feat(skills): add root cause analysis skill package

.github/skills/root-cause-analysis/README.md

@@ -0,0 +1,91 @@
+---
+title: Generic Root Cause Analysis Skills
+description: Configure the hybrid RCA skill package and its companion assessment skills
+---
+
+This package contains three portable skills:
+
+* `root-cause-analysis/SKILL.md` owns the hybrid investigation and disposition workflow.
+* `statistical-hypothesis-testing/SKILL.md` compares eligible binary rates or numeric averages.
+* `causal-evidence-likelihood/SKILL.md` estimates how one evidence item changes hypothesis
+  plausibility through a reasoned likelihood ratio.
+
+The package does not define a custom agent. Install all three skills so the RCA workflow can invoke
+its companion assessments. An investigation can begin with empty or populated sets of evidence,
+hypotheses, and observations.
+
+## Host behavior
+
+The RCA skill selects one of two host modes:
+
+* In Azure SRE mode, it loads `root-cause-analysis/references/azure-sre-tools.md` and automatically
+  uses relevant, safe, read-only tools from that catalog. Azure terminology and source guidance
+  become authoritative for the connected Azure evidence.
+* In generic mode, it inventories other available tools, proposes a bounded evidence-expansion
+  action, and obtains user approval before invoking those tools. It can still assess supplied
+  evidence when no additional tools are approved or available.
+
+Tool availability does not grant data access or permission to alter a system. Enforce read-only
+access, approvals, and production boundaries through host controls.
+
+## Azure SRE installation
+
+1. Open the Azure SRE agent and go to **Builder > Skills**.
+2. Create skills named `root-cause-analysis`, `statistical-hypothesis-testing`, and
+   `causal-evidence-likelihood`.
+3. Add each corresponding `SKILL.md` as a skill procedure.
+4. Include the `root-cause-analysis/references/azure-sre-tools.md` reference with the RCA skill.
+5. Attach the Azure SRE tools available to the agent and verify its connector credentials.
+6. Keep write tools disabled for a read-only investigation.
+7. Start a new thread and verify that the host is detected as Azure SRE mode.
+
+Local repository changes do not update a deployed Azure SRE agent. Upload each changed skill and
+its references to refresh the deployment.
+
+## Generic installation
+
+Install the three skill directories in a host that supports on-demand skills. Expose only tools
+appropriate for the investigation. The RCA skill will request approval before using non-Azure-SRE
+tools to expand the evidence set.
+
+Example invocation:
+
+> Use the root-cause-analysis skill to investigate why the reported outcome occurred. Start with
+> the hypotheses, evidence, and observations in this thread. Identify gaps, propose additional
+> evidence collection when useful, and continue until the completion gate passes or a concrete
+> evidence, access, approval, or tool blocker remains.
+
+## Behavior and limits
+
+The skill tests predictions before declaring a cause, actively seeks disconfirming evidence,
+tracks source lineage, and preserves exact test parameters and observations. It invokes
+statistical testing for eligible grouped observations and causal evidence likelihood assessment
+for selected statistically significant pairs whose observed direction supports the hypothesis.
+Statistical significance and elicited likelihood ratios inform evidence weighting but cannot
+directly set a hypothesis disposition.
+
+`Complete` means the causal completion gate passed. `Provisional`, `Inconclusive`, `Blocked`, and
+`Paused` are not completed RCAs. The skill cannot guarantee that available evidence contains a
+discoverable root cause, override host budgets, schedule itself, or continue after the host stops.
+
+The procedure checkpoints after completed test cycles. Use approved durable storage when
+available; a checkpoint emitted only in chat does not guarantee cross-thread recovery.
+
+## Deferred work
+
+The following approved backlog remains outside this change:
+
+* Expand statistical methods beyond binary rates and independent-sample means.
+
+Behavior conformance coverage now verifies companion-skill disposition authority, the `Complete`
+gate, production-action approval, and resumable checkpoints for every non-complete stop state. A
+synthetic regression corpus exercises incident, data, software, and process-failure cases.
+
+## Microsoft documentation
+
+* [Skills: creation, tool attachment, and lifecycle](https://learn.microsoft.com/azure/sre-agent/skills)
+* [Connectors and data access](https://learn.microsoft.com/azure/sre-agent/connectors)
+
+---
+
+🤖 *Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*

.github/skills/root-cause-analysis/causal-evidence-likelihood/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: causal-evidence-likelihood
+description: 'Assess how one evidence item changes the plausibility of an RCA hypothesis using a reasoned likelihood ratio.'
+compatibility: "Requires an Agent Skills host and the root-cause-analysis companion workflow."
+---
+
+# Causal Evidence Likelihood
+
+## Goal
+
+Assess whether one observed evidence item makes an RCA hypothesis more or less plausible through
+logical and causal reasoning. Return a reasoned likelihood ratio for use by
+`root-cause-analysis`, without presenting the estimate as measured probability or causal proof.
+
+## Inputs
+
+* One explicit, falsifiable hypothesis `H`, including its proposed mechanism
+* One evidence item `E`, separated into direct observation and interpretation
+* Evidence provenance, reliability, coverage, timing, and known transformations
+* Plausible alternative explanations and relevant system context
+
+Assess one material evidence-to-hypothesis link at a time. Do not combine multiple observations,
+summaries, or duplicated telemetry into one item unless their dependence is explicit.
+Do not provide or use p-values, confidence intervals, effect sizes, statistical-test conclusions,
+correlation strengths, anomaly scores, sample counts, or likelihood estimates produced by another
+skill. If supplied, set them aside before assessment. Use only the meaning of the direct observation
+and general knowledge of how the system or class of systems behaves.
+
+## Assessment
+
+Ask:
+
+> Suppose a reasonable observer initially assigns equal probability to `H` and `not H`. After
+> learning only `E`, while using established logical and system knowledge, how should the
+> observer's assessment of `H` change?
+
+Evaluate this by comparing:
+
+```text
+LR(E) = P(E given H) / P(E given not H)
+```
+
+With prior odds of 1, the elicited posterior corresponding to the assessment is:
+
+```text
+q(E) = LR(E) / (1 + LR(E))
+```
+
+Reason in both directions before selecting a value:
+
+1. State why `E` would be expected if `H` were true.
+2. State why `E` could occur if `H` were false, including common causes, reverse causation,
+   measurement effects, and competing mechanisms.
+3. Check whether the proposed cause precedes the effect and whether the mechanism could operate
+   in the observed scope.
+4. Distinguish direct runtime, control, reproduction, or intervention evidence from source-code
+   intent, documentation, temporal proximity, and unexplained correlation.
+5. Test logical compatibility explicitly. If `E` cannot be true when `H` is true under the stated
+   mechanism and scope, classify it as contradicting even when statistical observations favor
+  `H`.
+6. Select the narrowest defensible likelihood-ratio band. Prefer `Neutral` when the connection is
+  unknown or equally expected under `H` and `not H`.
+
+## Likelihood-Ratio Scale
+
+| Assessment           |                  `LR(E)` | Implied `q(E)` from a 50% prior |
+|----------------------|-------------------------:|--------------------------------:|
+| Strongly contradicts |             at most 1/19 |                      at most 5% |
+| Weakly contradicts   | above 1/19 and below 0.8 |          above 5% and below 44% |
+| Neutral or unclear   |         0.8 through 1.25 |                 44% through 56% |
+| Weakly supports      |  above 1.25 and below 19 |         above 56% and below 95% |
+| Strongly supports    |              at least 19 |                    at least 95% |
+
+Return a band and, when the reasoning supports it, one representative `LR(E)` value. Use the Strong
+bands only when general system reasoning makes `E` nearly entailed by `H` or nearly incompatible
+with it after considering the strongest plausible alternative. If provenance or meaning is too
+uncertain to reason from `E`, return `Not Assessed` rather than `Neutral`.
+
+## Interpretation Constraints
+
+* Label `LR(E)` and `q(E)` as elicited reasoning estimates, not empirical frequencies.
+* Do not use `q(E)` as the RCA hypothesis's actual posterior probability. The 50% prior is a
+  standard reference point for evidence relevance.
+* Do not infer support from evidence reliability alone. Reliability controls whether the
+  observation can be trusted; `LR(E)` controls whether it distinguishes `H` from `not H`.
+* Do not inspect, cite, summarize, transform, or reproduce statistical inference from this or any
+  other skill. Statistical support has already been assessed elsewhere; using it here would count
+  the same support twice.
+* Derive the direction and ratio only from logical compatibility, mechanism behavior, temporal
+  possibility, system constraints, and plausible alternatives. Association strength and causal
+  relevance are separate.
+* Preserve logical contradiction. Reliable evidence that is incompatible with a necessary part of
+  `H` contradicts `H` even if numerous correlations or statistical tests favor it.
+* Do not multiply likelihood ratios unless the RCA workflow has justified conditional
+  independence or modeled the dependence. Duplicates and downstream consequences of the same
+  event do not provide independent updates.
+* A code comment or design document can support mechanism plausibility, but it does not prove that
+  the path executed during the incident.
+* Missing expected evidence contradicts `H` only when source coverage is adequate and `H` predicts
+  that the evidence would be emitted, retained, and observed.
+
+## RCA Record
+
+Return:
+
+* Hypothesis ID and exact statement
+* Evidence ID, direct observation, provenance, and reliability
+* `P(E given H)` rationale
+* `P(E given not H)` rationale and strongest plausible alternative
+* Direction: supports, contradicts, neutral, or `Not Assessed`
+* Likelihood-ratio band and representative `LR(E)` value when defensible
+* Implied `q(E)` from the standardized 50% prior, labeled as an elicited relevance estimate
+* Reasoning confidence: Low, Medium, or High, with the decisive limitation
+* Dependence notes identifying evidence that must not be multiplied with this result
+* Next observation that would most change or calibrate the assessment
+
+Return the assessment to `root-cause-analysis`. It informs evidence weighting but cannot directly
+set a hypothesis disposition or satisfy the root-cause completion gate.