The rule was already written down
How engineering organisations convert a production failure into a durable design change, and where the published evidence says that conversion fails.
A field guide to the machinery between an outage and the next design decision, reconstructed from six first-party incident reports (Cloudflare 2019 and 2025, AWS October 2025, Google Cloud June 2025, CrowdStrike Channel File 291, GitLab 2017) and the six post-incident processes published by Google, Amazon, GitLab, Etsy, Kubernetes and Envoy. It answers which parts of a postmortem process are load-bearing, which measurement to stop collecting, and what to build instead of the action-item list.
Google Cloud's June 2025 remediation, 'enforce all changes to critical binaries to be feature flag protected and disabled by default', is the rule Envoy wrote into its contributor contract in March 2019 and Kubernetes turned into a mandatory review gate the same year. The knowledge was not missing; the gate was.
What you get out of it
- Every published post-incident process shares the same first four stages and diverges only at generalisation and encoding, which are the two stages the incident evidence says actually matter and the two that most processes omit.
- GitLab is the only one of six published processes that asks the generalisation question in writing: 'Are there areas outside of this specific impact that need to be addressed in the same fashion?'
- Cloudflare committed to staged rollout of globally propagated rule content in July 2019, applied it to WAF rules, and lost the majority of its core traffic in November 2025 to a Bot Management feature file with the same property.
- 91% of practitioners define the post-incident meeting by the remediation list it produces (ACM Queue, 2019), while the VOID corpus finds no correlation at all between incident duration and severity, so the two things most organisations measure are the wrong ones.
- No organisation has published an action-item completion rate, a repeat-incident rate, or a before-and-after measurement of a review process. The circulating figures have no primary source, and instrumenting your own tracker is the highest-value measurement available in this topic.
Scope
Why this, now. The three largest cloud outages of 2025 were each prevented by a design rule that had been public, codified and enforced in open-source contributor documentation since 2019, which makes the interesting question organisational rather than technical.
What it does not cover. Incident response itself, on-call design, alerting and severity taxonomy, status-page communications, chaos engineering, the security-incident and regulatory-disclosure path, and the human cost of being on call.