# Rccafp

> Root Cause, Corrective Action, and Future Proofing - incident management protocol for multi-agent AI systems. Triggers on incidents, system failures, constraint violations, LLM overreach, or post-mortem analysis.

- Skill: `elevanaltd-hestai-mcp/rccafp` (Agent Skill)
- Install (CLI): `npx skillmds@latest add elevanaltd-hestai-mcp/rccafp`
- Raw SKILL.md: https://api.skillmd.com/api/skills/elevanaltd-hestai-mcp/rccafp/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML, Coding & Dev Tools
- Author: elevanaltd (https://skillmd.com/u/elevanaltd-hestai-mcp)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/elevanaltd-hestai-mcp/rccafp

---


# RCCAFP - Root Cause, Corrective Action, and Future Proofing

Structured 5-phase incident management protocol for multi-agent AI systems with human orchestration oversight.

## When to Use

Trigger RCCAFP when:
- A system constraint violation is detected
- An agent operates outside its role boundaries (overreach)
- A production failure or regression occurs
- A constitutional principle (I1-I6) is violated
- An assumption cascade causes unexpected behavior
- Post-mortem analysis is requested

## Five-Phase Process

### Phase 1: Detection and Triage
1. Create incident directory: `.hestai/state/incidents/YYYYMMDD-[incident-name]/`
2. Create subdirectories: `01-root-cause/`, `02-corrective-action/`, `03-future-proof/`
3. Document initial symptoms and severity assessment
4. Determine if full RCCAFP is warranted vs minor fix

### Phase 2: Root Cause Investigation
1. Collect evidence: exact causality chains, artifacts, logs
2. Cross-validate through multi-agent assessment
3. Document in `01-root-cause/causality-chain.md`
4. Identify which system boundaries were violated

### Phase 3: Corrective Action
1. Immediate containment and mitigation
2. Constraint validation - identify gaps in existing boundaries
3. Execute triage and damage control
4. Document in `02-corrective-action/constraint-validations.md` and `triage-execution.md`

### Phase 4: Future Proofing
1. Extract architectural learnings from the incident
2. Design prevention mechanisms with evidence
3. Define monitoring requirements
4. Document in `03-future-proof/prevention-mechanisms.md`

### Phase 5: Closure and Integration
1. Verify all phases are complete and documented
2. Pass findings through synthesis gate before integration
3. Update system documentation only after review
4. Refine protocol based on learnings

## Agent Roles in RCCAFP

| Agent | RCCAFP Role |
|-------|-------------|
| Holistic Orchestrator | Orchestrates process, owns gap accountability |
| Critical Engineer | Leads root cause investigation (tactical) |
| Principal Engineer | Leads future proofing (strategic prevention) |
| Implementation Lead | Executes corrective action implementations |
| Requirements Steward | Validates learnings against North Star |

## Synthesis Gate

All incident learnings must pass through the synthesis gate before being promoted to governance documentation:
- Findings go to `.hestai/state/incidents/pending/`
- Review validates evidence quality and relevance
- Only validated learnings are integrated into system docs

## Anti-Patterns

- **Silent Fix**: Fixing without documenting root cause
- **Skip Synthesis**: Promoting learnings without gate review
- **Blame Cascade**: Attributing to agents rather than system gaps
- **Speculative Prevention**: Creating mechanisms without evidence
- **Scope Creep**: Expanding response beyond the specific failure

## Success Metrics

- Mean Time to Detection (MTTD)
- Mean Time to Containment (MTTC)
- Documentation completeness
- Constraint validation effectiveness
- Incident recurrence rate
- Architecture improvement rate