/mend

Learning Loop — Pattern Extraction & Registration

Purpose: Read this file after incident resolution or failed remediation when updating the pattern catalog, registering a new pattern, or reviewing negative-pattern lessons.

Contents

• Pattern extraction workflow
• Pattern quality metrics
• Negative pattern catalog
• Knowledge transfer
• Catalog maintenance schedule

How Mend learns from incidents to expand the remediation pattern catalog over time.

Overview

Incident Resolved
  ↓
Triage Postmortem Published
  ↓
Mend Pattern Analysis
  ├── Existing pattern improved (update confidence factors, add variants)
  ├── New pattern candidate identified (draft → review → register)
  └── No actionable pattern (log insight only)

Pattern Extraction Workflow

Step 1: Postmortem Analysis (Multi-Stage Pipeline)

When Triage publishes a postmortem, Mend analyzes using a 4-stage pipeline. Single-pass analysis has 40%+ hallucination rates; staged processing reduces this to negligible levels.

Stage Pipeline

Each stage processes independently, then results are aggregated ("map-fold" approach). This keeps every input near the edge of a small context instead of buried mid-prompt in a large one — the lost in the middle position effect (Liu et al., TACL 2024), which is about where material sits in the context, not merely how much of it there is.

Extraction Fields

Quality Controls

Human Verification Strategy

Step 2: Pattern Candidate Assessment

Step 3A: Update Existing Pattern

When an incident matches an existing pattern:

1. Adjust confidence factors — Add new positive/negative signals discovered
2. Add variant — If symptoms differ slightly, add as variant of existing pattern
3. Update remediation steps — If a better fix was found, update primary steps
4. Update verification criteria — Add new checks discovered during verification
5. Adjust safety tier — If incident revealed different risk level, reclassify

Step 3B: Register New Pattern

When a genuinely new pattern is discovered:

1. Draft pattern using standard template:

### [CATEGORY]-[NNN]: [Title]

| Field | Value |
|-------|-------|
| **Symptoms** | [Observable indicators] |
| **Root Cause** | [Confirmed cause] |
| **Safety Tier** | [T1/T2/T3/T4] |
| **Confidence Factors** | [+/-% signals] |

**Remediation Steps:**
1. [Step] → Expected: [outcome]

**Verification:** [Success criteria]

2. Review criteria — New patterns must meet:

   • At least 1 confirmed incident as evidence
   • Reproducible symptoms (not one-off)
   • Automatable fix steps (not "call Bob")
   • Clear safety tier classification
   • Defined verification criteria

3. Registration — Add to reference/remediation-patterns.md in appropriate category

Pattern Quality Metrics

Track pattern effectiveness over time:

Pattern Health Check

Periodically review patterns for:

Negative Pattern Catalog

Track what NOT to do — failed remediation attempts:

Negative patterns serve as guardrails: if Mend's pattern matching suggests an action that appears in the negative catalog, it should flag the conflict and escalate.

Knowledge Transfer

To Triage

• Share pattern catalog updates for runbook refinement
• Report patterns that frequently need manual intervention (Triage should improve diagnosis)

To Beacon

• Share detection gaps discovered during incidents (symptoms that weren't monitored)
• Recommend new alerts based on pattern symptoms

To Builder

• Share patterns with high failure rates (may indicate code-level fixes needed)
• Report recurring issues that could be prevented with code changes

From Triage

• Receive postmortems as primary learning input
• Receive updated runbooks incorporating lessons learned

Catalog Maintenance Schedule