# Post-incident learning loop

Turns incidents into **measurable** stability gains. Complements playbooks’ retrospective sections ([`incident-playbooks/`](../operations/incident-playbooks/)) and [`feedback-loop-operations`](../operations/feedback-loop-operations.md).

## RCA expectations

| Severity | RCA depth | Timeline |
|----------|-----------|----------|
| **SEV-1** | Full timeline, blast radius, root and contributing causes, missed detection | Draft **≤5 business days**; review with Security/Legal if needed |
| **SEV-2** | Same, proportionally shorter; focus on customer impact and recurrence risk | Draft **≤10 business days** |
| **SEV-3** | Lightweight “five whys” or equivalent; optional if single-tenant and no integrity risk | **≤15 business days** or backlog slot |

RCA is **blameless** for individuals; **accountable** for systems and processes (missing test, missing alert, unclear runbook).

## Remediation ownership

- Each action item has **one owner**, **due date**, and **verification method** (test added, alert tuned, doc updated).
- **Product** owns UX/confusion items; **Eng** owns code/infra; **CS** owns comms templates and KB; **Ops** owns runbooks and monitoring thresholds.
- Items appear in sprint or ops backlog; **no orphan** “we should fix” bullets without owner.

## Follow-up validation

Before closing the incident record:

- [ ] **Fix verified** in non-prod or canary where applicable.
- [ ] **Alert** or dashboard gap closed—or risk accepted in writing with exec for SEV-1/2 only.
- [ ] **Customer** received final summary if they were impacted ([`customer-trust-protection`](customer-trust-protection.md)).
- [ ] **Related tickets** merged or linked to avoid duplicate work.

## Prevention tracking

- **Recurring issue gate:** same root symptom **≥3** times in **14 days** → mandatory engineering manager review ([`feedback-loop-operations`](../operations/feedback-loop-operations.md)).
- **Metrics:** add one **leading** indicator if the incident was detected late (e.g., queue age alert).
- **Quarterly:** review closed SEV-1/2 RCAs for theme clustering; input to [`execution-phase-review-gates`](execution-phase-review-gates.md).

## Artifacts

- Store: timeline, graphs, log excerpts (redacted), RCA doc link, action item tracker link.
- Link to [`live-tenant-success-metrics`](live-tenant-success-metrics.md) for launch-phase scorecards.