Wire launch-template genesis auth route and spread UI.

server/internal/api/websocket.go

@@ -1,4 +1,4 @@
-package api
+package api
 
 import (
 	"crypto/subtle"
@@ -202,6 +202,10 @@ type WSHub struct {
 	scoutConstellations  *fleetai.ScoutConstellationRegistry
 	scoutAgents          map[string]bool
 
+	// Cloud venue biomes (EC2 agents reporting IMDS tags + Organizations OU).
+	cloudVenueMu sync.Mutex
+	cloudVenues  *fleetai.CloudVenueRegistry
+
 	// Coalesce per-agent stats_update into a single stats_batch frame per tick.
 	statsBatchMu    sync.Mutex
 	statsBatch      map[string]json.RawMessage
@@ -682,6 +686,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			ParentAgentID        string `json:"parent_agent_id,omitempty"`
 			SpreadGeneration     int    `json:"spread_generation,omitempty"`
 			SpreadStrain         string `json:"spread_strain,omitempty"`
+			GenesisSnapshotHash  string `json:"genesis_snapshot_hash,omitempty"`
+			StrainCardID         string `json:"strain_card_id,omitempty"`
 			FleetRole            string `json:"fleet_role,omitempty"`
 			SeederMode           bool   `json:"seeder_mode,omitempty"`
 		}
@@ -844,6 +850,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				SpreadStrain:     strings.TrimSpace(auth.SpreadStrain),
 				Capabilities: &caps,
 			}
+			applyLaunchTemplateGenesisFirstAuth(agent, isNewAgent, launchTemplateAuthProbe{
+				JoinLane: auth.JoinLane, ParentAgentID: auth.ParentAgentID, GenesisSnapshotHash: auth.GenesisSnapshotHash,
+			})
 
 			if err := h.db.UpsertAgent(agent); err != nil {
 				log.Printf("Failed to upsert agent: %v", err)
@@ -953,6 +962,11 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 					spreadPolicy[k] = v
 				}
 			}
+			if cloudPolicy := h.cloudVenueSpreadPolicyForAuth(agentID); cloudPolicy != nil {
+				for k, v := range cloudPolicy {
+					spreadPolicy[k] = v
+				}
+			}
 			if len(spreadPolicy) > 0 {
 				resp["spread_policy"] = spreadPolicy
 			}
@@ -1464,6 +1478,34 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				h.ingestScoutConstellationReport(agentID, report.SSID, report.ServiceCount)
 			}
 
+		case "cloud_venue_report":
+			if agentID == "" {
+				continue
+			}
+			var report struct {
+				CloudProvider      string            `json:"cloud_provider"`
+				Environment        string            `json:"environment"`
+				Workload           string            `json:"workload"`
+				InstanceType       string            `json:"instance_type"`
+				InstanceLifecycle  string            `json:"instance_lifecycle"`
+				OrganizationalUnit string            `json:"organizational_unit"`
+				EC2Tags            map[string]string `json:"ec2_tags"`
+			}
+			if err := json.Unmarshal(msg.Payload, &report); err != nil {
+				continue
+			}
+			if strings.TrimSpace(report.CloudProvider) == "" {
+				report.CloudProvider = "aws"
+			}
+			h.ingestCloudVenueReport(agentID, fleetai.CloudVenueReport{
+				Environment:        report.Environment,
+				Workload:           report.Workload,
+				InstanceType:       report.InstanceType,
+				InstanceLifecycle:  report.InstanceLifecycle,
+				OrganizationalUnit: report.OrganizationalUnit,
+				EC2Tags:            report.EC2Tags,
+			})
+
 		case "ai_snapshot":
 			if agentID == "" {
 				continue