Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/main.go

@@ -17,6 +17,7 @@ import (
 
 	"crypto-miner-server/internal/alerts"
 	"crypto-miner-server/internal/api"
+	"crypto-miner-server/internal/atlas"
 	"crypto-miner-server/internal/builder"
 	"crypto-miner-server/internal/cloudflared"
 	"crypto-miner-server/internal/db"
@@ -138,6 +139,7 @@ func main() {
 	wsHub := api.NewWSHub(database)
 	adaptiveEngine := strategy.NewAdaptiveEngine(database, cfg.Server.AdaptiveStrategyEnabled)
 	wsHub.SetAdaptiveEngine(adaptiveEngine)
+	wsHub.SetFailureAtlas(atlas.NewFailureAtlas(database))
 	wsHub.SetAIHandler(aiHandler)
 	wsHub.SetFleetSecret(cfg.Server.FleetSecret)
 	api.SetAgentPathSecret(cfg.Server.FleetSecret)
@@ -272,8 +274,10 @@ func main() {
 	fleetAISched := fleetai.NewScheduler(
 		&api.ConfigAIAdapter{Src: configProvider},
 		&api.WSHubSnapshotAdapter{Hub: wsHub},
-		&api.FleetAIExecutor{Hub: wsHub},
+		&api.ClearanceGuardExecutor{Inner: &api.FleetAIExecutor{Hub: wsHub}, Clearance: wsHub.ClearanceManager()},
 		&api.DatabaseAIDecisionStore{DB: database},
+		&api.DatabaseCourtAdapter{DB: database},
+		wsHub.ClearanceManager(),
 	)
 	fleetAISched.Start()
 	defer fleetAISched.Stop()
@@ -502,11 +506,13 @@ func (p *serverConfigProvider) GetFleetAIConfig() api.FleetAIConfigView {
 		interval = 60
 	}
 	return api.FleetAIConfigView{
-		AIControlEnabled:      s.AIControlEnabled,
-		AIEndpoint:            s.AIEndpoint,
-		AIModel:               s.AIModel,
-		AINoContext:           s.AINoContext,
-		AIDecisionIntervalSec: interval,
+		AIControlEnabled:       s.AIControlEnabled,
+		AIEndpoint:             s.AIEndpoint,
+		AIModel:                  s.AIModel,
+		AINoContext:              s.AINoContext,
+		AIDecisionIntervalSec:    interval,
+		AIAutoElevateClearance:   s.AIAutoElevateClearance || s.AIControlEnabled,
+		AIPersona:                fleetai.NormalizePersona(s.AIPersona),
 	}
 }
 
@@ -522,8 +528,10 @@ func (p *serverConfigProvider) UpdateFleetAIConfig(v api.FleetAIConfigView) erro
 			"ai_control_enabled":       v.AIControlEnabled,
 			"ai_endpoint":              v.AIEndpoint,
 			"ai_model":                 v.AIModel,
-			"ai_no_context":            v.AINoContext,
-			"ai_decision_interval_sec": v.AIDecisionIntervalSec,
+			"ai_no_context":              v.AINoContext,
+			"ai_decision_interval_sec":   v.AIDecisionIntervalSec,
+			"ai_auto_elevate_clearance":  v.AIAutoElevateClearance,
+			"ai_persona":                 fleetai.NormalizePersona(v.AIPersona),
 		},
 	})
 	if err != nil {