feat(cloud): add edge host enrollment

tests/test_cloud_migrations.py

@@ -29,12 +29,23 @@ def test_forward_and_downgrade_migrations_on_empty_database(tmp_path) -> None:
         table_names = set(inspect(engine).get_table_names())
         assert {
             "host_registrations",
+            "device_enrollments",
             "pooled_devices",
             "scheduled_tasks",
             "plugins",
             "task_attempts",
         } <= table_names
         assert current_revision(database_url) == HEAD_REVISION
+        host_columns = {
+            column["name"]
+            for column in inspect(engine).get_columns("host_registrations")
+        }
+        assert {
+            "agent_instance_id",
+            "credential_digest",
+            "enrollment_token_digest",
+            "revoked_at",
+        } <= host_columns
     finally:
         engine.dispose()
 
@@ -43,6 +54,7 @@ def test_forward_and_downgrade_migrations_on_empty_database(tmp_path) -> None:
     engine = create_engine(database_url)
     try:
         inspector = inspect(engine)
+        assert "device_enrollments" not in inspector.get_table_names()
         assert "task_attempts" not in inspector.get_table_names()
         task_columns = {
             column["name"] for column in inspector.get_columns("scheduled_tasks")
@@ -95,6 +107,14 @@ def test_legacy_data_survives_upgrade_and_downgrade(tmp_path) -> None:
             column["name"] for column in inspect(engine).get_columns("scheduled_tasks")
         }
         assert {"attempt_count", "lease_id", "result_json"} <= task_columns
+        host_columns = {
+            column["name"]
+            for column in inspect(engine).get_columns("host_registrations")
+        }
+        assert {"agent_instance_id", "credential_digest", "revoked_at"} <= (
+            host_columns
+        )
+        assert "device_enrollments" in inspect(engine).get_table_names()
     finally:
         engine.dispose()
 
@@ -114,6 +134,40 @@ def test_legacy_data_survives_upgrade_and_downgrade(tmp_path) -> None:
         engine.dispose()
 
 
+def test_enrollment_downgrade_to_revision_0001_preserves_legacy_state(
+    tmp_path,
+) -> None:
+    database_url = _database_url(tmp_path)
+    upgrade_database(database_url)
+    engine = create_engine(database_url)
+    try:
+        with engine.begin() as connection:
+            connection.execute(
+                text(
+                    "insert into host_registrations "
+                    "(host_id, address, last_seen_at) values "
+                    "('legacy-host', null, '2026-01-01T00:00:00+00:00')"
+                )
+            )
+    finally:
+        engine.dispose()
+
+    downgrade_database(database_url, "0001_cloud_repository")
+
+    engine = create_engine(database_url)
+    try:
+        inspector = inspect(engine)
+        assert "device_enrollments" not in inspector.get_table_names()
+        assert connection_scalar(engine, "select count(*) from host_registrations") == 1
+        host_columns = {
+            column["name"] for column in inspector.get_columns("host_registrations")
+        }
+        assert "credential_digest" not in host_columns
+        assert current_revision(database_url) == "0001_cloud_repository"
+    finally:
+        engine.dispose()
+
+
 def test_schema_readiness_requires_head_revision(tmp_path) -> None:
     database_url = _database_url(tmp_path)
 
@@ -146,3 +200,8 @@ def _create_legacy_schema(connection) -> None:
         "name text primary key, version text not null, entry_point_kind text not null, "
         "target text not null, wired integer not null)"
     )
+
+
+def connection_scalar(engine, statement: str):
+    with engine.connect() as connection:
+        return connection.scalar(text(statement))