feat(cloud): add targeted task governance foundation

tests/test_cloud_sdk_api.py

@@ -267,6 +267,70 @@ def test_submit_with_constraints(tmp_path) -> None:
     assert status["status"] == "queued"
 
 
+def test_submit_with_explicit_target_is_listed_and_not_rerouted(tmp_path) -> None:
+    app, pool, scheduler, _ = _build_app(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    pool.sync_host_devices(
+        "host-b",
+        [Device(id="device-b", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    client = _client_for(app)
+
+    response = client.post(
+        "/v1/tasks",
+        json={
+            "goal": "target b",
+            "constraints": {
+                "target_host_id": "host-b",
+                "target_device_id": "device-b",
+            },
+        },
+    )
+    assert response.status_code == 201, response.text
+    task_id = response.json()["task_id"]
+
+    scheduler.assign()
+    task = client.get(f"/v1/tasks/{task_id}").json()
+    assert task["target_host_id"] == "host-b"
+    assert task["target_device_id"] == "device-b"
+    assert task["assigned_host_id"] == "host-b"
+    assert task["assigned_device_id"] == "device-b"
+    listed = client.get("/v1/tasks").json()["items"]
+    assert next(item for item in listed if item["id"] == task_id)["target_host_id"] == "host-b"
+
+
+def test_submit_rejects_incomplete_or_foreign_target(tmp_path) -> None:
+    app, pool, _, _ = _build_app(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    client = _client_for(app)
+
+    missing_host = client.post(
+        "/v1/tasks",
+        json={
+            "goal": "invalid",
+            "constraints": {"target_device_id": "device-a"},
+        },
+    )
+    assert missing_host.status_code == 400
+    foreign_device = client.post(
+        "/v1/tasks",
+        json={
+            "goal": "invalid",
+            "constraints": {
+                "target_host_id": "host-a",
+                "target_device_id": "unknown",
+            },
+        },
+    )
+    assert foreign_device.status_code == 400
+
+
 @pytest.mark.parametrize(
     ("method", "path", "payload", "required_scope"),
     [