{
  "id": "marcus-Q007",
  "character": "marcus",
  "quest_id": "Q007",
  "series_id": "marcus-main",
  "series_position": 7,
  "messages": [
    {
      "stage": "intro",
      "trigger": "quest_activated",
      "body": "Priya can't get into hermes. Something in the SSH config changed. Figure out what it was and restore her access without creating a new problem."
    },
    {
      "stage": "hint_1",
      "trigger": "player_requested_help",
      "body": "sshd_config is where SSH restrictions live. Look for AllowUsers or AllowGroups. One of those is either missing her or was set wrong."
    },
    {
      "stage": "hint_2",
      "trigger": "player_requested_help_again",
      "body": "AllowGroups is the right pattern — it scales. AllowUsers is a list you have to maintain manually. Either works, but think about which one you want to be maintaining in six months."
    },
    {
      "stage": "complete-clean",
      "trigger": "world_flag:hermes_ssh_hardened_correct",
      "body": "AllowGroups with web-admin. That's the correct way to do it. Users in the group get access, users not in the group don't. No list to maintain."
    },
    {
      "stage": "complete-fragile",
      "trigger": "world_flag:hermes_ssh_allowusers_fragile",
      "body": "Priya's back in. That AllowUsers list is going to need a line added every time someone new needs access. Worth switching to group-based before it becomes a problem."
    },
    {
      "stage": "complete-regression",
      "trigger": "world_flag:hermes_ssh_unrestricted",
      "body": "Access is restored but the hardening is gone. That restriction was there for a reason — SSH open to everyone on hermes isn't a great position to be in."
    }
  ]
}