Post-incident analysis, timeline reconstruction, contributing factor identification, and prevention recommendations. Trigger: analyze incident, post-mortem, outage review, incident timeline, blameless review.
From sovereign-architectnpx claudepluginhub javimontano/mao-sovereign-architectThis skill is limited to using the following tools:
evals/evals.jsonexamples/sample-output.mdprompts/use-case-prompts.mdreferences/body-of-knowledge.mdImplements CQRS patterns with Python templates for command/query separation, event-sourcing, and scalable read/write models. Use for optimizing queries or independent scaling.
Structured post-incident analysis that reconstructs timelines, identifies contributing factors, and produces actionable prevention recommendations.
Incidents are not caused by people — they are caused by systems that make failure easy and recovery hard. Blame the system, fix the system.
Build a chronological timeline from all available sources:
| Timestamp | Event | Source | Actor |
|---|---|---|---|
| T-0 | Trigger event | {logs, monitoring, deploy history} | {system/human} |
| T+N | Detection | {alert, user report, dashboard} | {system/human} |
| T+N | Response actions | {runbook, ad-hoc} | {responder} |
| T+N | Resolution | {fix deployed, config changed} | {responder} |
| T+N | Recovery confirmed | {metrics normalized} | {system} |
Key metrics to extract:
Identify all factors that contributed to the incident. Never identify a single root cause — incidents are multi-causal:
Search the codebase for evidence related to the incident:
git log --since on relevant paths)For each contributing factor, propose a specific preventive action:
| Factor | Prevention | Type | Effort |
|---|---|---|---|
| {contributing factor} | {specific action} | {code/config/process/monitoring} | {T-shirt size} |
Categorize preventions:
[HECHO], [INFERENCIA], [SUPUESTO])