principle-postmortem

Postmortem

Incidents are inevitable. A postmortem converts failure into systemic learning — the goal is not to assign blame but to close the gap between what the system can do and what the environment demands. The prevent → detect → learn triad is incomplete without this phase.

Cross-references: swe-workbench:principle-resiliency (prevent), principle-observability#SLI / SLO / Error Budget (detect / MTTD-MTTR framing), principle-release-engineering#Rollback (remediation action items).

Blameless Culture

Blame suppresses signal. When individuals fear punishment, they conceal information, underreport near-misses, and avoid risky-but-necessary work. Blameless postmortems operate from the assumption that everyone acted rationally given the information and tools available to them at the time.

Guiding principles:

• "The system allowed it" — if a person could cause an outage, the system lacked the guardrails to prevent it. The fix belongs in the system, not the person.
• Psychological safety — participants must feel safe sharing the full sequence of events, including their own mistakes. Facilitation owns this; interrupt any language that assigns personal fault.
• Hindsight bias — it is easy to see the right move after the fact. Explicitly reconstruct the information available at each decision point; do not evaluate decisions using information that only became visible later.
• Counterfactual fairness — "if only they had done X" is only valid if X was a realistic, well-understood option at the time. If X required information no one had, the real gap is in the information architecture.
• Separate the review from personnel processes — postmortems feed the improvement backlog, not performance reviews.

Root Cause Analysis

A single proximate cause is almost never the full story. Three distinct layers exist:

• Trigger — the immediate event that precipitated the incident (a deployment, a traffic spike, a configuration change).
• Condition — the pre-existing state that made the system vulnerable to that trigger (an untested code path, a missing circuit breaker, a stale cache TTL).
• Root cause — the systemic gap that allowed the condition to persist undetected (absent pre-deploy checklist, no SLO alert on the affected path, no load test in CI).