.md` unless the user names a different location.
-| Dimension | Value |
-|-----------|-------|
-| Affected services | [list] |
-| User-facing impact | [errors / degraded / full outage] |
-| Users affected | [estimated number or %] |
-| Peak error rate | [X% vs Y% baseline] |
-| Data loss | [none / describe scope] |
-| SLA breach | [yes/no — by how much] |
+### Step 8 - Other Output Formats
+Always produce the Markdown source first, then convert only if the user asked.
-## Timeline
+| Format | How |
+|--------|-----|
+| Markdown (default) | The `.md` file from Step 7 |
+| HTML | Write a single self-contained `.html` (inline CSS, no external assets) with the same sections and tables; render the fishbone tree in a `` block |
+| DOCX | Use the repo's `md-to-docx` skill: `node skills/md-to-docx/scripts/md-to-docx.mjs ` (needs `npm install` in that skill's `scripts/` folder once) |
+| PDF | Print the HTML to PDF with a browser, or use a locally available tool such as Pandoc. Check what is installed and tell the user if nothing suitable is available rather than installing anything silently |
-All times UTC.
-
-| Time | Event |
-|------|-------|
-| HH:MM | [First symptom / alert fired] |
-| HH:MM | [On-call paged] |
-| HH:MM | [Incident declared] |
-| HH:MM | [Root cause identified] |
-| HH:MM | [Mitigation applied] |
-| HH:MM | [Full resolution confirmed] |
-| HH:MM | [Customer communication sent] |
-
-## Root Cause
-
-[1–2 paragraphs. The deepest systemic gap that, if fixed, would have prevented the incident. Written in blameless language. Reference the 5 Whys chain if helpful.]
-
-## Contributing Factors
-
-- [Factor 1 — condition that made the incident worse]
-- [Factor 2]
-- [Factor 3]
-
-## What Went Well
-
-- [Thing that worked — good alert, fast response, clear runbook]
-- [Another positive]
-
-## What Could Have Gone Better
-
-- [Gap in process, tooling, or coverage — no blame language]
-- [Another gap]
-
-## Action Items
-
-| # | Action | Owner | Due Date | Priority |
-|---|--------|-------|----------|----------|
-| 1 | [Specific deliverable] | @person | YYYY-MM-DD | High/Medium/Low |
-| 2 | | | | |
-
-## Lessons Learned
-
-[Optional. 2–4 bullet points capturing non-obvious insights worth sharing with the broader team.]
-```
+Confirm the output path(s) to the user at the end.
## Common Mistakes
| Mistake | Fix |
|---------|-----|
| "Bob forgot to check the config" | "The deploy checklist did not include config validation" |
-| Root cause is "human error" | Keep asking Why — human error is always a symptom |
+| Root cause is "human error" | Keep asking Why - human error is always a symptom |
+| Jumping straight to one 5 Whys chain | Fishbone first, then drill the strongest branches |
+| Listing every fishbone idea as a root cause | Only evidence-backed causes get a 5 Whys chain; label the rest suspected or ruled out |
+| Only Prevent action items | Add Detect and Mitigate items too |
| Action items without owners | Every item needs a named individual, not a team |
-| Timeline reconstructed from memory | Check logs, alerts, Slack, PagerDuty before writing |
-| "Improve monitoring" as an action | Specify: which service, which metric, what threshold, by when |
-| Post-mortem written weeks later | Write within 48–72 hours while context is fresh |
+| Timeline reconstructed from memory | Check logs, alerts, chat, and paging history before writing |
+| "Improve monitoring" as an action | Specify which service, metric, threshold, and date |
+| Post-mortem written weeks later | Write within 48-72 hours while context is fresh |
+| Filling gaps with plausible-sounding details | Mark unknowns as open questions |
+
+## Bundled Files
+
+| File | Purpose |
+|------|---------|
+| [references/postmortem-template.md](references/postmortem-template.md) | Google SRE-style post-mortem template to fill in |
+| [references/fishbone-example.md](references/fishbone-example.md) | Worked fishbone + 5 Whys example and rendering format |
diff --git a/skills/incident-postmortem/references/fishbone-example.md b/skills/incident-postmortem/references/fishbone-example.md
new file mode 100644
index 0000000000..bf0a5c5a0c
--- /dev/null
+++ b/skills/incident-postmortem/references/fishbone-example.md
@@ -0,0 +1,81 @@
+# Fishbone + 5 Whys Worked Example
+
+Illustrative data only. Use the incident details the user provides, never this content.
+
+## Problem statement (fishbone head)
+
+Checkout API returned HTTP 500 for 47 minutes for accounts with more than 10k orders.
+
+## Fishbone as an indented tree
+
+```
+Checkout API returned HTTP 500 for 47 minutes
+|
++-- Code & Change
+| +-- [confirmed] v2.14.1 loads full result sets into memory
+| +-- [confirmed] No feature flag, so rollback required a redeploy
++-- Infrastructure & Platform
+| +-- [confirmed] Pod memory limit 512Mi, no headroom for large accounts
+| +-- [ruled out] Node pressure (nodes healthy in dashboards)
++-- Configuration & Data
+| +-- [suspected] A few accounts hold 10x the typical order count
++-- Monitoring & Detection
+| +-- [confirmed] Memory alert threshold at 90%, pods crashed before it fired
+| +-- [confirmed] No alert on pod restart rate
++-- Process & Tooling
+| +-- [confirmed] Load tests cover only the p50 account size
+| +-- [confirmed] No runbook for OOM-killed pods
++-- Dependencies & External
+ +-- [ruled out] Payment provider latency normal
+```
+
+## Fishbone as a table
+
+| Category | Cause | Status | Evidence |
+|----------|-------|--------|----------|
+| Code & Change | v2.14.1 loads full result sets into memory | Confirmed | PR link, heap profile |
+| Code & Change | No feature flag for the new query | Confirmed | Deploy config |
+| Infrastructure & Platform | 512Mi memory limit without headroom | Confirmed | Pod spec, OOMKilled events |
+| Infrastructure & Platform | Node pressure | Ruled out | Node dashboards |
+| Configuration & Data | A few accounts hold 10x the typical order count | Suspected | Needs a data query |
+| Monitoring & Detection | Memory alert at 90% never fired before crash | Confirmed | Alert history |
+| Monitoring & Detection | No alert on pod restart rate | Confirmed | Alert rule inventory |
+| Process & Tooling | Load tests cover only p50 account size | Confirmed | Test suite |
+| Process & Tooling | No OOM runbook | Confirmed | Runbook index |
+| Dependencies & External | Payment provider latency | Ruled out | Provider status page |
+
+## Selecting branches for 5 Whys
+
+Drill the confirmed branches that best explain the impact and the duration:
+
+1. **Code & Change -> Process & Tooling**: why the bad query reached production (explains the trigger).
+2. **Monitoring & Detection**: why it took 31 minutes to notice (explains the duration).
+
+## Chain 1: query reached production (categories: Code & Change, Process & Tooling)
+
+1. Why did users see 500s? -> API pods were crash-looping.
+2. Why were they crash-looping? -> Memory limit exceeded (OOMKilled).
+3. Why was the limit exceeded? -> The new query loaded full result sets into memory.
+4. Why was this not caught before deploy? -> Load tests only covered the p50 account size.
+5. Why did load tests only cover p50? -> No fixtures exist for large accounts, and nothing in the release checklist requires them.
+
+**Root cause 1:** the release process has no required test coverage for high-cardinality accounts.
+
+## Chain 2: slow detection (category: Monitoring & Detection)
+
+1. Why did it take 31 minutes to notice? -> No alert fired until customers reported errors.
+2. Why did no alert fire? -> The memory alert threshold was 90%, and pods were killed before sustained readings reached it.
+3. Why was the threshold set that way? -> It was copied from a service with a different memory profile.
+4. Why was it never revisited? -> Alert thresholds have no review owner or cadence.
+5. Why is there no owner or cadence? -> The alerting standard does not require one.
+
+**Root cause 2:** alert definitions have no ownership or periodic review, and pod restart rate is not monitored.
+
+## Resulting action items (typed)
+
+| # | Action | Type | Owner |
+|---|--------|------|-------|
+| 1 | Add load-test fixtures for accounts > 10k orders and require them in the release checklist | Prevent | @person |
+| 2 | Add an alert on pod restart rate > 3 in 5 min for the checkout service | Detect | @person |
+| 3 | Put the new query behind a feature flag with documented rollback | Mitigate | @person |
+| 4 | Write an OOM-killed-pod runbook and link it from the alert | Mitigate | @person |
diff --git a/skills/incident-postmortem/references/postmortem-template.md b/skills/incident-postmortem/references/postmortem-template.md
new file mode 100644
index 0000000000..428056baef
--- /dev/null
+++ b/skills/incident-postmortem/references/postmortem-template.md
@@ -0,0 +1,121 @@
+# Post-Mortem Template (Google SRE format)
+
+Copy this structure for the final document. Replace every bracketed placeholder with information supplied by the user. Mark anything unknown as `Open question: ...` instead of guessing.
+
+```markdown
+# Post-Mortem: [Incident Title]
+
+| | |
+|---|---|
+| **Date** | YYYY-MM-DD |
+| **Authors** | @name, @name |
+| **Status** | Draft / In review / Final |
+| **Severity** | P[1-4] |
+| **Incident commander** | @name |
+
+## Summary
+
+[2-3 sentences. What happened, the user impact, and how it was resolved. Written for someone who was not involved.]
+
+## Impact
+
+| Dimension | Value |
+|-----------|-------|
+| Affected services | [list] |
+| User-facing impact | [errors / degraded / full outage] |
+| Users affected | [number or %] |
+| Peak error rate | [X% vs Y% baseline] |
+| Data loss | [none / scope] |
+| SLO / SLA | [error budget consumed, breach yes/no] |
+| Business impact | [if known] |
+
+## Root Causes
+
+[One short paragraph per root cause, in blameless language. Each corresponds to a 5 Whys chain below.]
+
+1. **[Root cause 1]** - [one sentence]
+2. **[Root cause 2]** - [if applicable]
+
+## Trigger
+
+[The specific change or event that set the failure in motion, e.g. "Deploy of v2.14.1 at 14:02 UTC enabled the new report query".]
+
+## Detection
+
+[How the incident was detected (alert, customer report, manual). Time from start to detection. What would have detected it sooner.]
+
+## Resolution
+
+[What was done to mitigate and fully resolve. Time from detection to mitigation and to full resolution.]
+
+## Root Cause Analysis
+
+### Problem statement
+
+[The "head" of the fishbone: the observed failure in one line.]
+
+### Fishbone (candidate causes)
+
+[Indented tree, see fishbone-example.md. Mark each cause confirmed / suspected / ruled out.]
+
+| Category | Cause | Status | Evidence |
+|----------|-------|--------|----------|
+| [category] | [cause] | Confirmed / Suspected / Ruled out | [link or note] |
+
+### 5 Whys
+
+#### Chain 1: [branch name] (category: [category])
+
+1. Why [problem]? -> [answer]
+2. Why [answer]? -> [answer]
+3. Why ...? -> [answer]
+4. Why ...? -> [answer]
+5. Why ...? -> [systemic gap that can be fixed]
+
+#### Chain 2: [branch name] (category: [category])
+
+[...]
+
+### Contributing factors
+
+- [Condition that made the incident worse but is not a root cause]
+
+## Action Items
+
+| # | Action | Type (Detect / Mitigate / Prevent) | Owner | Tracking | Due | Priority |
+|---|--------|------------------------------------|-------|----------|-----|----------|
+| 1 | [Specific deliverable] | Prevent | @person | PROJ-123 or TBD | YYYY-MM-DD | High |
+
+## Lessons Learned
+
+### What went well
+
+- [Good alert, fast response, clear runbook]
+
+### What went wrong
+
+- [Gap in process, tooling, or coverage, no blame language]
+
+### Where we got lucky
+
+- [Things that limited the impact by chance rather than design]
+
+## Timeline
+
+All times UTC.
+
+| Time | Event | Source |
+|------|-------|--------|
+| HH:MM | [First symptom] | [link] |
+| HH:MM | [Trigger] | [link] |
+| HH:MM | [Alert fired / noticed] | [link] |
+| HH:MM | [On-call paged, incident declared] | [link] |
+| HH:MM | [Root cause identified] | [link] |
+| HH:MM | [Mitigation applied] | [link] |
+| HH:MM | [Full resolution confirmed] | [link] |
+| HH:MM | [Customer communication sent] | [link] |
+
+## Supporting Information
+
+- [Dashboards, logs, chat threads, tickets, related post-mortems]
+```