AetherForge/docs/WINDOWS_MINING_PHASES.md

Windows mining phases

Operator reference for the Windows agent lifecycle: what runs automatically, in what order, and what requires deck action. Source of truth: agent/client/, agent/miner/, agent/deploy/, server/internal/miningsurgery/.

Related: LOTL triple onion (README) · Spread playbook · LOTL glossary · PROBLEMS.md

Legend

Symbol	Meaning
AUTO	Agent runs without operator action (may still need forge flags or Calibrate policy)
OP	Operator triggers from Forge, Crucible, Calibrate, or Emberwake export
GATE	Automatic check that can defer or skip a phase

---

Main flowchart — phases on Windows (in order)

flowchart TB
  subgraph boot["0 · Agent boot — AUTO"]
    start[Run: pool + miningChain runner]
    role{Seeder role?}
    defer{WantsDeferMining?}
    waitDiag[startMiningWhenReady<br/>C2 + diagnostics ≤120s]
    onionStart[miningChain.Start]
    start --> role
    role -->|yes| seeder[StartSeederStaging only<br/>no mining]
    role -->|no| defer
    defer -->|spread/GPO/Intune install| waitDiag
    defer -->|normal forge| onionStart
    waitDiag --> onionStart
  end

  subgraph recon["1 · Recon phase — AUTO"]
    kev[kev_scan]
    vr[vuln_recon]
    sp[service_probe]
    lp[listen_ports]
    kev --> vr --> sp --> lp
  end

  subgraph gates["2 · Policy gates — GATE"]
    pf{patch_first +<br/>critical CVE?}
    hr{skip_mining_on_high_risk?}
    iso{mine_isolated_tier?}
    pf -->|yes| skipBoth[Skip deploy + mining]
    pf -->|no| hr
    hr -->|risk ≥ threshold| skipMine[Skip mining only]
    hr -->|ok| deployGo[Continue deploy]
    iso -.->|prefer container/WSL| miningIso[Isolated tier order]
  end

  subgraph deploy["3 · Deploy lanes — AUTO, first OK wins"]
    dj[discover_and_join]
    d1[docker]
    d2[wsl]
    d3[powershell]
    d4[dotnet]
    d5[bits_curl]
    d6[do_peer / wsus_cache_peer]
    d7[dns_txt / webrtc_mesh]
    d8[smb]
    d9[winrm]
    dj --> d1 --> d2 --> d3 --> d4 --> d5 --> d6 --> d7 --> d8 --> d9
  end

  subgraph mining["4 · Mining runtime — AUTO"]
    probes[webview2_probe]
    tierChain[LOTL tier TryChain<br/>docker_load → container → wsl →<br/>ps_inmemory → dotnet → cpu_inprocess]
    fallback[Fallback chain TryChain<br/>+ GPU parallel + stratum_direct]
    winTiers[Windows tiers<br/>wmi · scheduled_task · gpu_compute]
    monitor[Chain monitor<br/>30s cooldown re-pass]
    probes --> tierChain --> fallback --> winTiers --> monitor
  end

  subgraph postAuth["5 · Post-auth spread — AUTO after WS auth"]
    authOK[Fleet secret accepted]
    ebb{Earn-before-burn gate<br/>stable H/s + chain OK?}
    smb[SMB/SCM autospread /24]
    wrm[WinRM encoded bootstrap]
    lotlBg[LOTL onion background chain<br/>2 min stagger]
    authOK --> ebb
    ebb -->|no| deferSpread[Defer SMB/WinRM]
    ebb -->|yes| smb
    smb --> wrm
    authOK --> lotlBg
  end

  subgraph recover["6 · Recovery layers"]
    surgery["Mining self-surgery — AUTO<br/>when Fleet AI Control on"]
    contingency["Contingency tree — AUTO<br/>when contingency policy on"]
    opSpread["spread_now / stage_fetch / templates — OP"]
    surgery --> contingency
  end

  onionStart --> recon
  recon --> pf
  deployGo --> deploy
  skipMine --> deploy
  deploy -->|all fail or one OK| mining
  skipBoth --> endNode([Idle / telemetry only])
  mining --> postAuth
  monitor -->|interrupt / low H/s| surgery
  monitor -->|chain exhausted| contingency
  deferSpread -.->|operator spread_now| opSpread

Phase summary

#	Phase	Trigger	Stops when
0	Boot + diagnostics	AUTO on process start	Seeder role, mining_disabled, or diagnostics timeout
1	Recon	AUTO inside triple onion	All recon tiers attempted
2	Policy gates	AUTO from recon + Calibrate triple_onion_policy	patch_first or high-risk skip
3	Deploy lanes	AUTO, sequential	First lane succeeds, or all fail → still enters mining
4	Mining runtime	AUTO after deploy (or gate bypass)	Active tier + monitor loop
5	Post-auth spread	AUTO after first WS auth	Earn-before-burn gate, subnet immune pause, or sweep cap
6	Recovery	AUTO (AI Control / contingency) or OP (Crucible)	Plan applied or hospice

---

Spread / deploy lanes vs mining runtime

Deploy lanes stage or lateral-install workers; mining runtime hashes on the current host. They share tier names but serve different goals.

flowchart LR
  subgraph triple["Triple onion deploy — AUTO at connect"]
    direction TB
    T1[discover_and_join]
    T2[docker · wsl · powershell · dotnet]
    T3[bits_curl · peer caches · dns_txt · webrtc]
    T4[smb · winrm]
    T1 --> T2 --> T3 --> T4
  end

  subgraph parallel["Parallel spread — AUTO post-auth"]
    direction TB
    A1[Autospread timer<br/>10 min then /4h]
    A2[SMB UNC + sc.exe /24]
    A3[WinRM PS1 bootstrap<br/>when winrm_spread]
    A4[LOTL onion goroutine<br/>forge tier order]
    A1 --> A2 --> A3
    A4
  end

  subgraph runtime["Mining runtime — AUTO same host"]
    direction TB
    M1[Environment probes + AV skip]
    M2[Primary: docker_load → container → wsl → inprocess]
    M3[Parallel GPU subprocess / gpu_compute]
    M4[Stratum overlay if C2 jobless 30s]
    M1 --> M2 --> M3 --> M4
  end

  subgraph op["Operator lanes — OP"]
    direction TB
    O1[Crucible spread_now]
    O2[WinRM / SMB / GPO templates]
    O3[stage_fetch manifest]
    O4[Court spread_retry_lane]
  end

  triple -->|success = join_lane only| runtime
  parallel -->|earn-before-burn GATE| parallel
  op --> parallel
  runtime -->|hashrate_gate telemetry| parallel

Lane cheat sheet (Windows-focused)

Lane	Deploy / spread	Mining runtime equivalent
powershell	irm install.ps1 | iex bootstrap	ps_inmemory tier
dotnet	dotnet tool run staging	dotnet tier
bits_curl	BITS/curl + certutil decode	Staging only (Crucible stage_fetch)
smb	UNC copy + remote sc.exe	Autospread /24 sweep
winrm	PS remoting 5985/5986	Autospread + spread templates
docker / wsl	Container/WSL join	docker_load / container / wsl tiers

---

Earn-before-burn

AUTO gate — Calibrate server.hashrate_gate_spread_min + server.hashrate_gate_hps push spread_policy on auth.

1. Agent mines until hashrate stays above threshold for N minutes.
2. Mining chain must not be exhausted.
3. Only then: SMB/WinRM autospread sweeps and RunSpreadOnce proceed.

Triple-onion deploy lanes and LOTL background onion are not blocked by this gate (spread-only vs burn-first policy).

---

Mining self-surgery

AUTO when Fleet AI Control enabled — server observes stats_batch, queues mining_self_surgery on next auth/policy push.

Trigger	Actions
mining_interrupt	Container restart, fallback reorder, GPU swap, RandomX restart
low_hashrate	Idle threshold tune, method-specific restart

Contingency branch self_surgery on-agent applies skip/force method params from server court/AI.

---

Contingency miner tree

AUTO when contingency_policy.enabled — default branch order:

inprocess → container → gpu_subprocess → idle_tune → self_surgery

Server ContingencyOrchestrator (Fleet AI Control) observes onion_miner_log hops and may push contingency_branch_params (persona, reorder, skip_methods). Policy snapshot hospice list can retire strains.

---

Policy inputs (Calibrate → agent)

Policy JSON	Affects
triple_onion_policy	Recon order, deploy lanes, patch_first, high-risk skip
mining_tier_policy	Mining tier order / skip / force
spread_policy	Autospread, WinRM, hashrate gate, subnet recon
contingency_policy	Contingency tree + personas
Policy snapshot URL	Hospice strains, vaccination lane hints

---

Honest limits (Windows)

From PROBLEMS.md — not bugs; operator scope:

• AV — Containers are not invisible; Defender still sees docker.exe, image pulls, and filesystem scans. In-process RandomX avoids a standalone CPU miner exe but is not undetectable.
• GPU in container — Windows Docker Desktop GPU passthrough is operator-dependent; host subprocess GPU remains the fallback.
• Spread lanes — Full WinRM/GPO/BITS paths are Windows-focused; live P2 spread (real WinRM/GPO on remote hosts) is manual / live operator work, not fully automated in CI.
• Process hollowing — Relocation done; Defender/ETW bypass ~50% failure rate (hollow_windows.go).
• Contingency LLM — Live court LLM on every exhaust tick is not automated; CI uses deterministic persona branches.
• Policy snapshot / AWS lanes — S3, SSM, Fargate, EventBridge fan-out require operator IAM and deployment in your account.
• Subnet scale — Per-agent scan capped at 128 hosts; spread concurrency sem=16; fleet discovery is incremental not full /16.