AetherForge/docs/VALIDATION_LADDER.md

Validation ladder (L0-L8)

Operator guide for what to run after code lands - from zero-dependency mining smoke through live fleet work. Automated gates live in tests/README.md; secure payload steps in docs/E2E_VALIDATION.md; Windows lifecycle phases in docs/WINDOWS_MINING_PHASES.md.

Mindset: CI proves contracts and mocks; it does not prove Defender, domain GPO, or your AWS IAM. Climb the ladder until the change you shipped is covered at the lowest honest rung, then stop. PROBLEMS.md lists what automation will never close.

---

Ladder overview

flowchart TB
  L0["L0 - Mining only<br/>mine-validate, no C2"]
  L1["L1 - Fast unit slice<br/>test-suite -SkipE2E -SkipBuild"]
  L2["L2 - Full unit gate<br/>test-suite -SkipE2E"]
  L3["L3 - Dashboard E2E<br/>test-suite phases 1-8"]
  L4["L4 - Feature slices<br/>-Recon -S3Swarm -P2 ..."]
  L5["L5 - Docker mining proof<br/>ci-docker-mining"]
  L6["L6 - Isolated forge + VM<br/>e2e-validate Tier 3"]
  L7["L7 - Live spread / recon<br/>owned lab hosts"]
  L8["L8 - Cloud + IAM<br/>operator AWS account"]

  L0 --> L1 --> L2 --> L3
  L2 --> L4
  L2 --> L5
  L5 --> L6
  L6 --> L7
  L7 --> L8

Rung	When	Command / action	Proves	Does not prove
L0	RandomX / pool worker change	cd agent; go run ./cmd/mine-validate -seconds 20 -threads 2	CPU mining engine, pool login	C2, forge, spread, persistence
L1	Quick post-edit smoke	.\scripts\test-suite.ps1 -SkipE2E -SkipBuild	Go server+agent + Vitest (phases 1-4)	Production builds, Playwright
L2	Default post-landing gate	.\scripts\test-suite.ps1 -SkipE2E	Phases 1-7b, compile checks	Live browser E2E on :18989
L3	UI / WS / routing change	.\scripts\test-suite.ps1	Full 8 phases incl. Playwright	Real Windows payload, live pool fleet
L4	Single feature after parallel agents	.\scripts\test-suite.ps1 -<Feature> (see table below)	Targeted Go + Vitest (+ E2E when not -SkipE2E)	Cross-feature integration on real hosts
L5	Mining + C2 regression in isolation	.\scripts\ci-docker-mining.ps1	Server healthy, Linux agent online, H/s > 0	Windows-only tiers, GPU, spread
L6	Forge / persistence / Crucible on Windows	.\scripts\e2e-validate.ps1 + disposable Hyper-V VM	Full Windows agent on owned lab VM	Production wallet, internet-wide spread
L7	Spread lanes, Deploy Recon, P2	Manual lab: WinRM/GPO/BITS, SSRF probe paste, port scan to owned targets	Behavior on machines you own	CI coverage of third-party networks
L8	S3 swarm, SSM, Fargate, fan-out	Operator AWS creds + IAM in your account	Real PutObject, SendCommand, ECS	Anything in shared repo CI

Counts (refresh when drift): Go server 1007, agent 680, Vitest 867, Playwright 32 - see tests/README.md.

---

Feature gates (L4 slices)

Use one slice when a parallel agent landing touched only that surface. Each exits after its phase unless noted.

Feature	Command
Full gate	.\scripts\test-suite.ps1
Quick verify	.\scripts\test-suite.ps1 -SkipE2E
Fast slice	.\scripts\test-suite.ps1 -SkipE2E -SkipBuild
P2 mining/spread	.\scripts\test-suite.ps1 -P2
Fleet recon	.\scripts\test-suite.ps1 -ReconOnly
Deploy Recon	.\scripts\test-suite.ps1 -Recon
Subnet recon	.\scripts\test-suite.ps1 -SubnetRecon
S3Swarm	.\scripts\test-suite.ps1 -S3Swarm
CloudMap	.\scripts\test-suite.ps1 -CloudMap
Fargate	.\scripts\test-suite.ps1 -Fargate
PolicyFanout	.\scripts\test-suite.ps1 -PolicyFanout
SSM	.\scripts\test-suite.ps1 -SSM
Seer	.\scripts\test-suite.ps1 -Seer
Oath	.\scripts\test-suite.ps1 -Oath
Contingency	.\scripts\test-suite.ps1 -Contingency
CloudVenue	.\scripts\test-suite.ps1 -CloudVenue

With server already up: .\scripts\smoke-test.ps1 -BaseUrl http://127.0.0.1:8989 (REST matrix B-01-B-10).

---

Honest gaps (from PROBLEMS.md)

Automation closes regressions; these stay operator or architecture scope:

Area	Honest limit
By design	bof_execute disabled; process hollowing ~50% ETW/Defender failure; non-Windows cloudflared stub; mesh without -tags p2p; Linux/macOS GPU RVN uses Windows miner binaries only.
Scale	Subnet derived at query time; scan caps (128 hosts / spread sem 16); SQLite single-writer; WS init full fleet blob; 3D map capped at 200 nodes.
Container mining	AV still sees Docker; GPU-in-container on Windows is operator-dependent; worker image build not auto-forged.
Deferred architecture	tunnel_stream; Path Tracer RAM sessions; NAT without STUN; monolithic WS context; no CI HTTP forge without LIVE_FORGE=1.
AWS cloud	S3/CloudFront/SSM/Fargate/EventBridge need your IAM; CI uses mocks.
Manual / live	Live S3 signed magnets; SSM SendCommand; Fargate RunTask; fan-out Lambda; Cloud Map route_via server wiring; live P2 spread; Deploy Recon port scan/crawl from dashboard host; SSRF probe is manual paste.

Full tables: PROBLEMS.md. Test gap pointers: tests/README.md (P2 spread lanes, gaps section).

---

Operator checklist after landing

1. L2 .\scripts\test-suite.ps1 -SkipE2E from repo root.
2. If the change touched one feature row above, add L4 slice.
3. If forge/agent Windows behavior changed, plan L6 VM snapshot test (wallet + data-e2e\ only).
4. If spread/recon/AWS changed, read PROBLEMS Manual / live before claiming production-ready.
5. Update test counts in tests/README.md / PROBLEMS.md only when go test -list / Vitest / Playwright totals drift.

---

Related docs

• docs/E2E_VALIDATION.md - Tier 0-3 secure payload matrix, VM topology, Crucible checklist
• docs/WINDOWS_MINING_PHASES.md - Windows boot -> recon -> deploy -> mining -> spread phase maps
• tests/README.md - phase map, LOTL glossary, regression tables