fix(cloud): align planner configuration and records

openspec/changes/cloud-console-governance/design.md

@@ -40,8 +40,9 @@ or `tools`.
   control layer.
 - General remote Host control, inbound connections, or allowing one Host to
   enqueue work for another Host.
-- Charging, invoice generation, provider price catalogues, prompt/screenshot
-  retention, or an attempt to hard-limit direct-to-provider planner calls.
+- Charging, invoice generation, provider price catalogues, defining planner
+  prompt/screenshot retention (owned by `task-execution-progress-visibility`),
+  or an attempt to hard-limit direct-to-provider planner calls.
 - Cloud workflow-definition distribution.  Host-self submission is goal-only
   because a workflow definition is still stored locally on each Host.
 
@@ -162,9 +163,10 @@ when `tasks:submit` is present.  Policy and usage administration render only
 for `governance:admin`; backend scope and policy checks are authoritative.
 
 Every policy change records a safe audit event with actor, target, old/new
-revision, and non-secret values.  The Console clears any password inputs from
-the existing Users flow and never displays provider credentials, prompts,
-screenshots, cookies, or lease secrets.
+revision, and non-secret values. The governance views clear password inputs and
+never display provider credentials, screenshots, cookies, or lease secrets;
+the separate task-detail planner-history view is governed by
+`task-execution-progress-visibility`.
 
 ## Risks / Trade-offs
 

openspec/changes/cloud-console-governance/specs/cloud-planner-proxy/spec.md

@@ -18,18 +18,19 @@ the remaining budget.
 - **THEN** the endpoint returns a structured failure without invoking the
   configured provider
 
-### Requirement: Planner proxy settles provider-reported token usage without persisting prompts
+### Requirement: Planner proxy settles provider-reported token usage without duplicating planner decision content
 The Cloud planner-decision endpoint SHALL settle its reservation to the
 provider-reported token usage when available and SHALL retain only non-secret
-metering metadata, never the raw prompt, screenshot, provider credentials, or
-session/lease secret.
+metering metadata in its usage event, never raw prompt text, screenshot bytes,
+provider credentials, or session/lease secrets. This does not constrain the
+separate bounded planner-decision history defined by `cloud-planner-proxy`.
 
 #### Scenario: Provider response includes usage
 - **WHEN** the configured provider returns a valid tool-call decision and
   token-usage metadata
 - **THEN** the endpoint records and returns the decision, settles the Host's
-  reservation to the reported usage, and does not durably store request text
-  or screenshot bytes
+  reservation to the reported usage, and records a usage event without request
+  text or screenshot bytes
 
 #### Scenario: Usage is indeterminate after failure
 - **WHEN** a reservation exists but the endpoint cannot determine provider

openspec/changes/task-execution-progress-visibility/specs/cloud-planner-proxy/spec.md

@@ -1,3 +1,7 @@
+## REMOVED Requirements
+
+### Requirement: Planner-decision requests are not durably persisted
+
 ## ADDED Requirements
 
 ### Requirement: Cloud Control Plane persists each resolved planner decision for later retrieval