after, while it is fresh. **Takes:** a few minutes of agent time. **You get:** a postmortem with a timeline, root causes, the key fix, what went well and actions, ticking those already done.

## The prompt

```text
Write a postmortem for <incident> in onecell. Save it to <cell>.

1. Gather the facts: the commits and pull requests that fixed it (git
   log, gh pr view), deploy times, any parked debugging session or
   handoff (search), and what I tell you. Mark any time you estimate
   as approximate.

2. Draft "Postmortem: <incident>" with create_document (dry run first):
   - A stats block: duration, impact, fixes
   - A summary in plain words: what people saw, and why
   - A timeline block: detection, each finding, each fix, recovery
   - Root causes as a table: cause, why it happened, why tests missed it
   - A diff block of the key fix, trimmed
   - What went well
   - Actions as a checklist, ticking the ones already done
   Keep it blameless: describe what the system allowed, not who slipped.

3. If a fix carried a design decision, record it as a decision block too.

4. Reply with the link and the one action that most prevents a repeat.
```

## What your agent does

1. Reconstructs the timeline
   From commit times, pull requests, deploys and your notes, marking what is estimated.
2. Separates causes from symptoms
   Each root cause with why it happened and why tests didn't catch it.
3. Shows the fix
   The key change as a before-and-after diff, trimmed to the lines that matter.
4. Turns it into actions
   A checklist, with the fixes already shipped ticked, and the one that matters most in the reply.

## What you get

A postmortem for Tally, a made-up invoicing app, whose reminder emails went out twice after a deploy restarted the worker mid-run. Two root causes, one already patched.

<!-- onecell:block {"type":"embed","documentId":"b6491368-ef63-4cd6-a98b-7202ecd2144f"} -->
[Sample postmortem: invoice reminders sent twice](https://onecell.io/p/sample-postmortem-duplicate-reminders)

## Variations

<details>
<summary>Park a debugging session while it's happening</summary>

During the incident, every so often say: “Park what we know so far in my Inbox: hypotheses, commands tried, what each showed.” It takes seconds, survives a crashed session or a switch of agent, and becomes the postmortem's best source.

</details>

<details>
<summary>A note for customers</summary>

Add: “Then write a short customer-facing note: what they saw, when it was fixed, and what we changed. No internal names.” Share it with a link after you have read it.

</details>

<details>
<summary>A near miss</summary>

Use the same prompt for something caught before anyone noticed. Near misses are the cheapest postmortems you will ever write.

</details>

## Tips

- Write it the day after. Details fade faster than you expect.
- “Why tests missed it” is the column that prevents the next one.
- Tick the actions already shipped; it shows the loop closing.

---

Part of [onecell recipes](https://onecell.io/help/recipes): copy-paste prompts for using onecell in your work.