feat(cloud): add targeted task governance foundation

2026-07-13 22:21:12 +08:00
parent a3ba94be04
commit 2cd314b183
41 changed files with 2099 additions and 15 deletions
@@ -0,0 +1,61 @@
+## MODIFIED Requirements
+
+### Requirement: Host identity is authenticated and bound to one host id
+The internal Host Agent API SHALL require a host-scoped bearer principal and
+SHALL reject any request that attempts to act for a `host_id` different from
+the authenticated principal's bound host.
+
+#### Scenario: Host authenticates as itself
+- **WHEN** a Host Agent presents valid credentials bound to its requested
+  `host_id`
+- **THEN** the internal API authorizes permitted heartbeat, claim, renewal,
+  result, policy retrieval, and self-submission operations
+
+#### Scenario: Host attempts to impersonate another host
+- **WHEN** valid credentials bound to host A are used on a request for host B
+- **THEN** the internal API rejects the request without reading or modifying
+  host B's state
+
+### Requirement: Host Agent synchronizes heartbeat and complete device snapshots
+The Host Agent SHALL periodically submit its complete local device snapshot
+and last applied policy revision to the control plane, and the control plane
+SHALL atomically refresh the host heartbeat, replace only that host's
+pooled-device records, and return the effective Host policy whenever its
+revision differs.
+
+#### Scenario: Host reports devices
+- **WHEN** a Host Agent submits a valid heartbeat containing its current devices
+- **THEN** the control plane updates the host's last-seen time and exposes the
+  submitted devices through the aggregated pool
+
+#### Scenario: Host policy revision changed
+- **WHEN** a Host heartbeat presents a revision older than the effective
+  Cloud-host policy
+- **THEN** the response includes the complete newer policy and revision for the
+  Host to cache
+
+#### Scenario: Host policy revision is current
+- **WHEN** a Host heartbeat presents the current effective policy revision
+- **THEN** the response confirms that revision without resending an unrelated
+  policy representation
+
+#### Scenario: Host reports no devices
+- **WHEN** a previously populated host submits an empty device snapshot
+- **THEN** only that host's prior device records are removed while devices
+  owned by other hosts remain unchanged
+
+## ADDED Requirements
+
+### Requirement: Host can submit a self-targeted goal through the outbound protocol
+The Host Agent SHALL be able to submit a goal-only task through its existing
+outbound authenticated protocol, and the control plane SHALL derive its target
+from the authenticated Host rather than accepting another Host identifier.
+
+#### Scenario: Host submits a local goal
+- **WHEN** an authenticated Host submits a valid goal through its internal
+  self-submission operation
+- **THEN** the control plane returns a queued task targeted to that Host
+
+#### Scenario: Host submits an ineligible local Device
+- **WHEN** a Host names a Device that is not owned by its authenticated Host
+- **THEN** the control plane rejects the request without creating a task