Postmortem Timeline is the chronological view of one incident from page to resolution. Every signal that fired, every agent decision, every approval, every action, every human comment, in order, with timestamps. The page is the artifact a postmortem reader opens first; the rest of the postmortem document references it.
Five event types appear on every timeline. (1) Signals: alerts, predictions, SLO breaches. (2) Decisions: every agent decision, every operator action. (3) Actions: tool calls, deploys, rollbacks. (4) Approvals: human sign-offs. (5) Comments: human notes added by responders during the incident. All five interleave chronologically.
The timeline assembles automatically from the underlying ledgers. Agent Ledger contributes decisions and actions. Audit Logs contribute approvals. The on-call system contributes ack/handoff events. Operator comments are captured during the incident via Slack reactions or a quick-note widget. By the time the incident closes, the timeline is ready.
When the incident closes, the timeline is hashed and frozen. The frozen timeline is what the postmortem document references. Future agent activity on related services does NOT appear on the frozen timeline. Snapshots are immutable so the postmortem stays accurate even months later.
Scrub mode lets you step through the timeline frame by frame. Pause, rewind, step forward through every event. Useful for teaching new on-call engineers what happened during a memorable incident; useful for auditors verifying a sequence of approvals. Scrubbing does not change anything; the timeline is read-only after freeze.
Subscribe to Nova AI Ops on YouTube for demos, tutorials, and feature deep-dives.
The timeline is the work of a postmortem. The page does the work; you write the analysis.