feat(cloud): add edge host enrollment

packages/cloud-platform/cloud/repository.py

@@ -16,6 +16,39 @@ ResultRecordStatus = Literal["recorded", "already_recorded", "conflict"]
 LeaseRenewalStatus = Literal["renewed", "not_found", "conflict", "expired"]
 
 
+class HostEnrollmentConflictError(RuntimeError):
+    """Raised when a Host enrollment cannot preserve its existing binding."""
+
+
+class EnrollmentTokenConflictError(HostEnrollmentConflictError):
+    """Raised when a one-time enrollment token is already bound elsewhere."""
+
+
+class DeviceEnrollmentConflictError(RuntimeError):
+    """Raised when a local device enrollment conflicts with stored identity."""
+
+
+@dataclass(frozen=True)
+class HostEnrollment:
+    host_id: str
+    agent_instance_id: str
+    display_name: str | None
+    enrolled_at: datetime
+    revoked_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class DeviceEnrollment:
+    device_id: str
+    host_id: str
+    local_device_id: str
+    driver_type: str
+    name: str | None
+    capability_tags: list[str]
+    enrolled_at: datetime
+    revoked_at: datetime | None = None
+
+
 @dataclass(frozen=True)
 class TaskAttemptRecord:
     task_id: str
@@ -46,6 +79,53 @@ class LeasedAssignment:
 class CloudRepository(Protocol):
     """Persistence port for cloud state and atomic scheduling operations."""
 
+    def enroll_host(
+        self,
+        *,
+        host_id: str,
+        agent_instance_id: str,
+        credential_digest: str,
+        enrollment_token_digest: str,
+        display_name: str | None,
+        enrolled_at: datetime,
+    ) -> HostEnrollment: ...
+
+    def authenticate_enrolled_host(
+        self,
+        credential_digest: str,
+    ) -> str | None: ...
+
+    def revoke_enrolled_host(
+        self,
+        host_id: str,
+        *,
+        revoked_at: datetime,
+    ) -> bool: ...
+
+    def is_enrollment_managed_host(self, host_id: str) -> bool: ...
+
+    def enroll_device(
+        self,
+        *,
+        device_id: str,
+        host_id: str,
+        local_device_id: str,
+        driver_type: str,
+        name: str | None,
+        capability_tags: list[str],
+        enrolled_at: datetime,
+    ) -> DeviceEnrollment: ...
+
+    def get_device_enrollment(
+        self,
+        device_id: str,
+    ) -> DeviceEnrollment | None: ...
+
+    def list_device_enrollments(
+        self,
+        host_id: str,
+    ) -> list[DeviceEnrollment]: ...
+
     def upsert_host(
         self,
         host_id: str,