SUMMARY: An evidence-preserving postmortem joins raw technical records, participant impact, operator decisions, and unresolved corrections without rewriting uncertainty. It produces an accountable learning record rather than a smooth story assembled after recovery.
Begin when the incident is declared, not after it closes. Assign a recorder who is not the incident commander. Preserve proportionately: collect what explains decisions and consequences while excluding unrelated personal data and secrets.
1. Freeze Volatile Evidence
Capture relevant logs, alerts, configuration versions, queue state, status notices, and decision messages before retention jobs or routine changes erase context. Record collection time, source, owner, and integrity hash.
2. Separate Observation From Inference
Label each statement as observed, reported, inferred, or estimated. Keep the raw source linked. Do not silently replace an early belief with the later explanation.
3. Build Parallel Timelines
Track system behavior, operator action, participant impact, and public communication separately before aligning them. Include clock source and known drift so apparent order does not become false precision.
4. Preserve Decision Context
For each consequential choice, record who decided, what evidence was available, alternatives considered, expected expiry, and affected routes. Link emergency authority back to the control plane map.
5. Inventory Unresolved Cases
List deferred transactions, stale recipients, missed notices, manual overrides, appeals, and corrections that remain open. Assign an owner and deadline without exposing personal case details in the public report.
6. Test the Causal Claim
Distinguish trigger, contributing conditions, detection gaps, and consequence amplifiers. Ask what evidence would disprove the proposed cause. Avoid reducing a distributed failure to the last person who touched the system.
7. Connect Actions to Failure Paths
Every corrective action should name the observed path it interrupts, its owner, due date, verification method, and rollback. Use the review clock so unfinished actions do not disappear after attention moves on.
8. Publish With Bounded Redaction
Protect credentials, exploit details, and personal records, but disclose impact, decisions, uncertainty, and corrective commitments. Name the reason for each material redaction and who can review the unredacted record.
9. Verify Learning in Operation
Repeat a safe version of the failure through the degraded-service drill. Close the action only when the new control changes the measured outcome.
Operator rule: preserve enough evidence to challenge the story, not only enough to support it.
Continue the discussion in the Clandestinia forum.