event timeline causal reconstructor

"Here are six files, what happened?" answered with file:line citations.

Drop in app logs (JSON lines, syslog, nginx/Apache), deploy and CI exports, PagerDuty/Opsgenie alert CSVs, Slack JSON exports and hand-typed notes. The skill normalises every timestamp format (ISO 8601, RFC 3164 syslog, CLF, epoch s/ms, US-style dates), asks which zone the naive ones are in, and builds a single UTC timeline where every event cites its source file:line.

• Clock-skew detection from request/order IDs that appear in two sources. It found a +95 s fast clock on the sample nginx log and corrects it with --auto-skew.
• Key moments: last change before impact, impact start, detection, recovery. Also time-to-detect, impact duration and detect-to-recover.
• Ranked candidate causes for any effect (--why "regex" or an event id), scored on recency, shared entities and rare words. Chat that mentions a deploy never counts as a change.
• Gaps where every source went silent, out-of-order lines and assumed zones are reported as data-quality notes.
• Output: terminal summary plus Markdown, CSV and JSON timelines for postmortems, insurance claims, customer disputes or audit trails.

What's included

SKILL.md, scripts/timeline.py, scripts/make_samples.py (fictional 6-source checkout outage), expected output, references (RFC 3339/3164/5424, nginx and Apache log docs, Slack export format, Google SRE postmortem guidance), tests.