{
  "id": "Q002",
  "title": "Syntax Error in Aisle Four",
  "tier": 1,
  "primary_vm": "web_server",
  "required_vms": ["workstation", "web_server"],
  "ticket_id": "T002",
  "baseline_snapshot": "baseline.clean",
  "summary": "Someone edited nginx.conf and introduced a syntax error. Nginx will not start. The player needs to identify the broken config, fix it, and restore the service. This is a single-VM, single-symptom quest. Evidence is clear in the nginx error output. The config error is a missing semicolon on a listen directive.",
  "clue_fingerprint": {
    "description": "nginx -t reveals the syntax error. systemctl status nginx shows the unit failed with an exit code. journalctl -u nginx points at the line. The error is on the listen directive in /etc/nginx/sites-enabled/axiomworks.conf — a missing semicolon.",
    "evidence": [
      { "type": "log_contains", "vm": "web_server", "path": "/var/log/nginx/error.log", "contains": "invalid parameter" },
      { "type": "service_state_is", "vm": "web_server", "service": "nginx", "state": "failed" },
      { "type": "file_contains", "vm": "web_server", "path": "/etc/nginx/sites-enabled/axiomworks.conf", "contains": "listen 80" }
    ],
    "_note": "The baseline snapshot has listen 80 without semicolon. nginx -t will report exactly which line. The player does not need to know where the file is in advance — the error output tells them."
  },
  "objectives": [
    {
      "id": "nginx-running",
      "description": "Nginx is active and serving requests",
      "check_mode": "passive",
      "validation": {
        "type": "and",
        "rules": [
          { "type": "service_state", "vm": "web_server", "service": "nginx", "state": "active" },
          { "type": "port_listening", "vm": "web_server", "port": 80, "protocol": "tcp", "listening": true }
        ]
      }
    }
  ],
  "solution_branches": [
    {
      "id": "config-fixed-enabled",
      "label": "Fixed and Enabled",
      "priority": 100,
      "validation": {
        "type": "and",
        "rules": [
          { "type": "service_state", "vm": "web_server", "service": "nginx", "state": "active" },
          { "type": "service_enabled", "vm": "web_server", "service": "nginx", "enabled": true },
          { "type": "port_listening", "vm": "web_server", "port": 80, "protocol": "tcp", "listening": true },
          { "type": "file_contains", "vm": "web_server", "path": "/etc/nginx/sites-enabled/axiomworks.conf", "contains": "listen 80;" }
        ]
      },
      "trust_delta": 2,
      "world_flags": ["nginx_stable", "hermes_web_healthy"],
      "follow_up_dialogue": "marcus-Q002-complete-clean",
      "follow_up_ticket": "T003"
    },
    {
      "id": "config-fixed-not-enabled",
      "label": "Running But Not Enabled",
      "priority": 60,
      "validation": {
        "type": "and",
        "rules": [
          { "type": "service_state", "vm": "web_server", "service": "nginx", "state": "active" },
          { "type": "service_enabled", "vm": "web_server", "service": "nginx", "enabled": false },
          { "type": "port_listening", "vm": "web_server", "port": 80, "protocol": "tcp", "listening": true }
        ]
      },
      "trust_delta": 1,
      "world_flags": ["nginx_unstable", "hermes_web_healthy"],
      "follow_up_dialogue": "marcus-Q002-complete-not-enabled",
      "follow_up_ticket": "T003",
      "_note": "Service is running now but will not survive a reboot. Marcus notes this. Sets up a later incident."
    }
  ],
  "pressure_profile": "web_outage_escalation",
  "blast_radius": [],
  "_blast_radius_note": "I001 removed — I001 triggers only from Q003's quick-fix branch, not from anything in Q002. See OI-007.",
  "unlock_requirements": ["world_flag:player_ssh_configured"],
  "narrative_phase": "normal_work",
  "linux_concepts": ["nginx", "systemctl", "service configuration", "config syntax"],
  "failure_conditions": ["nginx not running", "service not enabled at boot"],
  "behavior_impact": {
    "default": { "curiosity_delta": 0, "obedience_delta": 1, "risk_delta": 0, "suspicion_delta": 0 }
  },
  "hidden_hook": null,
  "access_requirements": {
    "minimum_access": { "web_server": "basic_user" },
    "requires_root": false,
    "temporary_grants_allowed": []
  },
  "tags": ["services", "nginx", "config", "web_server"],
  "internal_notes": "This is the first quest on hermes. The player SSHes from ares. They need basic SSH connectivity to be established from Q001. The config file path and the error line number both appear in nginx -t output — no guessing required. The fun is in reading the error correctly and knowing that a failed config means the service was running fine before someone touched it."
}
