What changed before it broke, drafted as a postmortem.
Incident brief is an AI agent that starts the incident postmortem for you. Describe what broke and it lists everything that changed in GitHub in the last 48 hours, finds related open issues, ranks likely suspects as hypotheses, drafts a postmortem skeleton in Notion and posts the suspects in Slack.
- 09:24Mentioned: checkout slow
- 09:2414 PRs, 4 releases found
- 09:25Searched related issues
- 09:25Drafted in Notion
- 09:26Posted 3 suspects
Why is the first hour of an incident so slow?
Because before anyone can fix it, someone has to work out what changed. That means scrolling merged pull requests, checking which release went out, and searching for an issue someone filed last week. The postmortem waits until days later, written from memory, with the timeline half guessed.
Without it
- The first hour spent scrolling merged pull requests.
- A release from yesterday nobody thinks to check.
- The postmortem started days later, from memory.
- Guesses passed around as the cause.
With Incident brief
- Every change in the last 48 hours, in one list.
- Related open issues found from the symptom.
- Suspects ranked, each labelled a hypothesis.
- A postmortem draft waiting in Notion.
What goes into an incident postmortem draft?
Four things GitHub can answer in the first hour, so the people on call can spend it on the fix.
What changed
Merged pull requests, releases and commits to main in the last 48 hours, each with its time.
Related issues
Open issues whose words match the symptom, so a known problem isn't rediscovered.
Likely suspects
Changes ranked by fit and timing, each written as a hypothesis, never a cause.
Open questions
What GitHub can't answer: exact start, what's deployed, where the delay sits.
How does an AI incident postmortem work?
Every run follows the same five steps. GitHub is only read; the draft is written once, as a new Notion page, then the suspects go to Slack.
- 1
Lists what merged
Pull requests merged in the 48 hours before now, with times in UTC and yours.
GitHub - 2
Lists releases and commits
Releases published in the window, and commits to main that weren't pull requests.
GitHub - 3
Searches related issues
Open issues matching the symptom's words, one search at a time, up to four.
GitHub - 4
Drafts the postmortem
Summary, timeline with unknowns marked, what changed, suspects and open questions.
Notion - 5
Posts the suspects
Each one a hypothesis, ranked by fit and timing, with the page link.
Slack
- @incident-brief checkout pages are slow since 9am
- Run when another system calls its webhook with what broke and when
From one sentence to a postmortem draft.
Describe the job, let Arclyx draft the agent, test it once on a drill, create it, then read what lands in #incidents. The full draft waits in Notion.
Paste the sentence. Arclyx picks the tools it needs and asks what it can't work out.
What should it do?
When I describe an incident, list what changed in our GitHub repository in the last 48 hours (merged PRs, releases, commits to main), find related open issues, and draft a postmortem skeleton as a new Notion page under Incidents: timeline, what changed, likely suspects and open questions. Post the likely suspects and the page link to #incidents.
- Tools it can use
- GitHub
- Notion
- Slack
- Which Notion page should postmortems go under?
- Incidents, in our engineering space
It writes the instructions, and you sign in to each tool once. Nothing runs until you say so.
- Reading your description
- Writing the instructions
- Picking the tools
Incident brief
- GitHub
- Notion
- Slack
When you describe an incident
Try it once as a dry run. It reads your real tools, and what it would post is shown to you, not posted.
- Lists what mergedGitHub · Search pull requests
- Lists releases and commitsGitHub · List releases ×2
- Searches related issuesGitHub · Search issues
- Drafts the postmortemNotion · Create page
- Posts the suspectsSlack · Post
Once it's created, the output lands where you said, with a source for every item.
Merged at 8:40, twenty minutes before the reported start.
Hypothesis: an extra call on every checkout. Not confirmed as deployed.
↗ example-a.com/pull/524Merged 15 hours before the start, so a weaker timing match.
Hypothesis: building the index slowed writes to orders.
↗ example-a.com/pull/517The closest release before the start; its contents weren't inspected.
Open question: which version is running, and since when?
↗ example-a.com/releases/v0.9.4An open issue that matches 'checkout' and 'slow'.
Linked in the draft for whoever picks it up.
↗ example-a.com/issues/388
One draft, four readers.
The same postmortem draft answers a different question for each person in the incident.
On-call engineers
What changed in the last 48 hours, before they open GitHub.
Engineering managers
A postmortem started while the incident is still fresh.
Tech leads
The suspects ranked, each with its timing and a hypothesis.
Support
The open issues that match what customers are reporting.
How do you write an incident postmortem with AI?
Start from what changed. Describe the incident to an AI agent, let it list the last 48 hours of merged pull requests, releases and commits, find related open issues and draft the timeline and suspects as hypotheses. Your team confirms the cause and adds the actions. In Arclyx that's five steps, starting with one sentence.
“When I describe an incident, list what changed in our GitHub repository in the last 48 hours (merged PRs, releases, commits to main), find related open issues, and draft a postmortem skeleton as a new Notion page under Incidents: timeline, what changed, likely suspects and open questions. Post the likely suspects and the page link to #incidents.”
- 1
Describe the job
One sentence: which repository, which Notion page postmortems go under, and where the suspects go.
- 2
Connect GitHub and Notion
The agent gets GitHub tools that list, search and read, and a Notion tool that only creates new pages.
- 3
Name the parent page
Every draft lands under that page, and the agent checks its title before writing.
- 4
Run a drill
Optional. A dry run on a made-up incident holds the page and shows the suspects first.
- 5
Mention it when something breaks
@mention it in Slack with the symptom and roughly when it started.
Or start from one of these sentences
“When I describe an incident, list what merged and was released in our repository in the last 12 hours and send me the three likeliest suspects.”
“When I describe an incident, list what changed in our app and API repositories in the last 48 hours and draft the postmortem in Notion.”
“When I name a release, list the pull requests in it and any open issue that mentions the same areas, and post them to #incidents.”
“Every Monday at 10, list last week's postmortem drafts in Notion with their open questions, and post them to #eng-leads.”
AI postmortem draft vs a blank template.
A postmortem template and scrolling GitHub by hand each cover part of the job. Here is what each one does, and doesn't, do.
| Postmortem template | Scrolling GitHub | Incident brief | |
|---|---|---|---|
| What changed in 48 hours | You fill it in | Yes, page by page | Listed, with times |
| Related open issues | You search | If you think to search | Found from the symptom |
| Suspects | A blank section | Whatever stands out | Ranked, each a hypothesis |
| Timeline | A blank table | No | Drafted, unknowns marked |
| Where it lands | A doc you copy | Your head | A Notion page and one Slack message |
Source: Google SRE book: example postmortem, checked 24 October 2026.
Is it safe to give an AI agent your GitHub during an incident?
It reads your repository, creates one page under the Notion page you choose and writes one message. Every run is recorded and has a spend ceiling by default.
Every run is recorded
Every step, in order
Every run records the tools it called, with a short preview of each result. Only the person who started a run can open its content.
Hypotheses, not causes
Its instructions say to label every suspect a hypothesis and mark anything it couldn't verify as unknown.
What each run cost
Tokens and cost are recorded per run and per agent, next to your plan's limits.
A spend ceiling, on by default
Each run has a dollar ceiling unless you remove it. A run stops before it goes over it, and tells you.
It can
- List merged pull requests, releases and commits
- Search and read open issues
- Create new Notion pages, under the page you name
- Post to one Slack channel you name, message you, or email you
It can't
- Revert, merge or push a change
- Comment on or open an issue
- Read logs, metrics or alerts
- Edit, move or delete a Notion page
- Email anyone but you
Questions about incident postmortems.
What goes in an incident postmortem?
What happened, when, why and what you'll change. Incident brief drafts the parts GitHub can answer: an incident summary, a timeline with unknowns marked, what changed in the last 48 hours, related open issues, likely suspects and open questions. Your team adds the root cause and actions.
Does it find the root cause?
No. It ranks suspects by how well a change's title matches the symptom and how its timing fits, and labels every one a hypothesis. When nothing lines up cleanly with the start, it says so instead of picking one.
Which changes does it look at?
Pull requests merged, releases published and commits to main that weren't pull requests, in the 48 hours before the run. It lists up to 30 pull requests and 50 commits and says if there were more.
Does it read logs, metrics or alerts?
No. It reads your GitHub repository only. Whether a change is deployed, what the logs show and where the delay sits go into the draft's open questions for the person on call.
Can it roll back or revert a change?
No. It's given only GitHub tools that list, search and read. It can't revert, merge, comment, open an issue or push.
Where does the draft go?
A new Notion page under the page you name, titled with the incident and the date. It checks that page's title first, and after writing it fetches the new page to confirm where it landed. It never edits an existing page.
What if the description is vague?
Its instructions tell it to stop and ask for the symptom and roughly when it started, rather than draft a postmortem around a guess.
Do I need to write code?
No. Describe the job in one sentence. Arclyx drafts the agent, you sign in to GitHub, Notion and Slack once, and you @mention it with what broke.
Agents that work well with it.
Build your incident brief.
One sentence in, a working agent out. Join the beta and we'll set you up.