2.2 KiB
2.2 KiB
ADDED Requirements
Requirement: Fresh Hosts register directly with the trusted Cloud API
The Cloud API SHALL accept a first Host registration without a configured
enrollment token or Authorization header, assign a durable host_id, and store
only the digest of the Host-generated high-entropy secret.
Scenario: Fresh Host registers without static configuration
- WHEN a Host Agent with no cached identity sends a valid instance identifier and generated Host secret to the enrollment endpoint
- THEN the Cloud API creates or returns the durable Host identity and does not require a pre-shared deployment credential
Scenario: Registration is retried by the same Host
- WHEN the same Host retries registration with its original instance identifier and candidate secret after losing the response
- THEN the Cloud API returns the existing Host identity without creating a duplicate Host row
Requirement: Registered Hosts authenticate all later operational requests
The system SHALL require the persisted Host secret for device enrollment,
heartbeat, claim, renewal, and result operations after first registration, and
SHALL bind each accepted request to its registered host_id.
Scenario: Registered Host sends a heartbeat
- WHEN a Host presents its persisted secret for its own Host identity
- THEN the Cloud API accepts the heartbeat subject to normal validation
Scenario: Caller attempts a Host operation without its secret
- WHEN a caller accesses any post-registration Host operation without a valid secret bound to the path Host identity
- THEN the Cloud API rejects the operation without changing Host state
Requirement: Host Agent configuration contains no static Cloud credential
The Host Agent SHALL use its cached identity when present and otherwise perform
direct registration, without HOST_AGENT_HOST_ID, HOST_AGENT_TOKEN, or
HOST_AGENT_ENROLLMENT_TOKEN configuration.
Scenario: Fresh Host starts with only its local state path
- WHEN a Host Agent starts with no cached Cloud identity and no static Host credential environment values
- THEN it generates and persists an identity through direct registration before starting heartbeat or assignment polling