u02526-failure-root-cause-mining-for-cybersecurity-operations

# Failure Root Cause Mining for cybersecurity operations ## Why This Skill Exists Use failure root cause mining in cybersecurity operations with emphasis on evidence quality, falsifiability, and calibration. ## When To Use Use this skill when the request explicitly needs "Failure Root Cause Mining for cybersecurity operations" outcomes in the cybersecurity operations domain. ## Step-by-Step Implementation Guide 1. Define measurable outcomes for Failure Root Cause Mining for cybersecurity operations, including baseline and target metrics for cybersecurity operations. 2. Specify structured inputs/outputs for failure root cause mining and validate schema contract edge cases. 3. Implement the core failure root cause mining logic with deterministic scoring and reproducible execution traces. 4. Integrate orchestration policy, routing, approval gates, retries, and rollback for autonomous execution. 5. Run unit, integration, simulation, and regression suites for Failure Root Cause Mining for cybersecurity operations under maximally truth-seeking conditions. 6. Roll out behind a feature flag, monitor telemetry, and refine thresholds using observed operational outcomes. ## Required Deliverables - Capability contract: input schema, deterministic scoring, output schema, and failure modes. - Runtime profile: diagnostic-engine using failure root cause mining to produce failure-root-cause-mining-artifact-cybersecurity-operations. - Orchestration integration: cybersecurity-operations:diagnostic-engine routing, approval gates, retries, and rollback controls. - Validation evidence: unit, integration, simulation, regression-baseline suites and rollout telemetry. ## Operational Runbook ### Preflight - Validate mission scope, contracts, and required inputs. - Verify feature flag posture, dependencies, and approval prerequisites. ### Execution - Execute failure root cause mining workflow with deterministic scoring and trace capture. - Track posture transitions and preserve reproducible evidence artifacts. ### Recovery - Apply rollback strategy if posture is critical or guardrails fail. - Escalate blocked execution to oversight with incident packet and trace references. ### Handoff - Publish outcome report, scorecard, and telemetry links. - Queue follow-up tasks for unresolved risks, approvals, or optimization work. ## Guardrails - [quality] Require unit and integration validations before promoting Failure Root Cause Mining for cybersecurity operations. -> `run-validation:unit+integration+simulation+regression-baseline` - [reliability] Trigger rollback on critical posture or repeated failures. -> `rollback:rollback-to-last-stable-baseline` - [compliance] Require policy and approval gates prior to autonomous deployment. -> `approval-gates:policy-constraint-check+evidence-review` - [safety] Block production action when risk posture is critical until human oversight review. -> `open-incident:human-oversight`