From 2c86208d2953feb3a0ac1b77c574e7bc95cebd27 Mon Sep 17 00:00:00 2001 From: wu Date: Tue, 13 Jan 2026 14:45:47 +0800 Subject: [PATCH] Refactor root cause analysis to allow AI proactive analysis - Change from strict Q&A to AI-based synthesis from conversation - AI can analyze root causes proactively from available information - Only ask targeted questions when information is missing - Present full analysis and ask for confirmation/clarification - More flexible and efficient than step-by-step questioning --- skills/postmortems/SKILL.md | 15 +++--- .../references/root-cause-analysis.md | 47 ++++++++++++------- 2 files changed, 40 insertions(+), 22 deletions(-) diff --git a/skills/postmortems/SKILL.md b/skills/postmortems/SKILL.md index 37823264..bf027bcc 100644 --- a/skills/postmortems/SKILL.md +++ b/skills/postmortems/SKILL.md @@ -92,14 +92,17 @@ Ask if there's any more information they want to provide, or if it's time to mov ### Root Cause Analysis -Guide users through root cause analysis using techniques from [references/root-cause-analysis.md](references/root-cause-analysis.md): +Analyze root causes using techniques from [references/root-cause-analysis.md](references/root-cause-analysis.md). Based on information provided in the conversation: -1. **5 Whys**: Ask iterative "why" questions to dig deeper -2. **Causal Chain**: Build symptom → immediate cause → contributing factor → root cause -3. **Systems Thinking**: Consider technical, process, and organizational layers +1. **Synthesize available information**: Review what the user has shared about the incident +2. **Apply 5 Whys**: Analyze the chain of "whys" from available information, ask targeted questions only when information is missing +3. **Build Causal Chain**: Construct symptom → immediate cause → contributing factor → root cause +4. **Apply Systems Thinking**: Consider technical, process, and organizational layers **What to do:** -- Guide interactive 5 Whys analysis +- Analyze root causes proactively from conversation context +- Present your analysis and ask for confirmation or clarification +- Only ask targeted questions about specific gaps, not the entire chain - Help identify contributing factors beyond immediate cause - Frame causes in terms of systems and processes, not individuals - Suggest alternative explanations and "second stories" @@ -109,7 +112,7 @@ Guide users through root cause analysis using techniques from [references/root-c - Use role-based language, not names - Ask "why did the system allow this" not "why did this person do this" -If user provides information that blames individuals, help reframe it in blameless terms. +If user provides information that blames individuals, automatically reframe it in blameless terms. ### Action Items Generation diff --git a/skills/postmortems/references/root-cause-analysis.md b/skills/postmortems/references/root-cause-analysis.md index ce0be25e..934f25d7 100644 --- a/skills/postmortems/references/root-cause-analysis.md +++ b/skills/postmortems/references/root-cause-analysis.md @@ -1,45 +1,60 @@ # Root Cause Analysis Techniques +## Approach + +Analyze root causes based on information provided in the conversation. You can synthesize information from multiple messages, ask clarifying questions when needed, and provide analysis proactively rather than requiring strict question-answer sequences. + ## 5 Whys -Guide users through iterative "why" questions to dig deeper into root causes. +Use iterative "why" questions to dig deeper into root causes. You can: -**Example interaction:** -- User: "The service failed" -- AI: "Why did the service fail?" -- User: "Database connection timeout" -- AI: "Why did the connection timeout?" -- User: "Connection pool exhausted" -- AI: "Why was the pool exhausted?" -- ... (continues until root cause) +- **Analyze from conversation**: If the user has already provided information about what happened, analyze it and identify the chain of "whys" yourself +- **Ask when needed**: Only ask "why" questions if information is missing or unclear +- **Present the chain**: Show the full 5 Whys chain once you have enough information -Continue asking "why" until reaching a root cause that cannot be further decomposed or points to a systemic issue. +**Example:** +If user says "The service failed because database connection timed out", you can analyze: +1. Why did the service fail? → Database connection timeout +2. Why did the connection timeout? → Connection pool exhausted (infer or ask if unclear) +3. Why was the pool exhausted? → Long-running queries blocking connections (infer or ask) +4. Why were there long-running queries? → Missing index on frequently queried column (infer or ask) +5. Why was the index missing? → Database migration script didn't include index creation (root cause) + +Present this analysis and ask for confirmation or clarification if needed. ## Causal Chain -Help users build a chain of causation from symptom to root cause: +Build a chain of causation from symptom to root cause based on available information: ``` Symptom → Immediate Cause → Contributing Factor → Root Cause ``` -Guide users to identify each link in the chain and understand how they connect. +Identify each link from the conversation context. If a link is unclear, ask a specific question about that link rather than going through the whole chain step-by-step. ## Systems Thinking -Prompt users to consider multiple layers: +Analyze across multiple layers based on what the user has shared: - **Technical**: Code, infrastructure, configuration - **Process**: Deployment, monitoring, on-call procedures - **Organizational**: Training, documentation, communication -For each layer, ask: "What gaps or issues exist at this level that contributed to the incident?" +For each layer, identify gaps or issues that contributed to the incident. If information is missing for a layer, ask targeted questions about that specific layer. ## Blameless Reframing -When users provide information that blames individuals, help reframe in blameless terms: +When users provide information that blames individuals, automatically reframe in blameless terms: - ❌ "John deployed the buggy code" - ✅ "The deployment process allowed code without sufficient tests to reach production" -Always ask: "Why did the system/process allow this?" rather than "Why did this person do this?" +Always frame causes in terms of systems and processes, not individuals. Ask: "Why did the system/process allow this?" rather than "Why did this person do this?" + +## Analysis Workflow + +1. **Synthesize available information**: Review what the user has shared about the incident +2. **Identify gaps**: Determine what information is missing for a complete root cause analysis +3. **Ask targeted questions**: Only ask about specific gaps, not the entire chain +4. **Present analysis**: Show your root cause analysis and causal chain +5. **Validate and refine**: Ask if the analysis makes sense or if anything is missing