Aftermath

Overview

The Problem

Small teams still have real incidents, but the tooling around them is usually built for larger organizations. The response happens in Slack, a few links get pasted into a thread, someone rolls back a deploy, and the post-mortem is written later from memory.

That is enough to recover once. It is not enough to build a useful record. The next engineer or coding agent trying to understand a similar failure has to reconstruct the same context again.

The bet

If incident context is captured while the team is already responding, the post-incident record can become a durable asset instead of a cleanup chore.

What I Built

• Cues that open an incident from a manual report, webhook, Sentry alert, or PagerDuty event
• Live Stage, a real-time incident page for severity, affected services, links, Slack context, and timeline events
• Encore, an AI-drafted post-mortem with summary, impact, root cause, resolution, lessons, and follow-ups
• Playback, a searchable incident memory that keeps published post-mortems useful after the incident closes
• Agent access for checking related incidents before a PR, finding a similar past outage, or drafting a runbook from history

The Tradeoff

The product has to avoid becoming another incident response system. PagerDuty, incident.io, Rootly, Slack, and observability tools already own parts of that workflow. Aftermath works best when it sits beside them: collecting useful signal, structuring the record, and making past incidents easy to reuse.

That constraint shaped the build. I kept the core loop narrow: open an incident, capture the timeline, draft the post-mortem, publish it into Playback, and expose that memory to people and agents. The deeper technical pieces stay behind the scenes so the showcase can stay focused on the product shape.

Why I Stopped

The product reached a working state. Cue through Live Stage, Encore, and Playback were built, along with Slack capture, GitHub and alerting monitors, Situation Rooms, and agent access over MCP. I dogfooded the loop on my own projects and ran research calls with lean teams. The problem was real; the build held together.

What did not hold together was distribution. Aftermath sits beside existing incident tools, which means the buyer already pays for PagerDuty, Sentry, or incident.io. That is a reasonable wedge for a memory layer, but it also narrows who will add another line item. Research calls confirmed the pain, but not a path I could reach without an enterprise sales motion, a content engine, or a partner channel I did not have.

I could keep building features. I could not see an accessible go-to-market strategy: one I could run solo, on a founder budget, without pretending product-led growth would carry a product that needs team adoption during an incident workflow. Shutting down was the honest call.

What Stayed Online

Closing the company did not mean the domain had to go dark. In July 2026 I republished aftermath.sh as a portfolio piece: Open Playback, the Playback and Encore parts of the product pointed at public incident write-ups instead of a customer's private ones.

Each encore is a public post-mortem from GitHub, Cloudflare, Linear, Honeycomb, and others, normalized into the structure the product produced: severity, start time and duration, blast radius, affected services, and tags, then summary, impact, root cause, resolution, and a phased timeline (detect, investigate, mitigate) with the service each event touched. The corpus holds 32 encores at the time of writing, browsable by tag, each linking back to its source.

The agent access survived too. OpenMCP is a free MCP server over the corpus, with no account required. Add it to Claude or Cursor and ask how production actually breaks: cache stampedes, BGP misconfigurations, DNS resolution failures, runaway cleanup jobs.

jsoncopy
{
  "open-playback": {
    "type": "http",
    "url": "https://open-mcp.aftermath.sh/"
  }
}

The hosted incident product (Cues, Live Stage, Situation Rooms, Slack capture) is not offered. What remains is the part of the build that never needed team adoption to be useful: a structured record of how real systems failed, readable by people and by agents.

Status

Aftermath the company is closed. The site stays up as Open Playback, a free portfolio piece. This case study records what I built, why I stopped, and what I kept online.

• Incident response
• Developer tools
• AI