{
  "id": "Q006",
  "title": "Time Is A Flat Circle",
  "tier": 2,
  "primary_vm": "build_machine",
  "required_vms": ["workstation", "build_machine"],
  "ticket_id": "T006",
  "baseline_snapshot": "baseline.clean",
  "summary": "The build machine (vulcan, Arch Linux) has clock drift. NTP is not running because the service was disabled during a noisy audit period and never re-enabled. The clock is 40 minutes behind. As a result, pacman signature verification is failing — GPG signature timestamps appear to be in the future, which pacman treats as invalid. The player gets a ticket saying builds are broken and package installs fail. They need to diagnose the actual cause (clock drift), fix it (enable and start systemd-timesyncd or ntp), and then refresh the keyring.",
  "clue_fingerprint": {
    "description": "pacman -Syu fails with signature errors. gpg --verify on a downloaded package shows the signature timestamp is in the future relative to local time. timedatectl shows NTP is inactive and the local clock is significantly behind. journalctl -u systemd-timesyncd shows the service was stopped and disabled.",
    "evidence": [
      { "type": "service_state_is", "vm": "build_machine", "service": "systemd-timesyncd", "state": "inactive" },
      { "type": "service_enabled_is", "vm": "build_machine", "service": "systemd-timesyncd", "enabled": false },
      { "type": "log_contains", "vm": "build_machine", "path": "/var/log/pacman.log", "contains": "invalid or corrupted package (PGP signature)" }
    ]
  },
  "objectives": [
    {
      "id": "ntp-running",
      "description": "Time synchronization is active",
      "check_mode": "passive",
      "validation": {
        "type": "or",
        "rules": [
          { "type": "service_state", "vm": "build_machine", "service": "systemd-timesyncd", "state": "active" },
          { "type": "service_state", "vm": "build_machine", "service": "ntpd", "state": "active" },
          { "type": "service_state", "vm": "build_machine", "service": "chronyd", "state": "active" }
        ]
      }
    },
    {
      "id": "ntp-enabled",
      "description": "Time synchronization is enabled on boot",
      "check_mode": "passive",
      "validation": {
        "type": "or",
        "rules": [
          { "type": "service_enabled", "vm": "build_machine", "service": "systemd-timesyncd", "enabled": true },
          { "type": "service_enabled", "vm": "build_machine", "service": "ntpd", "enabled": true },
          { "type": "service_enabled", "vm": "build_machine", "service": "chronyd", "enabled": true }
        ]
      }
    },
    {
      "id": "package-installs-work",
      "description": "Package manager can install without signature errors",
      "check_mode": "explicit",
      "validation": {
        "type": "and",
        "rules": [
          {
            "type": "or",
            "rules": [
              { "type": "service_state", "vm": "build_machine", "service": "systemd-timesyncd", "state": "active" },
              { "type": "service_state", "vm": "build_machine", "service": "ntpd", "state": "active" }
            ]
          },
          { "type": "package_installed", "vm": "build_machine", "package": "archlinux-keyring", "installed": true }
        ]
      }
    }
  ],
  "solution_branches": [
    {
      "id": "timesyncd-enabled-keyring-refreshed",
      "label": "Full Fix — NTP Enabled and Keyring Refreshed",
      "priority": 100,
      "validation": {
        "type": "and",
        "rules": [
          {
            "type": "or",
            "rules": [
              { "type": "service_state", "vm": "build_machine", "service": "systemd-timesyncd", "state": "active" },
              { "type": "service_state", "vm": "build_machine", "service": "ntpd", "state": "active" }
            ]
          },
          {
            "type": "or",
            "rules": [
              { "type": "service_enabled", "vm": "build_machine", "service": "systemd-timesyncd", "enabled": true },
              { "type": "service_enabled", "vm": "build_machine", "service": "ntpd", "enabled": true }
            ]
          },
          { "type": "package_installed", "vm": "build_machine", "package": "archlinux-keyring", "installed": true }
        ]
      },
      "trust_delta": 3,
      "world_flags": ["vulcan_ntp_healthy", "vulcan_builds_healthy"],
      "follow_up_dialogue": "marcus-Q006-complete-clean"
    },
    {
      "id": "ntp-running-not-enabled",
      "label": "Running But Not Enabled at Boot",
      "priority": 50,
      "validation": {
        "type": "and",
        "rules": [
          { "type": "service_state", "vm": "build_machine", "service": "systemd-timesyncd", "state": "active" },
          { "type": "service_enabled", "vm": "build_machine", "service": "systemd-timesyncd", "enabled": false }
        ]
      },
      "trust_delta": 1,
      "world_flags": ["vulcan_ntp_fragile", "vulcan_builds_healthy"],
      "follow_up_dialogue": "marcus-Q006-complete-fragile"
    }
  ],
  "pressure_profile": null,
  "blast_radius": [],
  "unlock_requirements": ["world_flag:player_ssh_configured"],
  "narrative_phase": "unease",
  "linux_concepts": ["NTP", "systemd-timesyncd", "Arch Linux", "pacman", "package keyring"],
  "failure_conditions": ["NTP not enabled at boot", "package manager still failing signature checks"],
  "behavior_impact": {
    "default": { "curiosity_delta": 0, "obedience_delta": 1, "risk_delta": 0, "suspicion_delta": 0 }
  },
  "hidden_hook": null,
  "access_requirements": {
    "minimum_access": { "build_machine": "sudo" },
    "requires_root": false,
    "temporary_grants_allowed": []
  },
  "tags": ["ntp", "time", "pacman", "arch", "build_machine", "services"],
  "internal_notes": "First quest on vulcan. Introduces Arch Linux and pacman. The clock drift → GPG failure chain is real and genuinely confusing the first time you encounter it. The use of `or` on the NTP objective allows systemd-timesyncd, ntpd, or chronyd — any of them fixes the problem. The explicit check on package installs requires the player to confirm things work, not just that NTP is running."
}