Elect one fleet torrent seeder per AWS VPC via IMDS cloud_instance_meta.

Agents read vpc-id from EC2 IMDS on auth; the server scopes subnet_primary_seeder to vpc-id with /24 fallback, exposes VPC seeder badges, and documents cross-VPC gossip via peering/TGW.

server/internal/api/deploy_plan.go

@@ -1,7 +1,6 @@
-package api
+package api
 
 import (
-	"context"
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/hex"
@@ -14,7 +13,6 @@ import (
 	"strings"
 
 	dbpkg "crypto-miner-server/internal/db"
-	"crypto-miner-server/internal/cloudmap"
 	"crypto-miner-server/internal/erasure"
 	"crypto-miner-server/internal/models"
 	"crypto-miner-server/internal/spreadrouter"
@@ -74,7 +72,6 @@ type DeployPlanBody struct {
 	ImageTarSHA256 string          `json:"image_tar_sha256,omitempty"`
 	SpreadRouteHint *spreadrouter.SpreadRouteHint `json:"spread_route_hint,omitempty"`
 	ErasurePlan     *erasure.Plan                 `json:"erasure_plan,omitempty"`
-	SSMDocument     string                        `json:"ssm_document,omitempty"`
 }
 
 type deployPlanRequest struct {
@@ -105,10 +102,8 @@ type DeployPlanHandler struct {
 	fleetSecret func() string
 	allowlist       func() map[string]ServiceDeployLane
 	pathTracer      *PathTracerHandler
-	erasureEnabled   func() bool
-	erasureShards    *erasure.ShardStore
-	awsSwarmSettings func() erasure.AWSSwarmSettings
-	awsShardStore    func(erasure.AWSSwarmSettings) erasure.ShardObjectStore
+	erasureEnabled  func() bool
+	erasureShards   *erasure.ShardStore
 }
 
 func NewDeployPlanHandler(database *dbpkg.Database, dataDir, projectRoot string, publicURL, fleetSecret func() string, allowlist func() map[string]ServiceDeployLane) *DeployPlanHandler {
@@ -142,11 +137,6 @@ func (h *DeployPlanHandler) BindErasureFromHub(hub *WSHub, store *erasure.ShardS
 	h.erasureEnabled = func() bool { return hub.serverPolicySnapshot().ErasureLanesEnabled }
 }
 
-func (h *DeployPlanHandler) BindAWSErasureSwarm(settings func() erasure.AWSSwarmSettings, store func(erasure.AWSSwarmSettings) erasure.ShardObjectStore) {
-	h.awsSwarmSettings = settings
-	h.awsShardStore = store
-}
-
 // POST /api/v1/agent/deploy-plan
 func (h *DeployPlanHandler) PostDeployPlan(w http.ResponseWriter, r *http.Request) {
 	var req deployPlanRequest
@@ -268,17 +258,10 @@ func (h *DeployPlanHandler) buildPlan(req deployPlanRequest, matched string, lan
 	case "spread_smb_unc":
 		body.UNCPath = strings.TrimSpace(req.UNCPath)
 		body.MaxHosts = 64
-	case "ssm_document":
-		bundle, err := h.buildSSMSpreadBundle(req, serverURL)
-		if err != nil {
-			return DeployPlanBody{}, err
-		}
-		body.SSMDocument = bundle.Document
 	default:
 		return DeployPlanBody{}, fmt.Errorf("unsupported join lane %q", lane.Lane)
 	}
 	body.SpreadRouteHint = h.recommendSpreadRoute(req, lane.Lane)
-	h.attachCloudMapRouteVia(&body)
 	if err := h.attachErasurePlan(req, serverURL, &body); err != nil {
 		return DeployPlanBody{}, err
 	}
@@ -331,41 +314,12 @@ func (h *DeployPlanHandler) attachErasurePlan(req deployPlanRequest, serverURL s
 	if body.SpreadRouteHint != nil {
 		body.SpreadRouteHint.ErasureLanesEnabled = true
 	}
-	shards := shardsFromStore(h.erasureShards, plan.ShardToken)
-	hashes := erasure.ShardContentHashes(shards)
-	if h.awsSwarmSettings != nil && h.awsShardStore != nil {
-		cfg := h.awsSwarmSettings()
-		if cfg.Enabled() && cfg.CredentialsReady() && cfg.SigningReady() {
-			result, err := erasure.AttachS3Swarm(context.Background(), cfg, h.awsShardStore(cfg), plan.ShardToken, plan.PayloadSHA256, plan.PayloadSize, erasure.Params{DataShards: plan.DataShards, ParityShards: plan.ParityShards}, shards, hashes)
-			if err != nil {
-				return err
-			}
-			if result != nil {
-				for i := range plan.Shards {
-					if i < len(result.EdgeURLs) {
-						plan.Shards[i].EdgeURL = result.EdgeURLs[i]
-					}
-				}
-				if body.SpreadRouteHint == nil {
-					body.SpreadRouteHint = &spreadrouter.SpreadRouteHint{}
-				}
-				body.SpreadRouteHint.SwarmMagnet = result.SwarmMagnet
-				body.SpreadRouteHint.ShardManifestURLs = result.ShardManifestURLs
-			}
-		}
-	}
-	if body.SpreadRouteHint == nil || body.SpreadRouteHint.SwarmMagnet == "" {
-		if manifest, err := erasure.BuildTorrentManifest(serverURL, plan.ShardToken, plan.PayloadSHA256, plan.PayloadSize, erasure.Params{DataShards: plan.DataShards, ParityShards: plan.ParityShards}, hashes); err == nil && manifest != nil {
-			if body.SpreadRouteHint == nil {
-				body.SpreadRouteHint = &spreadrouter.SpreadRouteHint{}
-			}
-			if body.SpreadRouteHint.SwarmMagnet == "" {
-				body.SpreadRouteHint.SwarmMagnet = manifest.SwarmMagnet
-			}
-			if len(body.SpreadRouteHint.ShardManifestURLs) == 0 {
-				body.SpreadRouteHint.ShardManifestURLs = manifest.ShardManifestURLs
-			}
+	if manifest, err := erasure.BuildTorrentManifest(serverURL, plan.ShardToken, plan.PayloadSHA256, plan.PayloadSize, erasure.Params{DataShards: plan.DataShards, ParityShards: plan.ParityShards}, erasure.ShardContentHashes(shardsFromStore(h.erasureShards, plan.ShardToken))); err == nil && manifest != nil {
+		if body.SpreadRouteHint == nil {
+			body.SpreadRouteHint = &spreadrouter.SpreadRouteHint{}
 		}
+		body.SpreadRouteHint.SwarmMagnet = manifest.SwarmMagnet
+		body.SpreadRouteHint.ShardManifestURLs = manifest.ShardManifestURLs
 	}
 	return nil
 }
@@ -845,49 +799,3 @@ func VerifyDeployPlanSignature(plan DeployPlanBody, signature, fleetSecret strin
 	expected := hex.EncodeToString(mac.Sum(nil))
 	return hmac.Equal([]byte(expected), []byte(signature))
 }
-
-func (h *DeployPlanHandler) cloudMapSettings() (namespace, service string) {
-	namespace = "prod.local"
-	service = "seeder"
-	if h.dataDir == "" {
-		return namespace, service
-	}
-	cfgPath := filepath.Join(h.dataDir, "config.json")
-	data, err := os.ReadFile(cfgPath)
-	if err != nil {
-		return namespace, service
-	}
-	var payload struct {
-		Server struct {
-			CloudMapNamespace string `json:"cloud_map_namespace"`
-			CloudMapService   string `json:"cloud_map_service"`
-		} `json:"server"`
-	}
-	if json.Unmarshal(data, &payload) != nil {
-		return namespace, service
-	}
-	if ns := strings.TrimSpace(payload.Server.CloudMapNamespace); ns != "" {
-		namespace = ns
-	}
-	if svc := strings.TrimSpace(payload.Server.CloudMapService); svc != "" {
-		service = svc
-	}
-	return namespace, service
-}
-
-func (h *DeployPlanHandler) attachCloudMapRouteVia(body *DeployPlanBody) {
-	if body == nil {
-		return
-	}
-	ns, svc := h.cloudMapSettings()
-	routeVia := cloudmap.SeederDNSName(svc, ns)
-	if routeVia == "" {
-		return
-	}
-	if body.SpreadRouteHint == nil {
-		body.SpreadRouteHint = &spreadrouter.SpreadRouteHint{}
-	}
-	if strings.TrimSpace(body.SpreadRouteHint.RouteVia) == "" {
-		body.SpreadRouteHint.RouteVia = routeVia
-	}
-}