The Coroner: Full Program Edition

The free Coroner skill investigates a production incident and produces a post-mortem. The Full Program Edition turns that into a program: persistent case history, pattern detection across incidents, and direct integration with your deployment checklist so the same failure does not happen twice.

The most expensive incident is the one you have for the second time. The Full Program Edition tracks every post-mortem in a persistent INCIDENT_LOG.md, runs a cross-incident pattern analysis on each new investigation, and flags when the root cause of a new incident resembles a root cause you have already resolved once. It also connects to The Architect's deploy checklist: action items that surface during an investigation can be added directly as checklist steps, so future deploys are guarded against the same failure class.

For operators running a Greyline security program, The Coroner also writes security-relevant findings to WARDEN_LOG.md automatically, creating a closed loop between incident response and the security posture tracker.

::WHAT'S INCLUDED::

The full SKILL.md with all six investigation procedures

INCIDENT_LOG.md template with structured fields for case tracking across incidents: timeline, blast radius, root cause, action items, status

Cross-incident pattern analysis that compares new incidents against prior cases and flags recurring root cause classes

Architect integration for writing action items directly into pre-deploy checklist steps (requires The Architect)

Greyline: Warden integration for writing security findings to WARDEN_LOG.md (requires Greyline: Warden)

Severity escalation matrix with P0/P1/P2/P3 definitions, expected response times, and stakeholder communication templates

Prior action item audit: on each new investigation, checks whether any open action item from a prior incident contributed to this one

START-HERE.md with setup instructions for OpenClaw, Claude Code, and Claude Desktop

::WHO IS THIS FOR?::

Operators who have had the same production incident more than once. Teams without a formal incident response process who want one that fits inside their existing Claude Code workflow. Founders running a small but production-grade system who need post-mortems that are rigorous enough to actually prevent recurrence.