repeats: 3

presets:
  - qwen36-thinking-coder-no-mtp
  - qwen36-thinking-coder-max-ctx-no-mtp
  - qwen36-thinking-general-no-mtp
  - qwen36-instruct-no-mtp
  - qwen36-thinking-coder-mtp-1
  - qwen36-thinking-coder-max-ctx-mtp-1
  - qwen36-thinking-general-mtp-1
  - qwen36-instruct-mtp-1
  - qwen36-thinking-coder-mtp-2
  - qwen36-thinking-coder-max-ctx-mtp-2
  - qwen36-thinking-general-mtp-2
  - qwen36-instruct-mtp-2
  - qwen36-thinking-coder-mtp-3
  - qwen36-thinking-coder-max-ctx-mtp-3
  - qwen36-thinking-general-mtp-3
  - qwen36-instruct-mtp-3
  - qwen36-thinking-coder-mtp-4
  - qwen36-thinking-coder-max-ctx-mtp-4
  - qwen36-thinking-general-mtp-4
  - qwen36-instruct-mtp-4

prompts:
  - id: coding
    max_tokens: 12000
    prompt: |
      Write an Ansible playbook that installs and configures Nginx as a reverse proxy on AlmaLinux 10. The playbook should:
      - Install Nginx and enable it on boot
      - Create a reverse proxy config for a backend service running on localhost:8080, serving on port 443
      - the backend service running on localhost:8080, returns a simple timestamp with Hello Agent World
      - Generate a self-signed certificate with openssl for testing
      - Set up the firewall rule for HTTPS using firewalld
      - Include proper error handling and idempotency
      - Use handlers for service restarts
      - Whenever possible, prefer ansible modules to shell commands
      Output only the playbook, no explanations.

  - id: reasoning
    max_tokens: 12000
    prompt: |
      You are a Lead Security Analyst and Infrastructure Engineer. You are provided with a partial incident report from the night shift. Your task is to analyze the events, deduce the attack vector, and recommend a highly specific action plan.

      Incident Report:
      - Time of Alert: 03:14 AM (Local Time).
      - Trigger: The core edge firewall flagged a "Sustained Bandwidth Anomaly".
      - Source: IP `10.10.30.88` (VLAN 30 - Untrusted/IoT). This IP was dynamically assigned via DHCP at 02:55 AM.
      - Hardware Info: The MAC address starts with `b8:27:eb` (OUI resolves to Raspberry Pi Foundation).
      - Traffic Pattern: The device is sending a continuous stream of outbound traffic to a single external IP (`198.51.100.42`) over UDP port 53. The firewall notes that the bandwidth is sustained at roughly 5 Mbps, and the payload does not match standard plaintext DNS queries.
      - Network Architecture Context: VLAN 30 is strictly isolated. Devices on this VLAN are forced to use a corporate web proxy for HTTP/HTTPS. However, an exception exists: UDP port 53 is allowed outbound directly to the internet to support legacy hardcoded IoT devices that ignore local DNS servers.
      - Infrastructure Logs: The physical switch port (Port 14 on Switch-Floor2) where this device is connected is located in an accessible meeting room. This port is normally kept `admin down`. However, your CI/CD logs show that an automated Ansible playbook, intended to deploy a standard configuration drift remediation, ran at 02:45 AM and unexpectedly changed Port 14's state to `up`.

      Required Output:
      1. Technical Analysis: What specific technique is the rogue device likely using to bypass the VLAN restrictions? Explain why the traffic pattern is suspicious.
      2. Root Cause Hypothesis: Correlate the timeline. How did an unauthorized physical device manage to get an active network port exactly when an automated infrastructure pipeline ran? What are the implications?
      3. Targeted Mitigation: Provide a precise, 3-step technical mitigation plan to stop the data exfiltration immediately. Constraint: You CANNOT shut down the physical switch port (security team needs to physically trace the cable first) and you CANNOT block UDP port 53 globally for VLAN 30 (it will break production legacy devices).

  - id: quick
    max_tokens: 2000
    prompt: |
      Explain in 3/4 sentences what a reverse proxy is, and when to use it in front of a web app
