Use when an incident has happened and you need to write a clear, blameless root-cause analysis (RCA) or postmortem from logs, metrics, timelines, and notes. Produces a structured document — summary, impact (who/what/how many/how long), detection, timeline, root cause vs contributing factors, resolution, and concrete preventive action items with owners. Distinguishes trigger from root cause and pushes for systemic fixes (monitoring, guardrails, access control) over one-off patches. Trigger when the user asks to write an RCA/postmortem, analyze an outage or incident, or turn incident notes and logs into a report.
