Appendix G: The Post-Mortem and Dissent Ledger
One post-mortem per wrong action in production; one ledger line per concern you raise, scored quarterly. Companion to Chapter 13.
Part 1: The agent-behavior post-mortem
An agent-behavior post-mortem is not an outage post-mortem. The system was up the whole time and did exactly what it was built to do; the outcome was still wrong. So it asks where the judgment was supposed to live and why it did not catch this. Three required sections:
1. Did the boundary hold, and which kind of failure follows? Did the agent act inside the autonomy it was granted, in which case the boundary itself was set wrong and the fix is a product decision; or did it act outside its boundary, in which case the control failed and the fix is an engineering one? Name which, because they are different failures with different owners.
_____
2. Which instrument caught it, or should have and did not? Name the instrument. A post-mortem that does not name the instrument gap has not found the real failure, which is usually that nobody was watching the dial that would have shown it.
_____
3. What changes? Stated as a specific edit to the boundary, the eval set, or the instrument. Never as a vow of vigilance. A post-mortem whose action item is increased vigilance will be re-run, verbatim, in a quarter.
_____
Part 2: The dissent ledger
Every concern you raise is a prediction, and predictions can be scored. Log them. Read the ledger quarterly and compute your dissent precision: when you raised a concern, how often were you right.
The four moves the concern can take: build the artifact; translate into CEO math; replace “when does it ship” with “what is our rollback time”; use governance as a procurement filter.
| Date | Concern raised | Which of the four moves it took | Prediction (what would go wrong) | Ground-truth resolution | Running dissent precision |
|---|---|---|---|---|---|
The demotion note. Apply the proficiency regime’s demotion rule to your own objections. If your dissent precision falls, that is not a signal to raise concerns louder. It is a signal that your read of this domain has drifted, and your objections need recalibrating before they need amplifying. A signal that never varies carries no information; the room routes around the PM who is always concerned for the same reason it routes around the agent that always escalates.