Post-Episode Evidence Review¶
Protocol — instantiates Intermittent Failure Capture
Reviews captured evidence soon after the episode while context is still recoverable and corrective action is still timely.
Post-Episode Evidence Review is a protocol for examining captured evidence soon after an episode — while surrounding context is still recoverable and corrective action is still timely — comparing it against prior episodes, deciding what if anything to reproduce, and turning the findings into action. Its defining move is that it is the human and organizational step that converts a preserved record into diagnosis and a decision: without it, capture is merely hoarding. It consumes the artifacts the other mechanisms produce and adds three things they cannot — a freshness clock, a comparison across episodes, and a governed decision about reproduction. It captures no evidence itself.
Example¶
A security operations center keeps seeing brief, self-clearing anomalies — a server briefly beacons to an unfamiliar host, then stops. Automated capture latches each episode's evidence, but the value comes from the review protocol: within twenty-four hours of each captured episode — while upstream logs have not yet rotated and the responder still remembers the shift — an analyst compares the new capture against prior ones, decides whether it is safe to recreate the trigger in a sandbox rather than on production, and assigns the finding to remediation or dismissal. Reviewing four captures together inside their freshness window, the analysts connect them to a single scheduled task on one host — a link that would have dissolved if each capture had sat untouched for a month.
How it works¶
- The review is time-bounded: it runs promptly, before context decays and while action is still useful.
- It compares the new episode against the accumulated set, looking for common preconditions, sequences, and triggers.
- It gates reproduction: a governed decision on whether and how to safely recreate the failure — sandbox versus production, or not at all.
- It routes the outcome to corrective action, escalation, or an explicit decision to retire the capture mechanism.
Tuning parameters¶
- Review latency — how soon after the episode the review runs. Sooner preserves context but demands standing review capacity.
- Grouping criteria — how episodes are matched to detect recurrence. Loose grouping invents patterns; strict grouping misses variants.
- Reproduction risk threshold — how cautious the gate is about recreating the failure, trading diagnostic value against the risk of causing harm.
- Evidence sufficiency bar — how many episodes must agree before a root cause is declared, versus waiting for more.
When it helps, and when it misleads¶
Its strength is that it is what makes the whole archetype pay off — it turns preserved records into corrective action and into a safe (or deliberately foregone) reproduction, closing the loop from capture to repair. Its named hazard is hindsight bias[n1] — once the outcome is known the cause seems obvious, so reviewers over-fit a confident story to a handful of episodes. Its central failure mode is reviewing too few episodes and declaring a root cause with false confidence — or reviewing so late that context has decayed and the window for action has closed. The classic misuse is running the review to assign blame rather than diagnosis, which quietly suppresses future reporting. The guarding discipline is to require a sufficiency bar before concluding, keep the freshness clock tight, and hold diagnosis separate from blame.
How it implements the components¶
Post-Episode Evidence Review realizes the diagnosis-and-decision side of the archetype — turning preserved records into action, not capturing them:
recurrence_analysis— compares the new episode against prior captures to find the preconditions and sequences common across them.follow_up_diagnostic_path— assigns review, escalation, and corrective action, so the record becomes a decision rather than an archive entry.reproduction_gate— governs whether and how to safely reproduce the failure, or to refrain, keeping reproduction attempts from causing new harm.
It does not capture the evidence it reviews — the rolling window (capture_window, state_snapshot) is flight_recorder's, the packaged record (episode_identifier, event_log) is incident_snapshot's, and the durable trace (evidence_preservation_rule) is black_box_log's. This protocol consumes what they produce.
Related¶
- Instantiates: Intermittent Failure Capture — the follow-up path that converts preserved evidence into diagnosis and repair.
- Consumes: Incident Snapshot · Flight Recorder · Black Box Log — the captured evidence it reviews.
- Sibling mechanisms: Flight Recorder · Trigger-Based Debug Trace · Incident Snapshot · Symptom Diary · Rare Event Monitor · Automatic Diagnostic Capture · Black Box Log
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Post-Episode Evidence Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it reviews captured evidence soon after the episode while context is still recoverable and corrective action is still timely.
Independent corroboration: The frozen evidence defines Post-Episode Evidence Review as 'Reviews captured evidence soon after the episode while context is still recoverable and corrective action is still timely', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Decision, Gate & Allocation — Post-Episode Evidence Review includes features of a case-specific gate, selection, routing, prioritization, or resource disposition, but its defining operation is a bounded evaluation of existing evidence or work that produces a finding or disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Rapid review of captured evidence after an intermittent failure is a reliability and incident-analysis practice.
Related originating lineages:
- Disaster Management & Risk Reduction — Disaster and emergency management contribute time-sensitive debriefing while operational context remains recoverable.
- Medicine & Healthcare — Clinical case review and episodic-monitor interpretation independently institutionalized prompt contextual review after transient events.
Review resolution: Both blind reviewers agree that engineering design is the primary origin. Reconciliation resolves reported ambiguity, alternate origin disagreement, origin mode disagreement, encyclopedia synthesis disagreement. Formative alternate lineages are retained as disaster_management, medicine_healthcare; later breadth of use is recorded separately as domain_reach=multi_domain, while origin_mode=cross_disciplinary_synthesis describes the relationship among origin lineages.
Attribution caveat: The generic label spans technical and clinical traditions without a single standardized origin.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
[n1] Hindsight bias is the tendency, once an outcome is known, to see it as having been predictable — which leads reviewers to construct an over-confident causal story from a few captured episodes. Structured review with a minimum-evidence bar is the standard guard, as in blameless post-incident analysis. ↩