# What changed before it broke, drafted as a postmortem. Incident brief is an AI agent that starts the incident postmortem for you. Describe what broke and it lists everything that changed in GitHub in the last 48 hours, finds related open issues, ranks likely suspects as hypotheses, drafts a postmortem skeleton in Notion and posts the suspects in Slack. ## Why is the first hour of an incident so slow? Because before anyone can fix it, someone has to work out what changed. That means scrolling merged pull requests, checking which release went out, and searching for an issue someone filed last week. The postmortem waits until days later, written from memory, with the timeline half guessed. Without it: - The first hour spent scrolling merged pull requests. - A release from yesterday nobody thinks to check. - The postmortem started days later, from memory. - Guesses passed around as the cause. With Incident brief: - Every change in the last 48 hours, in one list. - Related open issues found from the symptom. - Suspects ranked, each labelled a hypothesis. - A postmortem draft waiting in Notion. ## What goes into an incident postmortem draft? Four things GitHub can answer in the first hour, so the people on call can spend it on the fix. ### What changed Merged pull requests, releases and commits to main in the last 48 hours, each with its time. For example: Pull requests, Releases, Commits. ### Related issues Open issues whose words match the symptom, so a known problem isn't rediscovered. For example: Open issues, Symptom words. ### Likely suspects Changes ranked by fit and timing, each written as a hypothesis, never a cause. For example: Timing, Fit, Hypothesis. ### Open questions What GitHub can't answer: exact start, what's deployed, where the delay sits. For example: Deployed?, Start time. ## How does an AI incident postmortem work? Every run follows the same five steps. GitHub is only read; the draft is written once, as a new Notion page, then the suspects go to Slack. 1. **Lists what merged** (GitHub, reads): Pull requests merged in the 48 hours before now, with times in UTC and yours. 2. **Lists releases and commits** (GitHub, reads): Releases published in the window, and commits to main that weren't pull requests. 3. **Searches related issues** (GitHub, reads): Open issues matching the symptom's words, one search at a time, up to four. 4. **Drafts the postmortem** (Notion, drafts): Summary, timeline with unknowns marked, what changed, suspects and open questions. 5. **Posts the suspects** (Slack, posts): Each one a hypothesis, ranked by fit and timing, with the page link. When it runs: - @mention: @incident-brief checkout pages are slow since 9am - Webhook: Run when another system calls its webhook with what broke and when ## From one sentence to a postmortem draft. Describe the job, let Arclyx draft the agent, test it once on a drill, create it, then read what lands in #incidents. The full draft waits in Notion. Example output in #incidents, "Postmortem draft · checkout slow since 9:00 · 14 PRs and 4 releases in 48 hours" (placeholder companies): - Suspect 1 · #524 Add tax lookup to checkout: Merged at 8:40, twenty minutes before the reported start. Hypothesis: an extra call on every checkout. Not confirmed as deployed. Source: example-a.com/pull/524 - Suspect 2 · #517 New index on the orders table: Merged 15 hours before the start, so a weaker timing match. Hypothesis: building the index slowed writes to orders. Source: example-a.com/pull/517 - Suspect 3 · API v0.9.4 release: The closest release before the start; its contents weren't inspected. Open question: which version is running, and since when? Source: example-a.com/releases/v0.9.4 - Related issue · #388 Checkout times out for large carts: An open issue that matches 'checkout' and 'slow'. Linked in the draft for whoever picks it up. Source: example-a.com/issues/388 Draft in Notion under Incidents · 3 suspects, each a hypothesis · deploys and logs left as open questions ## One draft, four readers. The same postmortem draft answers a different question for each person in the incident. - On-call engineers: What changed in the last 48 hours, before they open GitHub. - Engineering managers: A postmortem started while the incident is still fresh. - Tech leads: The suspects ranked, each with its timing and a hypothesis. - Support: The open issues that match what customers are reporting. ## How do you write an incident postmortem with AI? Start from what changed. Describe the incident to an AI agent, let it list the last 48 hours of merged pull requests, releases and commits, find related open issues and draft the timeline and suspects as hypotheses. Your team confirms the cause and adds the actions. In Arclyx that's five steps, starting with one sentence. 1. **Describe the job**: One sentence: which repository, which Notion page postmortems go under, and where the suspects go. 2. **Connect GitHub and Notion**: The agent gets GitHub tools that list, search and read, and a Notion tool that only creates new pages. 3. **Name the parent page**: Every draft lands under that page, and the agent checks its title before writing. 4. **Run a drill**: Optional. A dry run on a made-up incident holds the page and shows the suspects first. 5. **Mention it when something breaks**: @mention it in Slack with the symptom and roughly when it started. The sentence that built it (@mention, When you describe an incident): > When I describe an incident, list what changed in our GitHub repository in the last 48 hours (merged PRs, releases, commits to main), find related open issues, and draft a postmortem skeleton as a new Notion page under Incidents: timeline, what changed, likely suspects and open questions. Post the likely suspects and the page link to #incidents. ### Or start from one of these sentences - Shorter window: "When I describe an incident, list what merged and was released in our repository in the last 12 hours and send me the three likeliest suspects." - Two repositories: "When I describe an incident, list what changed in our app and API repositories in the last 48 hours and draft the postmortem in Notion." - Deploy check: "When I name a release, list the pull requests in it and any open issue that mentions the same areas, and post them to #incidents." - Weekly review: "Every Monday at 10, list last week's postmortem drafts in Notion with their open questions, and post them to #eng-leads." ## AI postmortem draft vs a blank template. A postmortem template and scrolling GitHub by hand each cover part of the job. Here is what each one does, and doesn't, do. | What you need | Postmortem template | Scrolling GitHub | Incident brief | | --- | --- | --- | --- | | What changed in 48 hours | You fill it in | Yes, page by page | Listed, with times | | Related open issues | You search | If you think to search | Found from the symptom | | Suspects | A blank section | Whatever stands out | Ranked, each a hypothesis | | Timeline | A blank table | No | Drafted, unknowns marked | | Where it lands | A doc you copy | Your head | A Notion page and one Slack message | Source: [Google SRE book: example postmortem](https://sre.google/sre-book/example-postmortem/), checked 24 October 2026. ## Is it safe to give an AI agent your GitHub during an incident? It reads your repository, creates one page under the Notion page you choose and writes one message. Every run is recorded and has a spend ceiling by default. ### Every run is recorded - Every step, in order: Every run records the tools it called, with a short preview of each result. Only the person who started a run can open its content. - Hypotheses, not causes: Its instructions say to label every suspect a hypothesis and mark anything it couldn't verify as unknown. - What each run cost: Tokens and cost are recorded per run and per agent, next to your plan's limits. - A spend ceiling, on by default: Each run has a dollar ceiling unless you remove it. A run stops before it goes over it, and tells you. ### It can - List merged pull requests, releases and commits - Search and read open issues - Create new Notion pages, under the page you name - Post to one Slack channel you name, message you, or email you ### It can't - Revert, merge or push a change - Comment on or open an issue - Read logs, metrics or alerts - Edit, move or delete a Notion page - Email anyone but you ## Questions about incident postmortems. ### What goes in an incident postmortem? What happened, when, why and what you'll change. Incident brief drafts the parts GitHub can answer: an incident summary, a timeline with unknowns marked, what changed in the last 48 hours, related open issues, likely suspects and open questions. Your team adds the root cause and actions. ### Does it find the root cause? No. It ranks suspects by how well a change's title matches the symptom and how its timing fits, and labels every one a hypothesis. When nothing lines up cleanly with the start, it says so instead of picking one. ### Which changes does it look at? Pull requests merged, releases published and commits to main that weren't pull requests, in the 48 hours before the run. It lists up to 30 pull requests and 50 commits and says if there were more. ### Does it read logs, metrics or alerts? No. It reads your GitHub repository only. Whether a change is deployed, what the logs show and where the delay sits go into the draft's open questions for the person on call. ### Can it roll back or revert a change? No. It's given only GitHub tools that list, search and read. It can't revert, merge, comment, open an issue or push. ### Where does the draft go? A new Notion page under the page you name, titled with the incident and the date. It checks that page's title first, and after writing it fetches the new page to confirm where it landed. It never edits an existing page. ### What if the description is vague? Its instructions tell it to stop and ask for the symptom and roughly when it started, rather than draft a postmortem around a guess. ### Do I need to write code? No. Describe the job in one sentence. Arclyx drafts the agent, you sign in to GitHub, Notion and Slack once, and you @mention it with what broke. ## Agents that work well with it - [Release writer](https://arclyx.ai/agents/release-notes): Customer-facing notes for every release, drafted - [Issue triage](https://arclyx.ai/agents/issue-triage): New issues, likely duplicates and stale ones, every Monday - [Async standup](https://arclyx.ai/agents/async-standup): Yesterday's merges and stuck reviews, every morning [AI for engineering teams](https://arclyx.ai/solutions/engineering): AI for engineering teams that writes what surrounds shipping, from GitHub: the standup, the weekly report, release notes, postmortem drafts and issue triage. ## Early access Build your incident brief. One sentence in, a working agent out. Join the beta and we'll set you up. Join at https://arclyx.ai/#join or write to hello@arclyx.ai. Last updated 24 October 2026.