feat(cloud): enforce host governance budgets

openspec/changes/cloud-console-governance/tasks.md

@@ -51,13 +51,13 @@
 
 - [x] 4.1 Extend shared internal heartbeat request/response models with the
       Host's last policy revision and a revision-aware effective-policy reply.
-- [ ] 4.2 Update Host heartbeat synchronization to persist only safe cached
+- [x] 4.2 Update Host heartbeat synchronization to persist only safe cached
       policy state and expose it through local status/history without adding an
       inbound Cloud connection.
 - [x] 4.3 Add the Host-scoped goal-only task-submission route and
       `HostAgentClient` method; derive Host targeting from authenticated
       credentials and validate any named local Device ownership.
-- [ ] 4.4 Enforce the Host policy's self-submission and active-task limits in
+- [x] 4.4 Enforce the Host policy's self-submission and active-task limits in
       the Cloud service/scheduler, not only in Host-local code.
 - [ ] 4.5 Add Cloud API and Host Agent tests for revision convergence,
       unchanged-policy replies, self-targeted task creation, foreign target
@@ -71,7 +71,7 @@
 - [ ] 5.2 Extend planner-proxy request context and Host-Agent-local context
       binding so Cloud-proxied calls carry known task/attempt metadata without
       importing Host or Cloud concerns into `runtime`.
-- [ ] 5.3 Add Cloud proxy preflight reservation, configured conservative
+- [x] 5.3 Add Cloud proxy preflight reservation, configured conservative
       per-call ceiling, provider invocation, actual-usage settlement, and
       bounded unknown-usage reservation expiry.
 - [ ] 5.4 Record non-secret usage events and expose accurate
@@ -87,7 +87,7 @@
 - [x] 6.1 Add task composer API bindings and a scope-aware Console form for
       goal/workflow submission, Host/Device target selection, and target/policy
       validation errors.
-- [ ] 6.2 Complete or reconcile the admin Users view, then add user-
+- [x] 6.2 Complete or reconcile the admin Users view, then add user-
       submission-policy editing with safe refresh and conflict/error handling.
 - [ ] 6.3 Add Host policy administration and AI-usage/budget views, including
       revision display, unmetered direct Hosts, and no rendering of prompts,