feat: US-014 - Starter tasks: Category D incident debugging (1 task)

Add CCX-incident-031 for ccb_mcp_incident suite:
- Scenario: trace production etcd error 'mvcc: required revision has been
  compacted' to authoritative source functions in etcd-io/etcd (MCP-only)
- Oracle: server/storage/mvcc/kvstore.go (ErrCompacted def) +
  server/storage/mvcc/kvstore_txn.go (rangeKeys function)
- Decoy precision test: kubernetes/kubernetes has vendored etcd copies
  that look identical but are NOT the authoritative source
- eval.sh: file_set_match + keyword_presence (ErrCompacted, rangeKeys)
- Validity gate: VALID (gold=1.0, empty=0.0)
- Registered in configs/selected_mcp_unique_tasks.json (6 tasks total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_mcp_incident/ccx-incident-031/environment/Dockerfile

@@ -0,0 +1,26 @@
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Base tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    curl \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Clone local checkout repos (baseline config: agent has local access to these)
+RUN git clone --depth 1 --branch v1.32.0 https://github.com/kubernetes/kubernetes /workspace/kubernetes
+
+# Initialize git identity for agent commits
+RUN git config --global user.email "agent@example.com" && \
+    git config --global user.name "Agent" && \
+    git config --global safe.directory '*'
+
+# Create log directories
+RUN mkdir -p /logs/agent /logs/verifier
+
+ENTRYPOINT []

benchmarks/ccb_mcp_incident/ccx-incident-031/environment/Dockerfile.sg_only

@@ -0,0 +1,29 @@
+# CCX-incident-031 — sg_only variant
+# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    ca-certificates \
+    python3 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+# Empty workspace — agent discovers code via MCP tools only
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent" && \
+    git config --global safe.directory '*'
+
+# Create log directories
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Mark sg_only mode — verifiers and eval scripts check this flag
+RUN touch /tmp/.sg_only_mode
+
+ENTRYPOINT []

benchmarks/ccb_mcp_incident/ccx-incident-031/instruction.md

@@ -0,0 +1,68 @@
+# Incident Debugging: Trace Production Error to Authoritative Source
+
+## Incident Report
+
+Your on-call pager just fired. Your Kubernetes cluster's watch stream is failing
+with the following error appearing in the kube-apiserver logs:
+
+```
+rpc error: code = OutOfRange desc = etcdserver: mvcc: required revision has been compacted
+```
+
+The SRE team needs to file a bug report against the correct upstream component
+and link to the exact source functions that generate this error.
+
+## Your Task
+
+Identify the **authoritative** Go source files in the **distributed etcd service**
+that define and return the error string `"mvcc: required revision has been compacted"`.
+
+Specifically, find:
+1. The file where the `ErrCompacted` error variable is defined (not a vendor copy)
+2. The file containing the core function `rangeKeys` that returns this error when
+   a client requests a revision that has been garbage-collected by compaction
+
+## Important: Avoiding Decoys
+
+The local `kubernetes/kubernetes` checkout at `/workspace/kubernetes` contains
+vendored copies of etcd code under `vendor/go.etcd.io/etcd/`. These vendored
+files look identical to the real source but are **not** the authoritative location.
+
+The Kubernetes apiserver also has its own error-mapping layer at
+`staging/src/k8s.io/apiserver/pkg/storage/etcd3/errors.go` that translates
+the etcd error into Kubernetes error types — this is also **not** the authoritative
+source of the original error.
+
+Your answer must cite the **upstream etcd repository** (accessible via Sourcegraph
+MCP tools), not the vendored copies or the Kubernetes error-mapping layer.
+
+## Available Resources
+
+The local `/workspace/kubernetes/` directory contains `kubernetes/kubernetes` v1.32.0.
+
+**Note:** The etcd and Grafana repositories are accessible via Sourcegraph MCP tools:
+- `etcd-io/etcd` (distributed key-value store — this is where the error originates)
+- `grafana/grafana` (observability platform)
+
+## Output Format
+
+Create a file at `/workspace/answer.json` with your findings:
+
+```json
+{
+  "files": [
+    {
+      "repo": "org/repo-name",
+      "path": "relative/path/to/file.go",
+      "function": "FunctionName"
+    }
+  ],
+  "text": "Narrative explaining: which repo and files contain the authoritative error definition and the function that returns it, and why the kubernetes/kubernetes vendored copies are NOT the correct answer."
+}
+```
+
+## Evaluation
+
+Your answer will be scored on:
+- **File recall and precision**: Did you find the two Go files in etcd-io/etcd that are the authoritative source (not vendor copies)?
+- **Keyword coverage**: Does your answer mention the specific error constant (`ErrCompacted`) and function name (`rangeKeys`) by name?

benchmarks/ccb_mcp_incident/ccx-incident-031/task.toml

@@ -0,0 +1,28 @@
+version = "1.0"
+
+[metadata]
+name = "CCX-incident-031"
+description = "Incident debugging: trace production etcd error string to authoritative source functions"
+license = "Apache-2.0"
+
+[task]
+id = "CCX-incident-031"
+repo = "kubernetes/kubernetes"
+category = "incident-debug"
+language = "go"
+difficulty = "hard"
+time_limit_sec = 900
+mcp_suite = "ccb_mcp_incident"
+use_case_id = 31
+repo_set_id = "multi-org-go"
+mcp_unique = true
+
+[verification]
+type = "eval"
+command = "bash /tests/eval.sh"
+
+reward_type = "score"
+description = "Incident debugging: trace production etcd error string to authoritative source functions"
+
+[environment]
+build_timeout_sec = 900.0

benchmarks/ccb_mcp_incident/ccx-incident-031/tests/eval.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# eval.sh — MCP-unique benchmark evaluator for CCX-incident-031
+# Exit-code-first (SWE-Factory pattern):
+#   exit 0 — agent produced useful output (composite score > 0)
+#   exit 1 — total failure (composite score == 0 or missing answer)
+#
+# Writes /logs/verifier/reward.txt with the composite score [0.0, 1.0]
+
+set -euo pipefail
+
+TASK_ID="CCX-incident-031"
+ANSWER_PATH="/workspace/answer.json"
+TASK_SPEC_PATH="/tests/task_spec.json"
+ORACLE_CHECKS="/tests/oracle_checks.py"
+REWARD_PATH="/logs/verifier/reward.txt"
+
+mkdir -p /logs/verifier
+
+echo "=== CCX-incident-031 evaluator ==="
+echo "Task spec: $TASK_SPEC_PATH"
+echo "Answer:    $ANSWER_PATH"
+echo ""
+
+# sg_only mode guard: restore full repo if verifier wrapper exists
+if [ -f /tmp/.sg_only_mode ] && [ -f /tests/sgonly_verifier_wrapper.sh ]; then
+    echo "sg_only mode: sourcing verifier wrapper..."
+    source /tests/sgonly_verifier_wrapper.sh
+fi
+
+# Verify answer file exists
+if [ ! -f "$ANSWER_PATH" ]; then
+    echo "ERROR: answer.json not found at $ANSWER_PATH"
+    echo "0.0" > "$REWARD_PATH"
+    exit 1
+fi
+
+# Validate answer is valid JSON
+if ! python3 -c "import json; json.load(open('$ANSWER_PATH'))" 2>/dev/null; then
+    echo "ERROR: answer.json is not valid JSON"
+    echo "0.0" > "$REWARD_PATH"
+    exit 1
+fi
+
+echo "answer.json found and valid JSON"
+
+# Run oracle checks
+if [ ! -f "$ORACLE_CHECKS" ]; then
+    echo "ERROR: oracle_checks.py not found at $ORACLE_CHECKS"
+    echo "0.0" > "$REWARD_PATH"
+    exit 1
+fi
+
+echo "Running oracle checks..."
+SCORE=$(python3 "$ORACLE_CHECKS" --answer "$ANSWER_PATH" --spec "$TASK_SPEC_PATH" --verbose 2>&1 | tee /dev/stderr | tail -1)
+
+# Validate score is a number
+if ! echo "$SCORE" | python3 -c "import sys; float(sys.stdin.read().strip())" 2>/dev/null; then
+    echo "ERROR: oracle_checks.py did not return a valid score: $SCORE"
+    echo "0.0" > "$REWARD_PATH"
+    exit 1
+fi
+
+echo ""
+echo "Composite score: $SCORE"
+echo "$SCORE" > "$REWARD_PATH"
+
+# Exit based on score (SWE-Factory exit-code-first pattern)
+python3 -c "import sys; sys.exit(0 if float('$SCORE') > 0 else 1)"

benchmarks/ccb_mcp_incident/ccx-incident-031/tests/oracle_answer.json

@@ -0,0 +1,24 @@
+{
+  "files": [
+    {
+      "repo": "etcd-io/etcd",
+      "path": "server/storage/mvcc/kvstore.go",
+      "function": "ErrCompacted"
+    },
+    {
+      "repo": "etcd-io/etcd",
+      "path": "server/storage/mvcc/kvstore_txn.go",
+      "function": "rangeKeys"
+    }
+  ],
+  "text": "The error 'mvcc: required revision has been compacted' originates from etcd-io/etcd in two files. First, server/storage/mvcc/kvstore.go defines ErrCompacted as a package-level error variable: var ErrCompacted = errors.New(\"mvcc: required revision has been compacted\"). Second, server/storage/mvcc/kvstore_txn.go contains the function rangeKeys() which returns ErrCompacted at line 81 when the requested revision (ro.Rev) is less than the store's compactMainRev. The kubernetes/kubernetes repo contains vendored copies of these files under vendor/go.etcd.io/etcd/server/v3/storage/mvcc/ but these are not the authoritative source — the canonical location is the upstream etcd-io/etcd repository.",
+  "_metadata": {
+    "oracle_type": "file_set_match",
+    "discovery_method": "sourcegraph_keyword_search",
+    "queries": [
+      "repo:^github.com/etcd-io/etcd$ ErrCompacted errors.New",
+      "repo:^github.com/etcd-io/etcd$ ErrCompacted rangeKeys"
+    ],
+    "verified_at": "2026-02-20"
+  }
+}