Incident Memory: Training-Free Operational Memory through Sequential Pattern Mining and Velocity-Stratified Retrieval

Abstract

Incident response is a memory problem: teams accumulate tickets, traces, postmortems, and wiki pages, but the knowledge needed for the next incident is rarely stored with its order, freshness, and provenance intact. We present Incident Memory, a deterministic system that accumulates operational knowledge without model training. It combines (i) velocity-stratified retrieval, which ages structural, behavioral, contextual, and ephemeral facts at different rates; (ii) fingerprint-conditioned PrefixSpan mining, which extracts ordered playbooks from successful investigations; and (iii) provenance-aware metric definitions, which detect conflicting definitions through executable checks. On the UCI ITSM event log, containing 141,712 events across 24,918 incidents, Incident Memory extracts 23,110 ordered traces, mines 39 playbooks, and covers 84.3% of 6,934 held-out incidents. On controlled benchmarks with known ground truth, it achieves 99.2% ordered playbook precision (controlled), an architectural staleness guarantee versus 36% stale returns for a flat baseline, and conflict-detection F1 of 0.876. A direct Claude Haiku baseline on 19 fingerprint groups reaches 0.661 ordered precision, compared with 0.985 for PrefixSpan. The central result is not that language models are weak at incident response; it is that repeated incident histories are low-entropy once conditioned on fingerprint and previous action. In that regime, exact memory is a stronger primitive than open-ended generation.

14 pages, 5 figures, 8 tables (main text); includes appendix