{
  "id": "I001",
  "title": "Log Pressure Returns on Hermes",
  "affected_vm": "web_server",
  "trigger_conditions": ["world_flag:hermes_log_pressure_pending"],
  "blast_radius_quests": [],
  "blast_radius_incidents": [],
  "escalation_steps": [
    {
      "after_seconds": 1800,
      "action": "grow_log",
      "target": "/var/log/nginx/access.log",
      "amount_mb": 500,
      "description": "Log continues growing without rotation"
    },
    {
      "after_seconds": 3600,
      "action": "grow_log",
      "target": "/var/log/nginx/access.log",
      "amount_mb": 1000
    },
    {
      "after_seconds": 5400,
      "action": "raise_ticket_priority",
      "ticket_id": "T003",
      "value": "high",
      "description": "Dave files another ticket. The site is slow again."
    },
    {
      "after_seconds": 7200,
      "action": "trigger_new_ticket",
      "ticket_id": "T003-recurrence",
      "description": "A new disk full ticket arrives from monitoring."
    }
  ],
  "cooldown_seconds": 3600,
  "world_flags": ["web_disk_pressure_active"],
  "trust_effects": {
    "ignored": -2,
    "resolved_cleanly": 0,
    "_note": "No positive trust for resolving this — it is the same problem the player already half-fixed. Resolving it properly via logrotate clears the flag."
  },
  "resolution_requirements": {
    "clear_flag": "hermes_log_pressure_pending",
    "set_flag": "hermes_logrotate_healthy",
    "validation": {
      "type": "file_exists",
      "vm": "web_server",
      "path": "/etc/logrotate.d/nginx"
    }
  }
}