feat(heartbeat): load current thin rules from managed automations

[huangruiteng]

Summary

• Adopt existing Codex heartbeats into a compact bootstrap which reads the installed heartbeat-prompt --thin on every wake. Runtime upgrades then refresh execution rules without per-release host-store rewrites.
• Add batch preview plus explicit macOS offline apply/recovery/rollback. Prefer the native App API while running. Preserve schedule, pause state, model, notifications, thread identity and history; reject divergent stores and stale previews.
• Recognize exact runtime-loaded wrappers in upgrade-plan; support an explicit canary executable for a single-task trial.

Product and authority review

Execution rules remain in the existing thin generator. Discovery proposes adoption, never authorizes overwriting custom instructions. The fallback is a qualified local SQLite/TOML compatibility adapter, not a stable Codex API. It requires the App closed; its dual-store writes have a durable recovery journal, not a false atomicity claim. No automatic scheduler/session migration or new capability is introduced. UI buttons and cloud/Windows adapters are out of scope.

Validation

• Tested revision: 2ecb6408d756968826781f226c6cbd0fcc69eec4
• Run state: finished
• Input classes: synthetic, public_fixture, authorized_private_read_only

Check kind	Result	Public-safe evidence / limitation
unit	passed	52 related Python tests before the final negative discovery case; final migration suite: 16 passed.
real_entrypoint	passed	Real loopx.cli preview and generated thin command against isolated fixture registry.
real_backend	passed	Python SQLite with isolated on-disk Codex-shaped database/TOML; crash between DB commit and mirror, replay, rollback and drift rejection.
integration	passed	Existing upgrade-plan-smoke.py; exact wrapper readback is current, not perpetually stale.
static	passed	Ruff, diff hygiene and public/private boundary scan.
manual	passed	Read-only local inventory: candidates and a divergent host record identified; no live task mutation during validation.
manual	not_run	Live model adherence is not yet qualified; owner requested one-agent preinstallation after merge.

Coverage: no global install, no active goal promotion or mutation, no real host-store fault injection. Native App mutation will use its supported tool for the single-agent trial; offline apply remains closed-App only. PostgreSQL/Todo authority is unchanged. Recovery preserves per-task history rather than restoring a whole database.

Type and direction

• New feature; Host/runtime integration; Core control-plane hardening.
• Base: main. Shared-authority RFC fixture impact: N/A.
• DCO signed. No private prompts, paths, credentials or run logs included.

[huangruiteng]

Final maintainer review after owner approval of the compact bootstrap and a single-agent canary trial:

• Rebased on main including fix(heartbeat): clarify scope-bounded work without tiny-step bias #4180. Exact reviewed head: fce998dc5f63aaeca31db2cbed1a25a57b3b03b3.
• 59 related Python tests pass on that head, including real CLI generation and isolated on-disk SQLite/TOML migration, recovery, stale preview, canary routing, metadata retention and ambiguous discovery negatives. Existing upgrade-plan smoke and static/privacy checks pass.
• Domain execution authority is unchanged: the wrapper loads the current thin generator; Python here owns only local host adaptation. Adoption is explicit, custom prompts are never silently merged, and the fallback refuses a running App. Default-off behavior keeps existing automations untouched.
• No claim of live-model adherence yet. Only one existing ACTIVE task will receive the canary wrapper through the native App API after merge; no global installation or bulk automation replacement.
• Hosted broad CI may still be pending; owner-authorized admin merge uses the scoped real-path/backend qualification above. No known unresolved finding in the changed boundary.