Incident postmortem kit: merged UTC timeline, TTD/TTR, status updates and notices (en/ja)

What it does

Supports a production incident from live communication to the finished postmortem.

• Automatic timeline (build_timeline.py): reads application logs, Nginx/Apache access logs, syslog, deploy logs, PagerDuty-style CSV exports, Slack export JSON, copied chat text with time-only stamps like [14:03], and support ticket CSVs, converts everything to UTC and sorts it. Handles about 11 timestamp styles (ISO 8601, 2026/11/10 14:03 JST, Japanese dates, access-log format, epoch seconds and more) with a timezone per file. Collapses repeated lines, tags deploys, alerts, acknowledgements, mitigations and recovery, proposes key-event candidates, and warns wherever a timezone was assumed
• Metrics (incident_metrics.py): time to detect (TTD), acknowledge (TTA), mitigate (TTM) and resolve (TTR). From an error-rate CSV or log lines it finds the impact window above a threshold, the peak and an approximate failed-request count, and warns about milestones in the wrong order
• Action item checks (action_items.py): flags missing owners and due dates, overdue items, and vague or blame-style wording such as "be more careful" in the tracker CSV
• Templates: blameless postmortem (English and Japanese), status page updates (investigating, identified, monitoring, resolved; en/ja), customer report and apology email (en/ja)
• Guides: five whys and contributing factors, metric definitions and pitfalls, a live-incident checklist (severity, roles, update cadence)
• Worked example: 9 sample files in mixed formats and timezones, their outputs, and a finished postmortem

How to use

python scripts/build_timeline.py deploy.log::label=deploy app.log::label=app "chat.txt::kind=chat,tz=Asia/Tokyo,date=2026-11-10" --display-tz Asia/Tokyo --md timeline.md
python scripts/incident_metrics.py --metrics error_rate.csv --threshold 5% --detected ... --resolved ... --md metrics.md

The agent reviews the warnings and candidates, picks the real milestones, analyzes contributing factors and drafts the postmortem and notices. Works with Claude, Codex, Hermes Agent and Cursor.

Requirements

• Python 3 (standard library only). No network access
• Timezone names with daylight saving time (such as America/New_York) may need the tzdata package on Windows. Asia/Tokyo and fixed offsets like +09:00 always work

Caveats

• Event tags and milestone candidates are keyword heuristics. The agent and the team make the final call on times and causes from the evidence
• Numbers and facts not supported by the evidence are not written; unknowns are marked and asked about
• Nothing is sent automatically. Statements about compensation or personal data need approval by the owner
• Mask personal data from logs before using it in documents