Managed metering and hosted-compute policy

ReaperCI core remains complete and unlimited when self-hosted. Managed stacks add two isolated control-plane identities after first startup:

• usage:read can read an exact billing-window snapshot containing hosted build seconds, current storage bytes, and managed server count. BYO assignments are excluded by the core from hosted seconds.
• managed:write can read and replace the hosted-compute admission policy. It is combined with managed:credentials on the encrypted ReaperCI Cloud control identity. The credential scope can rotate only that identity itself or the isolated usage:read metering identity; it grants no administrative access to repositories, users, builds, deployments, or other service accounts.

managed:write is intentionally not implied by admin. It cannot be granted by the normal PAT API or by an owner-created service account. The first-startup bootstrap principal is recorded by immutable principal ID and is the only API identity permitted to create the managed control account. ReaperCI Cloud removes the plaintext bootstrap token file after both managed credentials are encrypted. Ordinary administrators also cannot rotate, disable, or delete that identity or its credential. The bootstrap principal may disable it, while routine 90-day rotation is performed by the narrowly scoped managed control identity.

The policy records plan metadata, included usage, hosted build concurrency, the exact billing window, and whether hosted builds are serviceable. An absent policy means self-hosted and allows hosted claims. Managed local workers enforce the synchronized concurrency cap at claim time, so plan changes do not require restarting the hub merely to lower or raise admission within its worker pool. A disabled policy has two effects:

1. runner: hosted queue requests fail with HTTP 402 and the structured hosted_builds_disabled error.
2. The local BuildKit worker stops claiming queued runner: auto work.

BYO workers do not consult this policy, so they may continue to claim compatible runner: auto and runner: byo builds. Already running work is not terminated; the policy is an admission boundary, not a remote kill switch.

ReaperCI Cloud synchronizes the policy after each Stripe subscription event and during recurring usage collection. active subscriptions and unexpired trials allow hosted compute. Expired trials, past_due, paused, and canceled subscriptions disable it. Included usage overages remain metered and visible; they do not silently stop BYO capacity.