FREESKILL v1.0UPDATED 2026-08

Correction of Errors

A Correction of Errors document connects impact, evidence, response, cause, and prevention without inventing a root cause or turning a person into one.

Incident reviews become unreliable when a hypothesis hardens into fact, the timeline mixes timezones, or corrective actions have no trace back to the analysis.

This playbook drafts or audits a COE with confirmed, disputed, and unknown evidence kept separate. The causal chain stops at the first unsupported link, then assigns the investigation and verification needed to move it forward.

Five whys is a prompt, not a quota. Stop where the evidence stops.

SIGNALS YOU NEED THIS

A root cause is named before the incident timeline is stable.

The review blames an operator but does not examine the system around the action.

Corrective actions are vague, unowned, or disconnected from a finding.

REPLACES

Blame documents, speculative root causes, and action lists that cannot prove recurrence risk changed.

PAIRS WITH

Post Mortems, Standard Operating Procedures, Done, and Business Writing.

0 of 4 steps complete

STEP 01Set the incident and impact boundary

Name the event, start and end, affected service or process, timezone, document owner, and known operational or customer impact. Keep unknown scope explicit.

INCIDENT
  Scheduled west-region reports did not run.
  Start: August 4, 09:10 MT
  Restored: August 4, 12:05 MT
  Customer scope: Unknown
  Document owner: Operations lead

STEP 02Reconstruct detection and response

Record how the event was found, contained, restored, and communicated. Use one timezone per timestamp and separate detection from restoration.

TIMELINE, MT
  09:10  Reports stopped.
  10:40  Analyst detected the failure.
  11:52  Worker restart began.
  12:05  Processing restored.

STEP 03Trace cause only as far as evidence allows

Build the why chain from supported facts toward a system or process condition the team can change. A hypothesis stays labeled, and an unsupported link becomes an investigation action.

CAUSAL CHAIN
  Reports were delayed because the scheduled worker stopped.
  Why the worker stopped: Evidence needed.

INVESTIGATION
  Owner: Owner needed
  Due: Date needed
  Evidence: worker logs and runtime state

STEP 04Connect actions to findings and closure proof

Cover containment, prevention, and faster detection where applicable. Each action needs a finding, owner, due date, verification method, status, and closure authority.

ACTION
  Add temporary worker-stoppage detection.
  Finding: failure was detected manually after 90 minutes.
  Owner: Owner needed
  Due: Date needed
  Verification: controlled alert test
  Status: open

Download the folder into your agent's skills directory. It uses only the material you provide and makes no remote calls.

skills/correction-of-errors

correction-of-errors/
├── SKILL.md                         ← draft and audit modes
├── meta.yaml                        ← version, sources, test prompts, changelog
├── LICENSE.md                       ← MIT
├── assets/
│   ├── correction-of-errors-template.md ← incident document
│   └── coe-audit-scorecard.md       ← causal and action audit
└── references/
    └── root-cause-guide.md          ← evidence-backed why chains

INVOKE IT LIKE THIS

"Run a COE on this incident."

Download skill v1.0 View source files

WORKS WITHClaude Code