magnus919_agent-skills/incident-learning/references/discovery-brief.md

Discovery Brief: Incident Learning

Survey scope

This brief surveys adjacent skills in the agent-skills catalog to define the ownership boundaries of incident-learning. The goal is to own the conversion of operational incident evidence into verified, owned follow-up work — without duplicating incident command, postmortem facilitation, test design, eval implementation, product-outcome review, delivery planning, resilience exercise design, or production-readiness decisions.

Skills surveyed

site-reliability-engineering

What SRE owns: Incident command, on-call operations, SLO/SLI framework, error budget governance, blameless postmortems, monitoring and alerting, toil elimination, and product-focused reliability.

Boundary: SRE owns the live operational response to incidents — the incident command system, real-time alerting, postmortem facilitation, and postmortem document production. It does not own the post-postmortem learning pipeline: converting postmortem findings into verified, cross-domain follow-up work with closure evidence. SRE's postmortem process produces action items; incident-learning owns the structured record that separates evidence from inference, maps escaped-from gaps, assigns domain-specific follow-up work, and tracks each finding to verified closure.

Routing decision: Incident-learning routes live incident command, on-call operations, and postmortem facilitation to SRE. SRE's incident-command and postmortem references are the authoritative sources for incident response and postmortem production. Incident-learning owns the learning pipeline that consumes postmortem output and produces verified, owned improvements.

qa-methodology

What QA methodology owns: Test strategy, regression testing, CI failure triage, test automation, quality gates and metrics, risk-based testing, exploratory testing, mutation-guided test hardening, agentic eval design, and SDET engineering.

Boundary: QA methodology owns the design and implementation of tests. Incident-learning owns the identification of test gaps from incident evidence and the mapping of those gaps to test follow-up work. When an incident reveals missing regression coverage, weak assertions, or untested failure paths, incident-learning records the gap and creates a test-domain follow-up item; QA methodology designs and implements the test that closes it. Incident-learning verifies closure — it confirms the test was added and catches the failure mode — but does not design the test itself.

Routing decision: Incident-learning routes test design and implementation to QA methodology. Incident-learning owns the gap identification, follow-up work mapping, and closure verification. QA methodology owns the test design and implementation that satisfies the follow-up work.

verification-methodology

What verification methodology owns: Pass/fail assessment against explicit criteria using direct, source-faithful evidence, reproducible checks, and clear verdicts.

Boundary: Verification methodology owns the protocol for producing verification evidence — the method for checking whether a change satisfies its criteria. Incident-learning owns the closure standard that requires verification evidence and the closure record that holds it. Every incident-learning follow-up work item has a verification method field; verification-methodology provides the protocol for executing that verification and producing the evidence. Incident-learning does not re-derive the verification protocol; it consumes the verdict.

Routing decision: Incident-learning routes verification execution to verification-methodology. Incident-learning owns the closure standard (what constitutes verified closure) and the closure record; verification-methodology owns the verification protocol that produces the evidence.

agent-evals-and-observability

What agent evals and observability owns: Evaluation design, dataset management, grader selection and calibration, trajectory review, regression analysis, release gates, production traces, and privacy-aware telemetry for AI agents.

Boundary: Agent evals and observability owns the design and operation of agent evaluation systems. Incident-learning owns the identification of eval gaps from agent incidents — missing eval cases, inadequate grader coverage, unobserved failure modes, dataset blind spots. When an agent incident reveals that an eval case would have caught the failure, incident-learning records the gap and creates an evals-domain follow-up item; agent-evals-and-observability designs and implements the eval. Incident-learning verifies closure: the eval case exists and catches the failure mode.

Routing decision: Incident-learning routes eval design and implementation to agent-evals-and-observability. Incident-learning owns the gap identification, follow-up work mapping, and closure verification. Agent-evals-and-observability owns the eval design and implementation.

product-lifecycle-learning

What product lifecycle learning owns: Post-launch outcome review, evidence-backed assumption ledger, feature health assessment, continue/improve/harvest/pivot/pause/retire decisions, and retirement lifecycles with deprecation and migration.

Boundary: Product lifecycle learning owns the product-outcome learning loop — comparing intended outcomes against observed results and making lifecycle decisions. Incident-learning owns the incident-to-product-improvement pipeline. When an incident reveals a product assumption failure (a feature used differently than intended, a user need that was missed, a design choice that produced operational risk), incident-learning records the gap and creates a product-domain follow-up item; product-lifecycle-learning updates the assumption ledger and assesses feature health. The two skills meet at the product-domain follow-up: incident-learning identifies the product gap; product-lifecycle-learning owns the assumption-update and lifecycle decision.

Routing decision: Incident-learning routes product assumption updates and lifecycle decisions to product-lifecycle-learning. Incident-learning owns the incident-to-product-gap mapping; product-lifecycle-learning owns the assumption ledger and feature-health decisions.

implementation-planning

What implementation planning owns: Delivery planning for approved requirements, work breakdown, dependency mapping, critical path, ownership, parallelism and sequencing, rollout strategy, rollback and recovery paths, and verification against the original requirement.

Boundary: Implementation planning owns the coordinated delivery of cross-domain, cross-team follow-up work. Incident-learning owns the follow-up work map — identifying what needs to be done and in which domain. When follow-up work spans multiple teams or repositories, incident-learning's follow-up work map feeds into implementation-planning's delivery plan. Implementation-planning sequences and coordinates the work; incident-learning tracks each item to verified closure.

Routing decision: Incident-learning routes cross-team, multi-repo follow-up coordination to implementation-planning. Incident-learning owns the follow-up work identification and closure tracking; implementation-planning owns the delivery coordination.

resilience-and-recovery

What resilience-and-recovery owns: Resilience design, failure-mode analysis, graceful degradation, RTO/RPO decision records, restore testing, game days, failover drills, data integrity verification, and recovery communication.

Boundary: Resilience-and-recovery owns the pre-incident resilience design and exercise-evidence method. Incident-learning owns the post-incident and post-exercise learning pipeline. Exercise and DR test findings feed into incident-learning for cross-incident pattern analysis and verified follow-up closure. A game day that exposes a restore gap produces findings in resilience-and-recovery's follow-up work ledger; incident-learning consumes those findings, enriches them with the evidence/inference/uncertainty taxonomy, maps escaped-from gaps, and tracks closure with verification evidence.

Routing decision: Incident-learning consumes exercise and DR findings from resilience-and-recovery. Resilience-and-recovery owns the exercise design and finding capture; incident-learning owns the cross-incident pattern analysis and verified closure pipeline. The two skills are complementary: resilience-and-recovery produces exercise findings; incident-learning converts them into verified, domain-mapped improvements.

production-readiness

What production-readiness owns: Minimum production evidence packet by risk class, go/no-go/defer/exception launch decisions, cross-domain evidence assembly with named sources or explicit missing-evidence outcomes.

Boundary: Production-readiness owns the launch decision — assembling cross-domain evidence and producing a go/no-go recommendation. Incident-learning owns the post-incident learning evidence that feeds into future launch decisions. When incident-learning findings reveal systemic gaps (a recurring escaped requirement, a pattern of monitoring gaps across services), those findings become evidence in the production-readiness packet for the next launch. Production-readiness consumes incident-learning records as one category of readiness evidence.

Routing decision: Incident-learning feeds evidence into production-readiness. Incident-learning owns the learning record production; production-readiness owns the launch decision that consumes those records as evidence.

production-excellence bundle (not yet landed)

What production-excellence will own: Composing production-readiness, migration-engineering, resilience-and-recovery, capacity-and-cost-engineering, and incident-learning into a unified production evidence packet with go/no-go/defer/exception outcomes.

Boundary: Production-excellence will consume incident-learning records, causal ledgers, follow-up work maps, and closure records as input to cross-incident pattern analysis. Incident-learning produces the learning dimension of the production-excellence evidence packet.

Routing decision: Incident-learning feeds the production-excellence bundle. The learning records this skill produces are a required input to the production-excellence analysis and decision framework.

agent-production-operations bundle (not yet landed)

What agent-production-operations will own: Operational management of AI agents in production — deployment, monitoring, governance, cost management, and operational learning specific to agent systems.

Boundary: Agent-production-operations will consume incident-learning records specific to agent incidents — agent authority failures, unexpected agent behaviors, eval gaps exposed in production — as input to agent-specific operational learning and governance decisions.

Routing decision: Incident-learning feeds the agent-production-operations bundle. Agent-incident learning records are a required input to agent-specific operational learning and governance.

What incident-learning does NOT own

• Incident command and live response: owned by site-reliability-engineering. Incident-learning does not manage live incidents or run incident response.
• Postmortem facilitation: owned by site-reliability-engineering. Incident-learning consumes postmortem output; it does not produce postmortem documents or facilitate postmortem sessions.
• Root-cause debugging: owned by systematic-debugging. Incident-learning consumes debugging findings; it does not investigate failures.
• Test design and implementation: owned by qa-methodology. Incident-learning identifies test gaps; QA methodology designs and implements tests.
• Eval design and implementation: owned by agent-evals-and-observability. Incident-learning identifies eval gaps; agent-evals-and-observability designs evals.
• Product assumption updates and lifecycle decisions: owned by product-lifecycle-learning. Incident-learning identifies product gaps; product-lifecycle-learning updates assumptions and makes lifecycle decisions.
• Cross-team delivery coordination: owned by implementation-planning. Incident-learning identifies follow-up work; implementation-planning coordinates delivery.
• Resilience exercise design: owned by resilience-and-recovery. Incident-learning consumes exercise findings; resilience-and-recovery owns exercise design.
• Launch decisions: owned by production-readiness. Incident-learning feeds evidence into production-readiness; it does not make go/no-go calls.

Summary

Incident-learning fills the gap between incident response (which SRE owns) and the implementation of follow-up work (which specialist skills own per domain). It is the pipeline that converts raw incident evidence into structured learning records with separated facts, hypotheses, and uncertainty; maps escaped-from gaps; assigns domain-specific follow-up work with ownership; and tracks every finding to verified closure — refusing to close on tickets alone. Its output feeds downstream decisions in resilience-and-recovery (cross-incident pattern analysis), production-readiness (launch evidence), production-excellence (unified evidence packet), and agent-production-operations (agent-specific operational learning).