chore(openspec): archive edge-host-enrollment

Sync delta specs into main specs before archiving: modified
cloud-control-plane, device-pool, and host-agent-protocol; created
new edge-host-enrollment capability spec. openspec validate --specs
reports 18/18 passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openspec/specs/cloud-control-plane/spec.md

@@ -33,22 +33,26 @@ The Cloud Control Plane SHALL run configurable scheduler and expired-lease maint
 - **THEN** its lifecycle workers stop accepting new iterations and terminate without abandoning an in-process database transaction
 
 ### Requirement: Deployment and local persistence modes share one contract
-The cloud repository SHALL support PostgreSQL for deployed operation and SQLite for local development and tests through the same behavioral contract, including hosts, devices, tasks, leases, attempts, and plugins.
+The cloud repository SHALL support PostgreSQL for deployed operation and SQLite for local development and tests through the same behavioral contract, including hosts, dynamic Host credential bindings, device enrollments, pooled devices, tasks, leases, attempts, and plugins.
 
 #### Scenario: Start with PostgreSQL
 - **WHEN** the configured database URL selects PostgreSQL and the schema is current
-- **THEN** the control plane uses PostgreSQL for all cloud state and transactional assignment operations
+- **THEN** the control plane uses PostgreSQL for cloud state, enrollment idempotency, authentication lookup, and transactional assignment operations
 
 #### Scenario: Start in local SQLite mode
 - **WHEN** the configured database URL selects SQLite in a local or test environment
-- **THEN** the same repository contract is available with the documented single-control-plane concurrency limitation
+- **THEN** the same repository contract, including Host and device enrollment, is available with the documented single-control-plane concurrency limitation
 
 ### Requirement: Cloud schema is versioned with migrations
 The system SHALL provide versioned forward and downgrade database migrations and SHALL refuse readiness when the database schema is incompatible with the running application.
 
 #### Scenario: Upgrade an existing cloud database
-- **WHEN** an operator applies the release's migrations to a supported previous schema
-- **THEN** existing hosts, devices, tasks, and plugins are retained and the new lease fields become available
+- **WHEN** an operator applies the enrollment release migration to a database at revision 0001
+- **THEN** existing hosts, pooled devices, tasks, attempts, and plugins are retained while nullable Host enrollment fields and durable device enrollment storage are added
+
+#### Scenario: Downgrade the enrollment schema
+- **WHEN** an operator downgrades revision 0002 while no enrollment-capable application process is connected
+- **THEN** dynamic Host credential and device enrollment storage is removed while legacy cloud state from revision 0001 remains available
 
 #### Scenario: Schema is behind at startup
 - **WHEN** the application connects to a database whose schema version is not accepted by the running release
@@ -75,3 +79,18 @@ The application SHALL expose separate liveness and readiness endpoints and SHALL
 #### Scenario: Task lifecycle is logged
 - **WHEN** a task is assigned, claimed, renewed, completed, retried, or failed
 - **THEN** the log event includes available task, host, device, attempt, lease, and correlation identifiers but excludes bearer tokens, screenshots, UI trees, and typed text
+
+### Requirement: Dynamic Host authentication uses durable credential digests
+The Cloud Control Plane SHALL authenticate dynamically enrolled Host bearer credentials through indexed repository lookup of a cryptographic token digest and SHALL compose that lookup with existing configured credentials.
+
+#### Scenario: Enrolled Host authenticates after Cloud API restart
+- **WHEN** a non-revoked enrolled Host presents its bearer credential after the Cloud API restarts
+- **THEN** the repository-backed authentication provider resolves the stored Host binding and authorizes only Host-scoped internal operations
+
+#### Scenario: Dynamic Host credential calls a public route
+- **WHEN** a dynamically enrolled Host credential is presented to a public SDK operation requiring a scope
+- **THEN** the request is rejected for missing scope rather than inheriting public operator privileges
+
+#### Scenario: Static credential deployment remains active
+- **WHEN** an operator continues to configure a Host-bound credential through the existing environment configuration
+- **THEN** that Host can use the existing operational protocol without performing bootstrap enrollment