6 min read
Detection ran. Consumption did not.
Fifteen days of correct, specific, automated detection went into an empty room. The tooling was not the failure, and neither were the responders.
The category
Response Engineering
You shifted left and fixed the pipeline. Production is still a person reading a dashboard at 3am. We engineer that layer.
Operations is a software problem. We build the production agent layer: defined as code, tested in CI, constrained by contract. Built on Open Agent Spec.
The gap it names
Detection is mostly a solved problem. Observability platforms produce correct, specific, timestamped signals, and they do it reliably, every day, whether or not anyone is reading.
The failure is downstream of that. Nothing consumes the detection. Nothing correlates a change against an onset while it is still cheap to do. And when a hypothesis does get formed, nothing carries it from the person who formed it to the people who act on it without shedding the two qualifiers that made it honest.
Response Engineering is the discipline of building that layer as software — with the same expectations of typing, testing and review you would apply to anything else that runs in production.
Four constraints do the work
Each of these is a constraint rather than a capability. That is deliberate: a capability is something the system can do on a good day, and a constraint is something it cannot stop doing on a bad one.
01
Every claim carries its epistemics as typed fields
A hypothesis is not a sentence. It is an object with a required confidence on a fixed scale, its supporting evidence, its contradicting evidence, and the test that would falsify it. Strip the falsifying test out and the run does not degrade quietly — it fails validation and stops.
A claim cannot shed its caveats when it changes hands.
02
Refusals live in the harness, not in the agent’s manners
An agent that declines politely is not a control, because politeness is a property of the model on the day. When someone directs the layer to relax a security control on a production host, the block happens in the runner, before dispatch, against an allow list.
Tested with the agent’s own instructions rewritten to cooperate fully.
03
What is missing is part of the record
The timeline the layer files carries an explicit list of evidence that was never collected, when it became obtainable, and the command that obtains it. A timeline that quietly omits the deciding evidence reads as complete when it is not.
The honest ending is the blocked one.
04
No agent reads another’s evidence surface
Each agent is bound to exactly one tool surface. Correlation and precedent reach the commander as typed inputs, not as shared context, so there is no route by which one agent quietly inherits another’s raw evidence.
Every handoff is dataflow, not narration.
What the layer is made of
Six agents, each with one narrow job, each declared as an Open Agent Spec that is validated in CI. Every arrow between them is a typed output whose claims carry confidence and falsifying_test as required fields.
telemetry-analyst
Detects recurrence in the problem feed
change-correlator
Correlates change history against onset
precedent-analyst
Recalls prior incidents, cited and bounded
incident-commander
Holds the hypothesis board
scribe
Files the timeline, drafts the change record
comms
Writes outward, and is never given the board
The incident record is written only through a tool call the adapter log can prove. Nothing reaches the record because an agent asserted it did.
Failure modes we demonstrate rather than describe
Five governance behaviours are scripted and verified live against the reference implementation. The suite exits zero only when every one of them holds.
- A directed change to relax a security control is blocked by the sandbox, before dispatch
- A caveats-stripped producer is rejected by the contract rather than passed on
- The attribution guard fires under convergence pressure toward a third party
- An ungrounded precedent is refused rather than cited
- A novel incident returns no applicable precedent, with its coverage stated
What we will not claim for it
There is no autonomous remediation. Anything that changes production state, alters a security control, or is irreversible inside the incident window requires human authorisation, and there is no setting that turns that off.
The bridge does not disappear. Your people still decide. What changes is that the call opens with evidence on the board instead of spending its first two hours assembling evidence that was always available.
The outcome is not a perfect one. Earlier, better evidenced and honestly bounded is the claim. Not solved.
The work is early. Six agents are written and validate against the specification; the investigation agents are verified live against mock adapters. We would rather say that than imply a maturity the repository does not show.
Technical material
All writing →Start with one incident pattern
You do not need an agent platform, and you do not need to have decided on one. You need one recurring incident pattern that costs you time.