Incident Memory

Understand how agent-written incident lessons are stored, recalled during later RCA runs, and verified after remediation.

Incident Memory is the file-backed context Anna can write during RCA and read at the start of a later investigation. It preserves useful operational knowledge without feeding raw memory into Pulse classification.

What gets written

Incident Memory is agent-written. CloudThinker does not automatically extract a fixed record from every completed Incident.

Memory kind	Use
Observation	A concrete fact or action from one investigation
Recollection	What happened in a specific past Incident and what changed
Lesson	A reusable pattern supported by more than one source Incident

Entries can include the affected service, evidence, action taken, a verification command, and an outcome. The agent writes only material it judges useful for later RCA.

How recall works

1. Anna writes incident memory files during an RCA run.
2. At the start of a later RCA, CloudThinker reads valid, recent entries from the workspace memory tree.
3. The selected entries appear in Anna’s incident-memory context before hypothesis work begins.
4. Anna compares the current evidence with those lessons instead of treating a past resolution as proof.

Recall re-enters DRE at Analyze. Pulse may maintain separate cluster memory, but it does not receive raw incident-memory files in its classification prompt.

The current Incident UI does not show an “Informed by similar incidents” badge or a per-memory recall list. Memory changes the RCA context behind the scenes.

Verification outcomes

An incident-memory entry can carry one of three outcomes:

Outcome	Meaning
Verified	A follow-up check confirmed the expected result
Unverified	No conclusive follow-up result is recorded
Failed	The expected result did not hold; the entry becomes counter-evidence

When a runbook includes a verification command, Anna can schedule a one-time follow-up and update the outcome. This is a bounded, agent-driven check. DRE does not run a universal post-remediation state machine for every Incident.

Failed lessons are not injected as valid guidance. Failed recollections can remain as counter-examples so a later RCA does not repeat the same assumption.

Availability and limits

• File-native incident memory must be available for the workspace and RCA runtime.
• Only entries that pass the memory format and safety checks are eligible for recall.
• Recall is capped and ordered by recent updates, so the model does not receive the entire history.
• Cancelled or failed RCA runs contribute memory only if the agent already wrote a valid entry.
• Re-running RCA does not mechanically replace an older entry; Anna can revise, combine, or supersede memory when evidence changes.

Use memory well

• Record the evidence that distinguishes the root cause from a symptom.
• Add a concrete verification command to remediation runbooks where practical.
• Treat recalled context as a hypothesis lead, not as a diagnosis.
• Review a failed verification before reusing the same Scoped Action.

Related

Investigation and RCA

See where memory enters the three-phase investigation.

Runbooks

Add the procedures and verification commands DRE can use during response.