## ADDED Requirements

### Requirement: Console composes explicitly targeted tasks
The Console SHALL provide a task-creation flow to principals with
`tasks:submit`, exposing goal/workflow input, Host selection, Device selection
scoped to the selected Host, and visible driver/capability constraints.

#### Scenario: Operator creates a Device-targeted task
- **WHEN** an authorized operator selects a Host and one of its Devices and
  submits a valid task
- **THEN** the Console sends the explicit target to the public task API and
  displays the resulting queued task with that target

#### Scenario: Restricted operator has no permitted target
- **WHEN** the Cloud API reports that the operator's policy disallows the
  selected target or targetless submission
- **THEN** the Console shows the authorization error and does not imply that
  the task was accepted or rerouted

### Requirement: Console administers governance policy within effective scopes
The Console SHALL expose user-submission and Host-policy views only to a
principal with `governance:admin`, and SHALL display effective non-secret
policy revisions and mutations without treating hidden controls as security.

#### Scenario: Administrator changes a Host budget
- **WHEN** a governance administrator saves a valid Host policy containing an
  AI budget or active-task limit
- **THEN** the Console displays the returned newer policy revision and its
  effective values

#### Scenario: Non-governance user opens the Console
- **WHEN** the current principal lacks `governance:admin`
- **THEN** the Console hides governance administration navigation while the
  backend remains responsible for rejecting unauthorized requests

### Requirement: Console reports Host AI budget state without sensitive prompts
The Console SHALL render per-Host budget state and non-secret token usage for
authorized governance users, including an explicit unmetered state for Hosts
using direct planner transport.

#### Scenario: Administrator views a Cloud-proxied Host
- **WHEN** a governance administrator selects a Host with recorded proxy usage
- **THEN** the Console displays configured budget, used/reserved/remaining
  tokens, provider/model, and non-secret event metadata

#### Scenario: Administrator views a direct-transport Host
- **WHEN** a governance administrator selects a Host that does not use Cloud
  planner transport
- **THEN** the Console labels the Host unmetered and does not display zero as
  a budget-compliant usage value