@jetrabbits/agentic 0.0.1

package/areas/devops/devsecops/workflows/security-scan-pipeline.md

@@ -0,0 +1,155 @@
+---
+name: security-scan-pipeline
+type: workflow
+trigger: /security-scan-pipeline
+description: Run a full security scan pipeline — SAST, dependency CVE, secrets, container image, IaC, and SBOM generation.
+inputs:
+  - service_name
+  - version_or_sha
+  - scan_scope (code|image|iac|all)
+outputs:
+  - scan_report
+  - findings_by_severity
+  - sbom
+roles:
+  - devops-engineer
+  - developer
+execution:
+  initiator: developer
+related-rules:
+  - shift-left-policy.md
+  - container-security.md
+uses-skills:
+  - secret-detection
+  - container-hardening
+  - sbom-supply-chain
+  - sigstore-signing
+quality-gates:
+  - zero Critical/High unresolved before release
+  - SBOM generated and attached to image
+  - no secrets found in code or git history
+---
+
+## Steps
+
+### 1. Secrets Scan — `@devops-engineer`
+```bash
+# Scan git history for secrets
+trufflehog git file://. \
+  --since-commit HEAD~20 \
+  --only-verified \
+  --fail
+
+# Scan current working tree
+gitleaks detect --source . --config .gitleaks.toml --exit-code 1
+```
+- **Done when:** zero verified secrets found; false positives documented in `.gitleaksignore`
+
+### 2. SAST (Static Analysis) — `@devops-engineer`
+```bash
+# semgrep (language-aware rules)
+semgrep scan \
+  --config=p/python         \
+  --config=p/owasp-top-ten  \
+  --config=p/secrets        \
+  --error                   \   # non-zero exit on findings
+  --output=sast-results.sarif \
+  --sarif                   \
+  src/
+
+# Upload to GitHub Security tab
+gh api -X POST repos/:owner/:repo/code-scanning/sarifs \
+  -f ref="refs/heads/main" \
+  -f sarif="$(cat sast-results.sarif | gzip | base64)"
+```
+- Block on: Critical/High severity findings without suppression comment
+- **Done when:** clean or all findings triaged with `# nosemgrep` + justification
+
+### 3. Dependency CVE Scan — `@devops-engineer`
+```bash
+# Scan source dependencies (before build)
+trivy fs . \
+  --severity CRITICAL,HIGH \
+  --exit-code 1 \
+  --format table \
+  --ignorefile .trivyignore
+
+# Language-specific (alternative)
+# Python
+pip-audit -r requirements.txt --fail-on-severity high
+# Node
+npm audit --audit-level=high
+# Go
+govulncheck ./...
+```
+
+### 4. Container Image Scan — `@devops-engineer`
+```bash
+IMAGE=registry.example.com/myorg/${SERVICE}:${VERSION}
+
+trivy image \
+  --severity CRITICAL,HIGH \
+  --exit-code 1 \
+  --format sarif \
+  --output image-scan.sarif \
+  --ignorefile .trivyignore \
+  ${IMAGE}
+
+# Also scan for misconfiguration in image layers
+trivy image \
+  --scanners misconfig \
+  --exit-code 0 \   # warn only for misconfig
+  ${IMAGE}
+```
+
+### 5. IaC Security Scan — `@devops-engineer`
+```bash
+# Terraform
+checkov -d terraform/ \
+  --quiet \
+  --compact \
+  --framework terraform \
+  --output sarif \
+  --output-file-path iac-scan.sarif
+
+# Or: tfsec
+tfsec terraform/ \
+  --format sarif \
+  --out tfsec.sarif
+
+# K8s manifests
+checkov -d charts/${SERVICE}/templates \
+  --framework kubernetes \
+  --quiet
+```
+
+### 6. Generate SBOM — `@devops-engineer`
+```bash
+IMAGE_DIGEST=$(crane digest ${IMAGE})
+
+# Generate CycloneDX SBOM
+syft ${IMAGE} -o cyclonedx-json=sbom.cdx.json
+
+# Attach as OCI attestation
+cosign attest \
+  --predicate sbom.cdx.json \
+  --type cyclonedx \
+  ${IMAGE}@${IMAGE_DIGEST}
+
+echo "SBOM attached to ${IMAGE}@${IMAGE_DIGEST}"
+```
+
+### 7. Collate Report — `@devops-engineer`
+```bash
+# Summary output
+echo "=== Security Scan Report: ${SERVICE} ${VERSION} ==="
+echo "Secrets:      $(cat secrets-results.json | jq length) findings"
+echo "SAST:         $(cat sast-results.sarif | jq '.runs[0].results | length') findings"
+echo "Dependencies: $(trivy fs . --quiet --format json 2>/dev/null | jq '.Results[].Vulnerabilities | length // 0' | paste -sd+ | bc) findings"
+echo "Image:        $(cat image-scan.sarif | jq '.runs[0].results | length') findings"
+echo "IaC:          $(cat iac-scan.sarif | jq '.runs[0].results | length') findings"
+echo "SBOM:         attached to registry"
+```
+
+## Exit
+Zero unresolved Critical/High + SBOM attached + scan report filed = security scan complete.

package/areas/devops/infrastructure/AGENTS.md

@@ -0,0 +1,50 @@
+# Infrastructure — guidance index
+
+## What this area covers
+
+Infrastructure-as-Code lifecycle: Terraform module authoring, environment provisioning and destruction, drift detection and remediation, state management, Ansible playbooks, cost optimization, and secret hygiene.
+
+## Guidance chain
+
+1. Project `.agent/` baseline
+2. `infrastructure/rules/*` — load all
+3. `infrastructure/skills/*/SKILL.md` — load only the skill matching the current task
+4. `infrastructure/workflows/*` — load the workflow matching the triggered command
+
+## Cross-cutting constraints
+
+- **IaC-only changes** — zero manual console or CLI changes in non-development environments; document exceptions.
+- **State is sacred** — never manually edit Terraform state; always use `terraform state` commands with documented justification.
+- **Immutability over mutation** — replace resources rather than patching them in place where possible.
+- **Secret hygiene** — no credentials, tokens, or keys in IaC code, state, or commit history.
+
+## Spec map
+
+```text
+infrastructure/
+├── rules/
+│   ├── iac-standards.md       ← module structure, naming, provider pinning
+│   ├── immutability.md        ← replace-before-destroy, no in-place secret mutations
+│   ├── secret-hygiene.md      ← vault integration, forbidden patterns, rotation policy
+│   └── state-management.md   ← backend config, state locking, import procedures
+├── skills/
+│   ├── terraform-modules/SKILL.md    ← module authoring, variable design, output contracts
+│   ├── ansible-playbooks/SKILL.md    ← idempotency, role structure, vault integration
+│   ├── drift-detection/SKILL.md      ← plan-diff analysis, scheduled drift checks
+│   ├── state-management/SKILL.md     ← import, mv, rm, split-state patterns
+│   └── cost-optimization/SKILL.md   ← right-sizing, reserved capacity, unused resource cleanup
+├── workflows/
+│   ├── provision-environment.md   ← /provision-environment
+│   ├── destroy-environment.md     ← /destroy-environment
+│   ├── drift-remediation.md       ← /drift-remediation
+│   └── module-development.md      ← /module-development
+└── prompts/
+    └── *.md
+```
+
+## Discovery patterns
+
+- `rules/*.md`
+- `skills/*/SKILL.md`
+- `workflows/*.md`
+- `prompts/*.md`

package/areas/devops/infrastructure/prompts/destroy-environment.md

@@ -0,0 +1,81 @@
+---
+workflow: destroy-environment
+---
+
+# Prompt: `/destroy-environment`
+
+Use when: safely tearing down a temporary or obsolete environment and validating cleanup before cost, security, or data risks remain.
+
+---
+
+## Example 1 — Decommission sandbox environment
+
+**EN:**
+```
+/destroy-environment
+
+Environment: sandbox-us-east-2
+Provider: AWS
+Resources expected: VPC, ECS service, RDS instance, S3 state bucket
+Safety checks:
+- confirm no production tags
+- ensure latest backup snapshot exists
+- require team-lead approval
+Output: destruction plan, executed steps, leftover resources report
+```
+
+**RU:**
+```
+/destroy-environment
+
+Окружение: sandbox-us-east-2
+Провайдер: AWS
+Ожидаемые ресурсы: VPC, ECS сервис, RDS инстанс, S3 state bucket
+Проверки безопасности:
+- подтвердить отсутствие production-тегов
+- убедиться, что есть свежий backup snapshot
+- обязательное подтверждение team-lead
+Результат: план удаления, выполненные шаги, отчёт по оставшимся ресурсам
+```
+
+---
+
+## Example 2 — Emergency cleanup of abandoned preview environment
+
+**EN:**
+```
+/destroy-environment
+
+Environment: pr-482-preview
+Provider: Hetzner Cloud + Cloudflare DNS
+Reason: preview stack was left running after branch deletion; monthly cost already > EUR 180
+Resources expected:
+- 3 VMs (1 control plane, 2 workers)
+- k3s load balancer IP
+- wildcard DNS record *.pr-482.dev.example.com
+- object storage bucket with test uploads
+Safety checks:
+- verify no shared production bucket or DNS zone is referenced
+- export last Terraform state and inventory before destroy
+- confirm no QA session scheduled in the next 24h
+Output: ordered teardown plan, DNS cleanup confirmation, cost savings estimate, and list of any dangling resources that require manual follow-up
+```
+
+**RU:**
+```
+/destroy-environment
+
+Окружение: pr-482-preview
+Провайдер: Hetzner Cloud + Cloudflare DNS
+Причина: preview-стек остался запущенным после удаления ветки; ежемесячная стоимость уже > EUR 180
+Ожидаемые ресурсы:
+- 3 VM (1 control plane, 2 workers)
+- k3s load balancer IP
+- wildcard DNS запись *.pr-482.dev.example.com
+- bucket объектного хранилища с тестовыми загрузками
+Проверки безопасности:
+- убедиться, что не используется общий production bucket или DNS зона
+- экспортировать последний Terraform state и inventory перед удалением
+- подтвердить, что в ближайшие 24ч не запланирована QA сессия
+Результат: упорядоченный план удаления, подтверждение очистки DNS, оценка экономии и список dangling-ресурсов для ручного завершения
+```

package/areas/devops/infrastructure/prompts/drift-remediation.md

@@ -0,0 +1,71 @@
+---
+workflow: drift-remediation
+---
+
+# Prompt: `/drift-remediation`
+
+Use when: detecting and remediating infrastructure drift between Terraform state and actual cloud resources.
+
+---
+
+## Example 1 — Scheduled weekly drift audit
+
+**EN:**
+```
+/drift-remediation
+
+Environment: production
+Scope: all Terraform components (vpc, k8s-nodes, rds, iam-roles)
+Mode: detect + classify (do NOT apply automatically)
+Output:
+  - Drifted resources with change type (add/change/destroy)
+  - Classification: ACCEPT / REMEDIATE / INVESTIGATE per finding
+  - IAM or security group drift → automatic INVESTIGATE + incident
+  - Cost impact of untracked resources
+```
+
+**RU:**
+```
+/drift-remediation
+
+Окружение: production
+Скоуп: все Terraform компоненты (vpc, k8s-nodes, rds, iam-roles)
+Режим: обнаружение + классификация (НЕ применять автоматически)
+Вывод:
+  - Ресурсы с отклонением и типом изменения (add/change/destroy)
+  - Классификация: ACCEPT / REMEDIATE / INVESTIGATE для каждой находки
+  - Отклонение IAM или security group → автоматически INVESTIGATE + инцидент
+  - Влияние на стоимость неотслеживаемых ресурсов
+```
+
+---
+
+## Example 2 — Post-incident: codify manual change
+
+**EN:**
+```
+/drift-remediation
+
+Context: INC-2024-099 — RDS manually scaled during P1 (db.r6g.large → db.r6g.xlarge)
+Environment: production / Component: rds-postgres only
+Decision: keep larger instance; codify in Terraform
+Task:
+  1. Confirm drift = only instance class change
+  2. Update terraform.tfvars: db_instance_class = "db.r6g.xlarge"
+  3. Run plan — must show 0 changes (no-op = codified)
+  4. Merge PR; close incident
+```
+
+**RU:**
+```
+/drift-remediation
+
+Контекст: INC-2024-099 — RDS вручную масштабирован во время P1 (db.r6g.large → db.r6g.xlarge)
+Окружение: production / Компонент: только rds-postgres
+Решение: оставить более крупный инстанс; закодировать в Terraform
+Задача:
+  1. Подтвердить что отклонение = только изменение класса инстанса
+  2. Обновить terraform.tfvars: db_instance_class = "db.r6g.xlarge"
+  3. Запустить plan — должен показать 0 изменений (no-op = закодировано)
+  4. Слить PR; закрыть инцидент
+```

package/areas/devops/infrastructure/prompts/module-development.md

@@ -0,0 +1,69 @@
+---
+workflow: module-development
+---
+
+# Prompt: `/module-development`
+
+Use when: creating or refactoring a Terraform module for team-wide reuse.
+
+---
+
+## Example 1 — New cloud-agnostic K8s node pool module
+
+**EN:**
+```
+/module-development
+
+Module: k8s-node-pool
+Purpose: provision worker nodes with uniform config (Hetzner primary, AWS secondary)
+Inputs: node_count, instance_type, zone, k8s_version (label only), common_tags
+Outputs: node IPs (list), SSH fingerprints
+Constraints:
+  - No provider config inside module
+  - All sensitive outputs marked sensitive = true
+  - validation{} blocks on all critical variables
+  - example/ dir with both Hetzner + AWS usage
+```
+
+**RU:**
+```
+/module-development
+
+Модуль: k8s-node-pool
+Назначение: создание worker нод с единой конфигурацией (Hetzner основной, AWS вторичный)
+Входные параметры: node_count, instance_type, zone, k8s_version (только лейбл), common_tags
+Выходные данные: IP нод (list), SSH fingerprints
+Ограничения:
+  - Без конфигурации провайдера внутри модуля
+  - Все sensitive выходные данные: sensitive = true
+  - validation{} блоки для всех критических переменных
+  - Директория example/ с примерами для Hetzner и AWS
+```
+
+---
+
+## Example 2 — Refactor: extract reusable VPC module from monolith
+
+**EN:**
+```
+/module-development
+
+Task: extract VPC/subnet config from environments/production/main.tf into reusable module
+Current state: all networking hardcoded in one file (3 AZs, specific CIDRs, specific tags)
+Target: generic modules/vpc/ with variable inputs for CIDR, AZ count, tags
+Safety: use moved{} blocks to prevent destroy+recreate during extraction
+Must work for: AWS (VPC/subnets/IGW/NAT) and Hetzner (network/subnets)
+Include: README.md with required vs optional variables, outputs, example usage
+```
+
+**RU:**
+```
+/module-development
+
+Задача: извлечь конфигурацию VPC/подсетей из environments/production/main.tf в переиспользуемый модуль
+Текущее состояние: вся сеть захардкожена в одном файле (3 AZ, конкретные CIDR, конкретные теги)
+Цель: универсальный modules/vpc/ с переменными для CIDR, количества AZ, тегов
+Безопасность: использовать блоки moved{} для предотвращения destroy+recreate при рефакторинге
+Должен работать для: AWS (VPC/подсети/IGW/NAT) и Hetzner (network/подсети)
+Включить: README.md с обязательными и опциональными переменными, outputs, примером использования
+```

package/areas/devops/infrastructure/prompts/provision-environment.md

@@ -0,0 +1,121 @@
+---
+workflow: provision-environment
+---
+
+# Prompt: `/provision-environment`
+
+Use when: provisioning or expanding infrastructure environments with Terraform and Ansible, while keeping cost, node configuration, and rollout safety explicit.
+
+---
+
+## Example 1 — Full staging environment on Hetzner
+
+**EN:**
+```
+/provision-environment
+
+Environment: staging / Cloud: Hetzner Cloud
+Scope: all (network + compute + K8s-ready node config)
+Resources:
+  - Private network: 10.0.0.0/16
+  - 1× cx31 control plane + 3× cx21 workers (Ubuntu 22.04)
+  - Load balancer for K8s API (port 6443)
+  - Firewall: deny-all inbound; allow SSH from jump-host IP only
+IaC: Terraform for cloud resources, Ansible for OS config (K8s prereqs, containerd, kubeadm)
+Outputs: server IPs to SSM; Ansible inventory file
+Cost estimate: required in plan output
+```
+
+**RU:**
+```
+/provision-environment
+
+Окружение: staging / Облако: Hetzner Cloud
+Скоуп: всё (сеть + вычисления + конфигурация нод для K8s)
+Ресурсы:
+  - Приватная сеть: 10.0.0.0/16
+  - 1× cx31 control plane + 3× cx21 workers (Ubuntu 22.04)
+  - Load balancer для K8s API (порт 6443)
+  - Firewall: deny-all входящий; разрешить SSH только с IP jump-host
+IaC: Terraform для облачных ресурсов, Ansible для конфига ОС
+Выходные данные: IP серверов в SSM; inventory файл для Ansible
+Оценка стоимости: обязательна в выводе plan
+```
+
+---
+
+## Example 2 — Ansible role for K8s node prerequisites
+
+**EN:**
+```
+/provision-environment
+
+Task: write idempotent Ansible role for K8s node prerequisites
+Target OS: Ubuntu 22.04 LTS
+Role name: k8s-prereqs
+Tasks to cover:
+  - Disable swap (permanent, survives reboot: /etc/fstab edit)
+  - Load kernel modules: overlay, br_netfilter (persistent via /etc/modules-load.d)
+  - Set sysctl params: net.bridge.bridge-nf-call-iptables=1, net.ipv4.ip_forward=1
+  - Install containerd (from official apt repo, pin version)
+  - Configure containerd: SystemdCgroup=true, correct config.toml
+  - Install kubeadm, kubelet, kubectl (pinned to 1.31.x; apt-mark hold)
+  - Restart containerd handler (only on config change)
+Testing: molecule test scenario with Ubuntu 22.04 container
+```
+
+**RU:**
+```
+/provision-environment
+
+Задача: написать идемпотентную Ansible роль для K8s node prerequisites
+Целевая ОС: Ubuntu 22.04 LTS
+Название роли: k8s-prereqs
+Задачи для покрытия:
+  - Отключение swap (постоянно, переживает перезагрузку: редактирование /etc/fstab)
+  - Загрузка kernel modules: overlay, br_netfilter (постоянно через /etc/modules-load.d)
+  - Установка sysctl параметров: net.bridge.bridge-nf-call-iptables=1, net.ipv4.ip_forward=1
+  - Установка containerd (из официального apt репозитория, с pinned версией)
+  - Конфигурация containerd: SystemdCgroup=true, корректный config.toml
+  - Установка kubeadm, kubelet, kubectl (pinned to 1.31.x; apt-mark hold)
+  - Handler перезапуска containerd (только при изменении конфига)
+Тестирование: molecule test сценарий с Ubuntu 22.04 контейнером
+```
+
+---
+
+## Example 3 — Monthly cloud cost audit (Hetzner + AWS)
+
+**EN:**
+```
+/provision-environment
+
+Scope: full infrastructure cost audit
+Cloud providers: Hetzner (bare-metal K8s cluster) + AWS (S3, SES, Route53)
+Monthly budget: €2,000 / actual last 3 months: €2,800 (+40% over budget)
+Terraform state available: all resources tagged with Project, Environment, Owner
+Goals:
+  1. Identify top-5 most expensive resources
+  2. Find unused resources: stopped VMs, unattached volumes, unused LBs, idle databases
+  3. Right-size: find over-provisioned nodes (< 20% average CPU/memory utilization)
+  4. Spot opportunities: which workloads could use spot/preemptible instances?
+  5. Output: prioritized savings plan with estimated monthly savings per action
+Tools available: infracost (for TF estimate), Prometheus for utilization metrics
+```
+
+**RU:**
+```
+/provision-environment
+
+Скоуп: полный аудит затрат на инфраструктуру
+Облачные провайдеры: Hetzner (bare-metal K8s кластер) + AWS (S3, SES, Route53)
+Месячный бюджет: €2,000 / фактически последние 3 месяца: €2,800 (+40% сверх бюджета)
+Terraform state доступен: все ресурсы тегированы Project, Environment, Owner
+Цели:
+  1. Определить топ-5 самых дорогих ресурсов
+  2. Найти неиспользуемые ресурсы: остановленные ВМ, неподключённые диски, простаивающие LB и БД
+  3. Right-size: найти избыточно выделенные ноды (< 20% среднего использования CPU/памяти)
+  4. Spot возможности: какие workloads могут использовать spot/preemptible инстансы?
+  5. Результат: приоритизированный план экономии с оценкой ежемесячной экономии на каждое действие
+Доступные инструменты: infracost (для оценки TF), Prometheus для метрик использования
+```

package/areas/devops/infrastructure/rules/iac-standards.md

@@ -0,0 +1,80 @@
+# Rule: IaC Standards
+
+**Priority**: P0 — IaC violations block infrastructure changes.
+
+## Terraform
+
+1. **All infrastructure is code**
+   - Every production resource must have a corresponding Terraform resource.
+   - Resources created outside Terraform are subject to automated removal within 7 days.
+   - Exception process: emergency manual change → IaC PR within 24 hours.
+
+2. **Module structure**
+   ```
+   terraform/
+   ├── modules/           ← reusable, generic (no env-specific values)
+   │   ├── vpc/
+   │   ├── eks-cluster/ or k8s-node-pool/
+   │   ├── rds-postgres/
+   │   └── object-storage/
+   └── environments/
+       ├── staging/       ← tfvars + backend config
+       └── production/    ← tfvars + backend config
+   ```
+
+3. **Version pinning — mandatory**
+   ```hcl
+   terraform {
+     required_version = ">= 1.9, < 2.0"
+     required_providers {
+       aws = { source = "hashicorp/aws", version = "~> 5.50" }
+     }
+   }
+   # Module references: use version tags, never ?ref=main in production
+   module "vpc" {
+     source  = "git::https://git.example.com/infra/modules//vpc?ref=v1.4.2"
+   }
+   ```
+
+4. **Naming convention**
+   ```hcl
+   # pattern: {project}-{environment}-{resource}-{optional-suffix}
+   name = "${var.project}-${var.environment}-${var.name}"
+   # e.g. myapp-production-postgres-primary
+   ```
+
+5. **Mandatory tags on every resource**
+   ```hcl
+   locals {
+     common_tags = {
+       Project     = var.project
+       Environment = var.environment
+       ManagedBy   = "terraform"
+       Owner       = var.team_name
+       CostCenter  = var.cost_center
+     }
+   }
+   ```
+
+## Ansible
+
+6. **Idempotency required** — every task must be safe to run multiple times with identical outcome.
+
+7. **Roles structure**
+   ```
+   roles/
+   └── my-role/
+       ├── tasks/main.yml
+       ├── defaults/main.yml   ← all variables with safe defaults
+       ├── vars/main.yml       ← internal constants
+       ├── templates/
+       ├── handlers/main.yml
+       └── meta/main.yml       ← dependencies declared
+   ```
+
+8. **No inline secrets** — use `ansible-vault` or reference from HashiCorp Vault / environment variables. Plain-text secrets in playbooks or vars files are a P0 violation.
+
+## Universal
+
+9. **Peer review required for all IaC changes** — `terraform plan` output attached to PR; `ansible-lint` must pass.
+10. **Dry-run before apply** — `terraform plan` / `--check` mode reviewed and approved; never skip in CI.

package/areas/devops/infrastructure/rules/immutability.md

@@ -0,0 +1,28 @@
+# Rule: Immutable Infrastructure
+
+**Priority**: P0 — Manual changes to running infrastructure are a critical policy violation.
+
+## Core Constraints
+
+1. **No SSH patching of running servers** — the fix is a new image + redeploy, not in-place modification.
+
+2. **Terraform is the single source of truth** — cloud console, CLI, or SDK changes that bypass Terraform are forbidden in production. Drift = violation.
+
+3. **Immutable image tags** — container images in production always reference content-addressed digest (`image@sha256:...`), never `:latest` or mutable tags.
+
+4. **Module versioning** — all Terraform module references pinned to semantic version tags. `?ref=main` is forbidden in staging and production.
+
+5. **Emergency exception process**
+   - Manual change allowed only for P0 incidents.
+   - Requires: Slack announcement + ticket + on-call sign-off.
+   - IaC PR to codify the change must be merged within **24 hours**.
+   - Recurring manual changes for the same resource = architecture review required.
+
+## Drift Policy
+
+6. **Drift detection runs every 6 hours** via CI scheduled job (`terraform plan`).
+7. **Detected drift classifications:**
+   - `ACCEPT`: approved architectural exception (documented in PR) → suppress alert
+   - `REMEDIATE`: unintended change → create ticket, remediate within 48h
+   - `INVESTIGATE`: unknown origin → P1 incident, may indicate unauthorized access
+8. **Drift in production security groups or IAM** → automatic P1 incident regardless of size.