chore: bootstrap lean sysadmin-chronicles repo

Import the runnable game code, content, docs, scripts, and repo guidance while leaving local agent state, dependency installs, build output, and backup copies out of the published tree.

content/incidents/I001-log-pressure-recurrence.json

@@ -0,0 +1,52 @@
+{
+  "id": "I001",
+  "title": "Log Pressure Returns on Hermes",
+  "affected_vm": "web_server",
+  "trigger_conditions": ["world_flag:hermes_log_pressure_pending"],
+  "blast_radius_quests": [],
+  "blast_radius_incidents": [],
+  "escalation_steps": [
+    {
+      "after_seconds": 1800,
+      "action": "grow_log",
+      "target": "/var/log/nginx/access.log",
+      "amount_mb": 500,
+      "description": "Log continues growing without rotation"
+    },
+    {
+      "after_seconds": 3600,
+      "action": "grow_log",
+      "target": "/var/log/nginx/access.log",
+      "amount_mb": 1000
+    },
+    {
+      "after_seconds": 5400,
+      "action": "raise_ticket_priority",
+      "ticket_id": "T003",
+      "value": "high",
+      "description": "Dave files another ticket. The site is slow again."
+    },
+    {
+      "after_seconds": 7200,
+      "action": "trigger_new_ticket",
+      "ticket_id": "T003-recurrence",
+      "description": "A new disk full ticket arrives from monitoring."
+    }
+  ],
+  "cooldown_seconds": 3600,
+  "world_flags": ["web_disk_pressure_active"],
+  "trust_effects": {
+    "ignored": -2,
+    "resolved_cleanly": 0,
+    "_note": "No positive trust for resolving this — it is the same problem the player already half-fixed. Resolving it properly via logrotate clears the flag."
+  },
+  "resolution_requirements": {
+    "clear_flag": "hermes_log_pressure_pending",
+    "set_flag": "hermes_logrotate_healthy",
+    "validation": {
+      "type": "file_exists",
+      "vm": "web_server",
+      "path": "/etc/logrotate.d/nginx"
+    }
+  }
+}

content/incidents/I002-backup-pressure-recurrence.json

@@ -0,0 +1,53 @@
+{
+  "id": "I002",
+  "title": "Backup Pressure Continues on Hermes",
+  "affected_vm": "web_server",
+  "description": "The /var/backups directory keeps filling because the partial fix (either cron corrected but disk not cleared, or disk cleared but cron still runs as root) leaves the underlying problem unresolved. The backup pressure will return.",
+  "trigger_flags": ["hermes_backup_partial"],
+  "blast_radius_quests": ["Q005"],
+  "blast_radius_incidents": ["I001"],
+  "notification": "Backup pressure is building again on hermes. /var/backups is filling up.",
+  "notification_severity": "warning",
+  "escalation_steps": [
+    {
+      "trigger_after_seconds": 1200,
+      "notification": "hermes: /var/backups is at 85%. Backup jobs are still accumulating owned-by-root files.",
+      "notification_severity": "warning",
+      "world_flags": []
+    },
+    {
+      "trigger_after_seconds": 2400,
+      "notification": "hermes: /var/backups is critically full. Backup jobs are failing. Dave has noticed.",
+      "notification_severity": "critical",
+      "world_flags": [],
+      "escalates_tickets": [
+        { "ticket_id": "T005", "new_priority": "high" }
+      ]
+    },
+    {
+      "trigger_after_seconds": 3600,
+      "notification": "hermes: Backup agent is now crashing. Sarah is asking questions in the channel.",
+      "notification_severity": "critical",
+      "world_flags": ["hermes_backup_root_running"]
+    }
+  ],
+  "world_flags": ["hermes_backup_partial"],
+  "resolution_requirements": {
+    "clear_flag": "hermes_backup_partial",
+    "set_flag": "hermes_backup_healthy",
+    "validation": {
+      "type": "and",
+      "rules": [
+        { "type": "file_contains", "vm": "web_server", "path": "/etc/cron.d/db-backup", "contains": "backup-agent" },
+        { "type": "file_owner", "vm": "web_server", "path": "/var/backups/db", "user": "backup-agent", "group": "backup-agent" },
+        { "type": "disk_usage_below", "vm": "web_server", "path": "/var/backups", "threshold_percent": 70 }
+      ]
+    }
+  },
+  "trust_effects": {
+    "ignored": -3,
+    "resolved_partially": -1,
+    "resolved_cleanly": 0,
+    "_note": "No trust bonus for resolving a problem you created by doing Q005 partially. Zero is the floor."
+  }
+}

content/incidents/I003-app-update-recurrence.json

@@ -0,0 +1,45 @@
+{
+  "id": "I003",
+  "title": "Upstream App Update Pressure on Vulcan",
+  "affected_vm": "build_machine",
+  "description": "If the player rolled back the axiomworks-app package but did not pin the version on hermes, the internal apt repo will eventually push the broken version again. The next unattended upgrade will pull it down and the app will break again.",
+  "trigger_flags": ["hermes_app_running"],
+  "blast_radius_quests": ["Q008"],
+  "blast_radius_incidents": ["I002"],
+  "notification": "Automated update on vulcan detected. The bad package version may be re-installed.",
+  "notification_severity": "warning",
+  "escalation_steps": [
+    {
+      "trigger_after_seconds": 900,
+      "notification": "hermes: axiomworks-app has been updated by the scheduled apt run. App is back on the bad version.",
+      "notification_severity": "critical",
+      "world_flags": [],
+      "escalates_tickets": [
+        { "ticket_id": "T008", "new_priority": "critical" }
+      ]
+    },
+    {
+      "trigger_after_seconds": 1800,
+      "notification": "vulcan: App is down again. Sarah is pinging the channel. Marcus is watching.",
+      "notification_severity": "critical",
+      "world_flags": []
+    }
+  ],
+  "world_flags": [],
+  "resolution_requirements": {
+    "set_flag": "hermes_app_pinned_2-1-0",
+    "validation": {
+      "type": "and",
+      "rules": [
+        { "type": "package_installed", "vm": "web_server", "package": "axiomworks-app=2.1.0" },
+        { "type": "file_contains", "vm": "web_server", "path": "/etc/apt/preferences.d/axiomworks-app", "contains": "Pin: version 2.1.0" }
+      ]
+    }
+  },
+  "trust_effects": {
+    "ignored": -4,
+    "resolved_partially": -2,
+    "resolved_cleanly": 0,
+    "_note": "Rollback-only is a partial fix — the pinning incident fires. Rollback-and-pin is the clean resolution and blocks this incident entirely."
+  }
+}