40 lines
1.8 KiB
Markdown
40 lines
1.8 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Host identity can be established by direct registration
|
|
The internal Host Agent API SHALL accept a fresh Host registration without a
|
|
pre-shared deployment credential, SHALL assign a durable Host identifier, and
|
|
SHALL store only the digest of the Host-generated secret for subsequent
|
|
host-scoped authentication.
|
|
|
|
#### Scenario: Fresh Host establishes an identity
|
|
- **WHEN** a fresh Host Agent submits a valid registration request containing
|
|
its instance identifier and generated secret
|
|
- **THEN** the control plane returns a durable Host identifier and stores only
|
|
the secret digest bound to that Host
|
|
|
|
#### Scenario: Registration request is retried
|
|
- **WHEN** the same Host Agent repeats registration with its original instance
|
|
identifier and secret after a lost response
|
|
- **THEN** the control plane returns the existing Host identifier without
|
|
creating a second Host identity
|
|
|
|
## MODIFIED Requirements
|
|
|
|
### Requirement: Host identity is authenticated and bound to one host id
|
|
After direct registration, the internal Host Agent API SHALL require a
|
|
host-scoped bearer principal for all Host operational requests and SHALL reject
|
|
any request that attempts to act for a `host_id` different from the
|
|
authenticated principal's bound host. The initial registration endpoint is the
|
|
only exception and establishes that bound principal.
|
|
|
|
#### Scenario: Host authenticates as itself after registration
|
|
- **WHEN** a Host Agent presents the persisted generated secret bound to its
|
|
requested `host_id`
|
|
- **THEN** the internal API authorizes permitted heartbeat, claim, renewal, and
|
|
result operations
|
|
|
|
#### Scenario: Host attempts to impersonate another host
|
|
- **WHEN** valid credentials bound to host A are used on a request for host B
|
|
- **THEN** the internal API rejects the request without reading or modifying
|
|
host B's state
|