feat(cloud): enforce host governance budgets

packages/cloud-platform/cloud/repository.py

@@ -15,7 +15,13 @@ if TYPE_CHECKING:
         UserAccount,
         UserSession,
     )
-    from cloud.governance import HostGovernancePolicy, UserSubmissionPolicy
+    from cloud.governance import (
+        HostGovernancePolicy,
+        TokenReservation,
+        TokenUsageSummary,
+        TokenUsageEvent,
+        UserSubmissionPolicy,
+    )
 
 
 AttemptStatus = Literal["assigned", "dispatched", "done", "failed", "expired"]
@@ -293,6 +299,7 @@ class CloudRepository(Protocol):
         submission_enabled: bool,
         allowed_host_ids: tuple[str, ...] | None,
         allowed_device_targets: tuple[tuple[str, str], ...] | None,
+        expected_revision: int | None,
         updated_at: datetime,
     ) -> UserSubmissionPolicy: ...
 
@@ -305,9 +312,30 @@ class CloudRepository(Protocol):
         self_submission_enabled: bool,
         max_active_tasks: int | None,
         daily_token_budget: int | None,
+        expected_revision: int | None,
         updated_at: datetime,
     ) -> HostGovernancePolicy: ...
 
+    def count_active_tasks_for_host(self, host_id: str) -> int: ...
+
+    def reserve_host_token_budget(
+        self, *, reservation_id: str, host_id: str, usage_day: str,
+        reserved_tokens: int, task_id: str | None, attempt: int | None,
+        created_at: datetime, expires_at: datetime,
+    ) -> TokenReservation | None: ...
+
+    def settle_host_token_reservation(
+        self, *, reservation_id: str, event_id: str, provider: str, model: str,
+        input_tokens: int | None, output_tokens: int | None, total_tokens: int,
+        occurred_at: datetime,
+    ) -> TokenUsageEvent | None: ...
+
+    def cleanup_expired_token_reservations(self, *, now: datetime, limit: int) -> int: ...
+
+    def get_host_token_usage_summary(
+        self, *, host_id: str, usage_day: str, now: datetime,
+    ) -> TokenUsageSummary: ...
+
     def list_reserved_device_ids(self, *, now: datetime) -> set[str]: ...
 
     def assign_task(