Turn a ServiceNow alert into the right incident, once

**Objective:** Raise an incident for alert `{alert-number}`, assign it to `{assignment-group}` (default: the configuration item's support group), and link and acknowledge the alert.

**Step 1: Read the alert**

Call `servicenow-get-alert` with number `{alert-number}`. Keep sys-id, severity, state, configuration-item, node, source, metric-name, description and task.

* If task is already set, the alert already has an incident: report that number and stop.
* If state is Closed, ask the user whether to continue before doing anything else.

**Step 2: Resolve the configuration item and owner**

Call `servicenow-get-configuration-item` with name set to the alert's configuration-item. Keep its support-group and environment. If `{assignment-group}` is blank use that support-group; if both are blank, ask the user.

**Step 3: Avoid a duplicate**

Call `servicenow-get-incident` with short-description.contains set to the configuration item name and opened.from yesterday, in states New and In Progress. If an open incident already covers this CI and symptom, offer to link the alert to it instead of creating a new one.

**Step 4: Map severity to impact and urgency**

* Critical: impact 1 - High, urgency 1 - High
* Major: impact 2 - Medium, urgency 1 - High
* Minor: impact 2 - Medium, urgency 2 - Medium
* Warning or lower: impact 3 - Low, urgency 3 - Low
* Raise impact one level for a Production environment CI that is not already High.

**Step 5: Confirm**

Show the proposed incident: short-description "<severity> alert on <CI>: <metric-name or first line of description>", description (alert description, node, source, alert number), configuration-item, assignment-group, impact, urgency, contact-type Monitoring if that value is listed. Ask for an explicit yes.

**Step 6: Write, in this order**

1. Call `servicenow-add-incident` once with the confirmed values.
2. Call `servicenow-get-incident` with short-description.contains set to the alert number or the CI name and opened.from today to get the new incident's number and sys-id.
3. Call `servicenow-update-alert` once with the alert sys-id, incident set to the new incident's sys-id, acknowledged true, and work-notes "Incident <number> raised."

**Step 7: Report**

The new incident number, its priority, the group, and confirmation that the alert now shows the task.

**Rules & Guidelines:**

* Write tools allowed: `servicenow-add-incident` once and `servicenow-update-alert` once, both after the single confirmation. Do not call `servicenow-add-alert`, `servicenow-update-incident` or any other write tool.
* If the add succeeds but the new incident cannot be found in step 6.2, do not create another one. Report the gap and let the user link the alert.

**Validation:**

* If `{alert-number}` is not found, stop.
* If the alert has no configuration-item, create the incident without one and say that the CI is missing.