[ci-scan] Add ci-failure-fix workflow

.github/workflows/shared/area-skills.instructions.md

@@ -0,0 +1,48 @@
+# Area → skill directory
+
+A single source of truth mapping a `dotnet/runtime` area / pipeline to the
+Copilot skill that carries the domain knowledge for it. Agents and skills that
+need to route a failure, a review, or a change to the right area knowledge
+should reference this table instead of re-declaring their own copy, so the
+mapping stays consistent as skills are added or renamed.
+
+Skill paths in the table below are relative to `.github/skills/`, so
+`mobile-platforms/SKILL.md` means `.github/skills/mobile-platforms/SKILL.md`.
+The one non-skill entry (NativeAOT) is given as a repo-root-relative path and is
+called out as such. Area-owner handles are **not** listed here; resolve owners
+from [`docs/area-owners.md`](../../../docs/area-owners.md) by the issue's
+`area-*` label.
+
+<a id="area-skill-table"></a>
+
+## Area → skill table
+
+Skill paths are relative to `.github/skills/`.
+
+| Area / pipeline | Skill(s) | What the skill covers |
+|---|---|---|
+| Mobile (ios / tvos / maccatalyst / android / wasm / wasi) | `mobile-platforms/SKILL.md` | Mobile/wasm test, csproj, and platform-condition knowledge. |
+| JIT / GC / PGO stress (codegen) | `jit-regression-test/SKILL.md`; `ci-pipeline-monitor/SKILL.md` | JIT codegen, assertion triage, regression-test extraction. |
+| `System.Net.*` | `system-net-review/SKILL.md` | Networking stack review and conventions. |
+| `Microsoft.Extensions.*` | `extensions-review/SKILL.md` | Extensions (DI, config, logging, hosting, caching) review. |
+| NativeAOT outer loop | repo-root `eng/testing/tests.*aot*.targets` + the test `.csproj` | NativeAOT test wiring (no dedicated skill; read the targets). |
+| Generic / unmapped | `ci-pipeline-monitor/SKILL.md` | Cross-cutting CI pipeline monitoring and triage. |
+
+When more than one skill is listed, load them in order; the first carries the
+primary domain knowledge and the rest add CI/triage context.
+
+<a id="area-mention-conventions"></a>
+
+## Area-owner mention conventions
+
+When an agent loops a human in (a PR body or an issue comment) based on an
+`area-*` label, apply these rules so notifications stay proportionate:
+
+- Resolve owners from [`docs/area-owners.md`](../../../docs/area-owners.md) by the
+  `area-*` label.
+- Live-mention **at most one or two** individual owners.
+- **Never live-mention a GitHub team.** Render a team handle (`@dotnet/<team>`)
+  as inline code `` `@dotnet/<team>` `` so it does not notify the whole team.
+- Never mention bots (`dotnet-maestro`, `github-actions`, codeflow accounts).
+- Put contacts under a non-accusatory heading framed as "loop-in for triage",
+  not blame.

.github/workflows/shared/create-kbe.instructions.md

@@ -141,9 +141,20 @@ never match because there is no test name. Add:
 Each candidate body must be fetched and read; do not match on title alone. On
 hit, record `existing-PR #<n>`.
 
+### Integrity-filtered PR candidate
+
+If any PR search above returns a `[Filtered]` marker for a candidate whose
+title, source symbol, or assertion slice overlaps the failing signature, do
+**not** assume no fix exists and file a fresh KBE. The filter hides a real PR
+you are not permitted to read, and it may already handle this failure. Record
+`skipped: integrity-filtered candidate, needs human review` and stop for this
+signature. A human can confirm whether the hidden PR fixes the failure; filing a
+duplicate KBE that is immediately closed as "fixed by" the hidden PR is a
+scanner-quality miss the feedback workflow will penalize.
+
 ### Merged fix PR (last 14 days)
 
-Only when an existing KBE or area-team tracker was recorded:
+When an existing KBE or area-team tracker was recorded:
 
 - `is:pr is:merged "<test-name>" merged:>=<14-days-ago>`
 - `is:pr is:merged "<test-file-path>" merged:>=<14-days-ago>`
@@ -152,6 +163,29 @@ Only when an existing KBE or area-team tracker was recorded:
 On match, record `skipped: fix recently merged in #<n>` and do not file a
 test-disable PR.
 
+#### Always run this for assertion / native / build-level signatures
+
+For a JIT, runtime, or build-level signature (assert in `coreclr!*`, `clrjit!*`,
+a native crash, or a compiler diagnostic), run the merged-PR search
+**unconditionally** — even when no existing KBE was found. These signatures
+recur and their KBEs are frequently closed-as-fixed, so an open-only dedup will
+not see the closed predecessor and the failure gets re-filed from a stale build.
+Search:
+
+- `is:pr is:merged "<assertion-text>" merged:>=<14-days-ago>` using a 6-12 word
+  literal slice of the assert / diagnostic message.
+- `is:pr is:merged "<source-symbol>" merged:>=<14-days-ago>` for each of the 2-3
+  most unique C / C++ identifiers in the stack frame or assertion text.
+
+For every merged PR hit, compare its `mergedAt` against the failing build's
+`finishTime` (the AzDO build that produced this failure; read it from the build
+metadata, not the queue time). If the fix merged **after** the build finished,
+the failure is stale and already addressed: record
+`skipped: fix already merged after source build` (cite the PR `#<n>`) and do not
+file. Only file a new KBE when the same assertion still reproduces in a build
+that finished **after** the fix merged (a genuine post-fix recurrence), and say
+so explicitly in the KBE body with both the fix PR `#<n>` and the post-fix build.
+
 <a id="verify-embedded-issues"></a>
 
 ## Verify every embedded issue number exists