Inspiration
Every production incident ends with the same question: what actually happened?
The outage itself may last only a few minutes, but writing the postmortem often takes hours. Engineers have to reconstruct timelines from logs, correlate deployments with failures, inspect stack traces, review Git history, and piece together Slack conversations before they can confidently explain the root cause and decide what should change.
I built PostMortem AI to reduce that manual investigation effort. Rather than treating incident analysis as one large AI prompt, I wanted to build an evidence-driven investigation workflow that breaks the problem into focused reasoning stages before assembling a structured, blameless postmortem engineers can inspect, review, and share.
What it does
PostMortem AI transforms incident evidence into a structured engineering postmortem.
The application accepts incident evidence such as:
- Incident metadata
- Deployment information
- Server logs
- Stack traces
- Git history
- Team / war-room discussion
- Additional investigation notes
It then performs a transparent seven-step investigation that:
- Extracts the incident timeline
- Correlates code changes with the incident
- Identifies the most likely technical root cause
- Generates a structured Five Whys analysis
- Separates mitigation from permanent resolution
- Produces prioritized engineering action items
- Deterministically assembles the final report in the browser
The generated report includes:
- Executive summary
- Impact assessment
- Chronological timeline
- Deployment analysis
- Root cause
- Contributing factors
- Source evidence
- Evidence confidence
- Five Whys
- Action items
- Additional evidence recommendations
- Blameless takeaway
The submitted Build Week V1 is intentionally frontend-first.
Judges can evaluate the complete experience immediately using Demo Mode, which requires no API key, backend, authentication, or database.
Demo Mode reconstructs Cloudflare's November 18, 2025 global outage from Cloudflare's published post-incident report using representative incident evidence, allowing the complete investigation workflow to be explored without an API key.
For real incidents, the application also supports browser-first Bring Your Own Key (BYOK) generation with OpenAI, Google Gemini, and Groq.
How I built it
The frontend is built with React, TypeScript, and Vite.
Instead of relying on one increasingly large AI prompt, the investigation is decomposed into focused stages. Each stage owns a specific part of the analysis, producing bounded outputs that are streamed to the interface as they are generated.
The final postmortem is assembled deterministically in the browser from those completed sections instead of asking the model to regenerate the entire report. This keeps prompts smaller, improves reliability across providers, reduces output-token usage, and creates a more scalable architecture.
The interface exposes every stage of the investigation, allowing users to inspect intermediate reasoning rather than receiving one opaque AI response. Generation can also be stopped and resumed without losing completed work.
Reports can be copied, downloaded as Markdown, or printed as PDFs directly from the browser.
An optional Express backend also exists in the repository for future production deployments, but the submitted V1 intentionally remains frontend-first so judges can evaluate the complete product immediately.
Development was carried out collaboratively with Codex and GPT-5.6. Early iterations were exploratory, and once the architecture stabilized I adopted a structured AI engineering workflow where every significant task included planning, implementation, independent review, verification, and human approval. The complete workflow is documented in the repository's AI task log.
Challenges I ran into
The biggest challenge was balancing investigation quality with model limitations.
As more evidence accumulated across an investigation, prompt sizes grew quickly. Asking an LLM to repeatedly regenerate an entire postmortem became increasingly inefficient and less scalable.
I redesigned the architecture so each investigation stage generated only its own evidence-backed section while the browser assembled the finished report deterministically. This kept prompts bounded, improved provider compatibility, reduced token usage, and created a foundation for future retrieval-based evidence processing.
Other challenges included:
- designing interruptible streaming with Stop and Resume
- handling provider-specific retry and error behavior
- supporting multiple AI providers behind one interface
- keeping the product browser-first and privacy-focused
- maintaining consistent documentation and AI workflow records throughout development
Accomplishments that I'm proud of
I'm most proud that PostMortem AI feels like a real engineering tool rather than a simple AI demo.
Highlights include:
- Transparent seven-step investigation workflow
- Deterministic client-side report assembly
- Browser-first architecture
- Demo Mode requiring no API key
- Multi-provider BYOK support
- Stop and Resume generation
- Evidence-grounded reasoning
- Deployment analysis that distinguishes correlation from causation
- Source evidence and confidence reporting
- A reconstructed real-world Cloudflare incident for realistic end-to-end evaluation
- Structured AI engineering workflow documenting how Codex contributed throughout development
What I learned
This project reinforced that building reliable AI systems is as much about workflow design as model capability.
Breaking a complex investigation into smaller evidence-focused stages produced better reasoning, improved reliability across providers, and avoided repeatedly asking the model to regenerate an increasingly large report. Transparent intermediate reasoning also made the system easier to review, debug, and trust than a single monolithic AI response.
I also learned that structured AI collaboration becomes significantly more valuable when planning, review, verification, and human decision-making are treated as first-class engineering activities rather than afterthoughts.
What's next for PostMortem AI
Build Week V1 intentionally focuses on a lightweight frontend-first experience.
The long-term vision is to evolve PostMortem AI into an AI-assisted incident investigation platform.
Planned future work includes:
- authenticated team workspaces
- persistent postmortem history
- automated evidence ingestion from GitHub, GitLab, CI/CD systems, deployment platforms, and observability tools
- retrieval-based evidence indexing so only the most relevant evidence is retrieved and sent to the LLM for each investigation stage
- cross-source evidence correlation across logs, deployments, commits, stack traces, metrics, traces, feature flags, and team discussions
- collaborative review workflows
- production-grade server-side deployments
- integrations with incident management and monitoring platforms
The goal is to help engineering teams investigate incidents more effectively—not just generate documentation after they're over.
Log in or sign up for Devpost to join the conversation.