## ADDED Requirements

### Requirement: Fresh Hosts register directly with the trusted Cloud API
The Cloud API SHALL accept a first Host registration without a configured
enrollment token or Authorization header, assign a durable `host_id`, and store
only the digest of the Host-generated high-entropy secret.

#### Scenario: Fresh Host registers without static configuration
- **WHEN** a Host Agent with no cached identity sends a valid instance
  identifier and generated Host secret to the enrollment endpoint
- **THEN** the Cloud API creates or returns the durable Host identity and does
  not require a pre-shared deployment credential

#### Scenario: Registration is retried by the same Host
- **WHEN** the same Host retries registration with its original instance
  identifier and candidate secret after losing the response
- **THEN** the Cloud API returns the existing Host identity without creating a
  duplicate Host row

### Requirement: Registered Hosts authenticate all later operational requests
The system SHALL require the persisted Host secret for device enrollment,
heartbeat, claim, renewal, and result operations after first registration, and
SHALL bind each accepted request to its registered `host_id`.

#### Scenario: Registered Host sends a heartbeat
- **WHEN** a Host presents its persisted secret for its own Host identity
- **THEN** the Cloud API accepts the heartbeat subject to normal validation

#### Scenario: Caller attempts a Host operation without its secret
- **WHEN** a caller accesses any post-registration Host operation without a
  valid secret bound to the path Host identity
- **THEN** the Cloud API rejects the operation without changing Host state

### Requirement: Host Agent configuration contains no static Cloud credential
The Host Agent SHALL use its cached identity when present and otherwise perform
direct registration, without `HOST_AGENT_HOST_ID`, `HOST_AGENT_TOKEN`, or
`HOST_AGENT_ENROLLMENT_TOKEN` configuration.

#### Scenario: Fresh Host starts with only its local state path
- **WHEN** a Host Agent starts with no cached Cloud identity and no static Host
  credential environment values
- **THEN** it generates and persists an identity through direct registration
  before starting heartbeat or assignment polling