---
name: lumen-postmortem
description: Produce a multi-tab HTML postmortem for a production incident. Combines a scoped recap, a mermaid sequence-diagram timeline, impact charts, and a structured write-up (Summary / Timeline / Impact / Root Cause / Action Items). Invoke for "postmortem", "post-mortem", "incident review".
version: 0.1.9 # x-release-please-version
---

# lumen-postmortem

Composite skill. Produces a single-file multi-tab HTML postmortem document for a production incident.

**Tier:** composite (molecular) — orchestrates 4 capabilities in a fixed pipeline. The agent has no runtime discretion over which skills to call or in what order.

## When to invoke

Triggers: `postmortem`, `post-mortem`, `incident review`, `incident retrospective`, `write a postmortem for X`, `incident write-up`, `RCA document`, `root cause analysis doc`.

When triggered, **execute the pipeline immediately**. Do not ask the user whether they want markdown vs HTML — the composite is the HTML path; markdown is the user's plain-`Write` path and they would not have triggered this composite if that's what they wanted.

Do NOT invoke when the user explicitly asks for:
- A markdown postmortem (no diagrams, no tabs) → write that directly with plain `Edit`/`Write`.
- A timeline diagram only → use `lumen-mermaid` (capability).
- An incident metrics chart only → use `lumen-chart` (capability).
- Architecture documentation → use `lumen-architecture-doc` (composite).

## Pipeline (fixed, sequential — do not skip, reorder, or substitute)

The composite assumes the user has provided incident context (which service, when, what happened) — either in the prompt, a linked issue, a Slack thread, or a logfile. If context is missing, ASK ONCE for: service name, incident window (start/end), and a one-line summary. Then run the pipeline.

### Step 1 — Scoped recap (`lumen-recap`)

Invoke `lumen-recap` against the affected repo, **scoped to the incident window**. Extract:
- Commits / merges in the window.
- Deploys in the window (from CI logs or release tags).
- Recent decisions touching the affected subsystem.

**Output:** scoped recap (the "what was changing around the time" picture).

### Step 2 — Incident timeline (`lumen-mermaid`)

Invoke `lumen-mermaid` with **`sequenceDiagram` syntax**. Actors:
- `Detection` — alert / user report.
- `Pager` — oncall.
- `Mitigation` — partial / full mitigation steps.
- `Resolution` — full restore.
- Add additional actors (services, dashboards, vendors) only if they took action.

Each event has a timestamp and an actor → actor message. Aim for 8–20 events. Use mermaid `Note over` for context lines that aren't messages.

**Output:** one mermaid HTML (timeline).

### Step 3 — Impact metrics (`lumen-chart`)

Generate 1–3 charts quantifying impact during the incident window:
- **Error rate** — line chart, requests/sec or % errors over time, incident window highlighted.
- **Latency** — line chart, p50/p95/p99, incident window highlighted.
- **Traffic / users affected** — bar or line chart.

If metrics are unavailable, skip Step 3 and note "metrics not available at writing" in the Impact tab. Do NOT fabricate.

**Output:** 0–3 chart HTMLs.

### Step 4 — Assemble write-up (`lumen-guide`)

Invoke `lumen-guide` in **single-file mode**. Tabs:
- **Summary** — 1-paragraph TL;DR, KPI strip (`duration`, `users affected`, `severity`, `services affected`), one-line root cause.
- **Timeline** — Step 2's mermaid timeline embedded full-width via `<iframe srcdoc="...">` (HTML-escape). Below the diagram: bullet list of major timestamps.
- **Impact** — Step 3's charts embedded with prose context. If Step 3 was skipped, plain-text impact estimate.
- **Root cause** — narrative (3–8 paragraphs). Use `card.accent` components for the "why didn't we catch this earlier" sub-points. Reference Step 1's commits/deploys where they contributed.
- **Action items** — `card.warning` per item, with: action, owner, target date. Use `finding--high` / `finding--medium` / `finding--low` severity to indicate priority.

Aesthetic: default `editorial`. Use `dark-professional` for sev-1 / customer-impacting incidents (signals seriousness).

**Output:** one assembled HTML file.

## Reliability contract

- Step 1's scoped recap is the source of truth for what was changing in the incident window.
- Step 2's timeline must reflect actual events (logs, alerts, slack timestamps); do not paraphrase or compress beyond clarity.
- Step 3's charts must come from real metrics; never fabricate.
- Action items in Step 4 must have an owner. Drop items without owners — they're not commitments.
- If any step fails, surface the error with the step number and the failing capability's name.

## Output

Single HTML file: a 5-tab postmortem (Summary / Timeline / Impact / Root Cause / Action Items). Offline-readable (`file://`), shareable as one attachment.

## Quality checks

- Summary tab's TL;DR matches the timeline's narrative.
- Every action item has an owner.
- Timeline events have timestamps.
- No fabricated metrics.
- Severity (`sev-1` / `sev-2` / `sev-3`) is stated explicitly in the Summary.
- Follow `skills/_shared/instructions.md` for universal aesthetics, file-handling, validation, and citation conventions.

## Execution model

This composite is always invoked via the LLM-authored skill path. Step 1 calls `lumen-recap`; Step 2 calls `lumen-mermaid`; Step 3 calls `lumen-chart`; Step 4 calls `lumen-guide`.

When the trigger fires, execute the pipeline. Do not propose a markdown alternative — the user's plain-`Write` is their markdown path; they triggered this composite for the HTML path.

## Sources

This composite is novel orchestration. Each constituent capability has its own NOTICE.md attribution:
- `skills/lumen-recap/NOTICE.md`
- `skills/lumen-mermaid/SKILL.md` (NOTICE inline in `src/templates/shared.ts`)
- `skills/lumen-chart/NOTICE.md`
- `skills/lumen-guide/NOTICE.md`