{
  "title": "Incident Post-mortem",
  "description": "Captures the timeline, contributing factors, detection gap, and the team's honest read on root cause — not just the proximate trigger. Designed to surface patterns across incidents when synthesized.",
  "language": "en",
  "questions": [
    {
      "hint": "Include timing, what you were looking at, and what your initial read was.",
      "text": "Walk me through the incident from your vantage point. What did you first notice, and when?",
      "type": "text",
      "order": 1,
      "required": true
    },
    {
      "hint": "Think about: missing safeguards, knowledge gaps, deployment process, monitoring gaps, architectural assumptions.",
      "text": "What do you think actually caused this — not just the proximate trigger, but the conditions that made the trigger possible?",
      "type": "text",
      "order": 2,
      "required": true
    },
    {
      "hint": "Consider alerting thresholds, on-call coverage, customer reports, internal dashboards. What would have caught it sooner?",
      "text": "How did we find out something was wrong? Was that fast enough?",
      "type": "text",
      "order": 3,
      "required": true
    },
    {
      "hint": "Think about downtime duration, data affected, number of users impacted.",
      "text": "How would you rate the severity of the impact on users or the business?",
      "type": "rating_scale",
      "order": 4,
      "options": {
        "max": 5,
        "min": 1,
        "maxLabel": "Critical impact",
        "minLabel": "Minimal impact"
      },
      "required": true
    },
    {
      "hint": "Runbook gaps, unclear ownership, tooling issues, needing to wake someone up to ask a question — anything that slowed the fix.",
      "text": "What made the response harder than it needed to be?",
      "type": "text",
      "order": 5,
      "required": true
    },
    {
      "hint": "Even a loose resemblance counts — same system, same class of failure, same team involvement.",
      "text": "Have we seen something similar before? If so, did we think we'd fixed it?",
      "type": "text",
      "order": 6,
      "required": false
    },
    {
      "hint": "Be specific. 'Better monitoring' is less useful than 'alert when the queue depth exceeds 10k for more than 2 minutes'.",
      "text": "What's the one change that would most reduce the chance of this class of incident happening again?",
      "type": "text",
      "order": 7,
      "required": true
    }
  ]
}