agentic-mobile-control/openspec/changes/edge-host-enrollment/tasks.md

1. Durable Enrollment Repository

• 1.1 Add Host and device enrollment records plus repository protocol operations for atomic enrollment, credential lookup/revocation, device lookup, and managed-Host detection.
• 1.2 Extend SQLAlchemy models and add Alembic revision 0002 with forward/downgrade support, indexes, uniqueness constraints, and the updated schema head.
• 1.3 Implement atomic Host enrollment idempotency and one-time enrollment-token consumption in the SQL repository for SQLite and PostgreSQL.
• 1.4 Implement dynamic credential lookup/revocation and idempotent Host-scoped device enrollment in the SQL repository.
• 1.5 Add repository contract and migration tests covering success, retries, token reuse conflicts, revocation, per-Host device identity, and schema preservation.

2. Cloud Authentication And Internal API

• 2.1 Parse and validate CLOUD_ENROLLMENT_TOKENS_JSON without exposing token values, while retaining existing configured bearer credentials.
• 2.2 Add enrollment-token verification, repository-backed dynamic Host authentication, and composed authentication providers.
• 2.3 Add Host/device enrollment request-response models and authenticated internal API routes with generated cloud IDs and conflict handling.
• 2.4 Require enrollment-managed Host heartbeat snapshots to contain only enrolled, non-revoked device IDs with matching driver types while preserving legacy snapshot behavior.
• 2.5 Compose enrollment services into the deployable Cloud API and add HTTP tests for bootstrap, idempotency, authorization, device enrollment, heartbeat validation, restart authentication, and public-scope isolation.

3. Edge Identity And Device Mapping Storage

• 3.1 Add an atomic, restrictive-permission Host identity store that persists pending and completed enrollment state across response loss and restart.
• 3.2 Extend Host Agent configuration to support explicit legacy credentials or managed enrollment with configurable token and identity-state path.
• 3.3 Extend DeviceConfigStore with nullable cloud device mappings and backward-compatible schema upgrade/read/write operations.
• 3.4 Add focused tests for identity-state recovery, configuration mode validation, file secrecy behavior, and device mapping persistence.

4. Host Agent Enrollment Startup

• 4.1 Extend the Host Agent client with synchronous bootstrap/device-enrollment operations that preserve existing retry and typed-error behavior.
• 4.2 Resolve managed Host identity before application construction, persisting the candidate secret before the request and assigned Host ID after success.
• 4.3 Enroll configured local devices before building the managed DeviceManager, persist mappings, and register drivers under cloud device IDs while leaving legacy mode unchanged.
• 4.4 Update Host Agent application and heartbeat/assignment tests for first enrollment, response-loss retry, restart reuse, device mapping recovery, legacy compatibility, and startup ordering.

5. Deployment And Operations

• 5.1 Add enrollment-token and identity-path variables to example/Compose deployment configuration without overwriting existing registry/image customizations.
• 5.2 Update cloud and macOS edge deployment documentation for managed enrollment, secret/state handling, static fallback, revocation, migration, rollback, and outbound-only networking.

6. Verification

• 6.1 Run formatting/static checks and focused repository, migration, Cloud API, Host Agent, deployment-contract, and end-to-end tests.
• 6.2 Run the complete non-integration workspace test suite and resolve regressions without modifying unrelated cloud-console work.
• 6.3 Run strict OpenSpec validation, review the final diff for credential leakage and architecture-boundary violations, and record verified limitations.