## ADDED Requirements

### Requirement: Host identity can be established by direct registration
The internal Host Agent API SHALL accept a fresh Host registration without a
pre-shared deployment credential, SHALL assign a durable Host identifier, and
SHALL store only the digest of the Host-generated secret for subsequent
host-scoped authentication.

#### Scenario: Fresh Host establishes an identity
- **WHEN** a fresh Host Agent submits a valid registration request containing
  its instance identifier and generated secret
- **THEN** the control plane returns a durable Host identifier and stores only
  the secret digest bound to that Host

#### Scenario: Registration request is retried
- **WHEN** the same Host Agent repeats registration with its original instance
  identifier and secret after a lost response
- **THEN** the control plane returns the existing Host identifier without
  creating a second Host identity

## MODIFIED Requirements

### Requirement: Host identity is authenticated and bound to one host id
After direct registration, the internal Host Agent API SHALL require a
host-scoped bearer principal for all Host operational requests and SHALL reject
any request that attempts to act for a `host_id` different from the
authenticated principal's bound host. The initial registration endpoint is the
only exception and establishes that bound principal.

#### Scenario: Host authenticates as itself after registration
- **WHEN** a Host Agent presents the persisted generated secret bound to its
  requested `host_id`
- **THEN** the internal API authorizes permitted heartbeat, claim, renewal, and
  result operations

#### Scenario: Host attempts to impersonate another host
- **WHEN** valid credentials bound to host A are used on a request for host B
- **THEN** the internal API rejects the request without reading or modifying
  host B's state