feat(scheduler): add Trae App heartbeat host

docs/book/chapters/06-codex-app.md

@@ -101,7 +101,7 @@ loopx history --goal-id <goal-id> --limit 10
 - `scheduler_hint` 是否适用于 `codex_app`；
 - 最新 run 是否包含验证和 writeback，而不只是 status poll。
 
-如果 `scheduler_hint.codex_app.stateful_backoff.apply_needed=true`，还要确认 App 实际应用了
+如果 `scheduler_hint.app_automation.stateful_backoff.apply_needed=true`，还要确认 App 实际应用了
 `recommended_rrule`，随后执行 packet 提供的完整 `ack_hint.cli_args`。仅看到 recommendation 或
 本地 ACK ledger 都不足以证明 cadence 已生效；实际 Host RRULE readback 若报告 drift，必须按当前
 hint 修复。

docs/book/en/chapters/06-codex-app.md

@@ -103,7 +103,7 @@ Check:
 - whether `scheduler_hint` applies to `codex_app`;
 - whether the latest run contains validation and writeback rather than only a status poll.
 
-When `scheduler_hint.codex_app.stateful_backoff.apply_needed=true`, also verify that the App applied the
+When `scheduler_hint.app_automation.stateful_backoff.apply_needed=true`, also verify that the App applied the
 `recommended_rrule` and then ran the packet's complete `ack_hint.cli_args`. A recommendation or local ACK
 ledger alone does not prove that Host cadence changed. If actual RRULE readback reports drift, repair it
 from the current hint.

docs/development/control-plane-course/03-first-real-loop.md

@@ -647,7 +647,7 @@ Scheduler ACK 应保留的关键字段：
 goal_id     = <goal-id>
 agent_id    = <agent-id>
 surface     = codex_app
-state_key   = scheduler_hint.codex_app.stateful_backoff
+state_key   = scheduler_hint.app_automation.stateful_backoff
 RRULE       = FREQ=MINUTELY;INTERVAL=3
 ```
 

docs/development/control-plane-course/07-host-scheduler-and-heartbeat.md

@@ -174,7 +174,7 @@ loopx quota scheduler-ack-current \
   --goal-id <goal-id> \
   --agent-id <agent-id> \
   --surface codex_app \
-  --state-key scheduler_hint.codex_app.stateful_backoff \
+  --state-key scheduler_hint.app_automation.stateful_backoff \
   --reset-token <proposal-reset-token> \
   --identity-signature <proposal-identity-signature> \
   --applied-rrule 'FREQ=MINUTELY;INTERVAL=30' \

docs/heartbeat-automation-prompt.md

@@ -631,23 +631,23 @@ When creating a heartbeat in Codex App, keep the visible instruction short and
 put the lifecycle in the automation task body. The default onboarding cadence
 starts at 3 minutes; after the first guard, follow
 `quota should-run.scheduler_hint` to back off long waits and stop external loops
-after a final quota/replan check confirms repeated unchanged polls. Codex App
+after a final quota/replan check confirms repeated unchanged polls. App-hosted
 heartbeats should search/use `automation_update` when available. If
 `scheduler_hint.action=stop_until_explicit_resume` and
-`scheduler_hint.codex_app.host_action=pause_or_delete_current_heartbeat`: in
+`scheduler_hint.app_automation.host_action=pause_or_delete_current_heartbeat`: in
 that terminal case, call `automation_update` once to pause the current
 heartbeat (delete only if pause is unavailable), verify the host result, spend
 no quota, and end the turn without a scheduler ACK. Otherwise call it only when
-`scheduler_hint.codex_app.stateful_backoff.apply_needed=true` and
-`scheduler_hint.codex_app.recommended_rrule` is present. After a successful
+`scheduler_hint.app_automation.stateful_backoff.apply_needed=true` and
+`scheduler_hint.app_automation.recommended_rrule` is present. After a successful
 RRULE update, run `loopx` with
-`scheduler_hint.codex_app.ack_hint.cli_args`; current payloads use
+`scheduler_hint.app_automation.ack_hint.cli_args`; current payloads use
 `quota scheduler-ack-current` so LoopX re-reads the latest hint and owns the
 progression/reset state. The ACK settles that RRULE; an immediate final guard
 may verify the same target but must not be treated as another elapsed poll.
 Attempt the host update at most once per hint and
 turn. If it fails or times out, do not retry or ACK; run
-`scheduler_hint.codex_app.failure_hint.cli_args` once to persist the failed
+`scheduler_hint.app_automation.failure_hint.cli_args` once to persist the failed
 target and observed host RRULE without spending quota. Exact repeats are then
 suppressed until either value changes. Continue any allowed delivery under the
 observed host cadence. When the desired RRULE is already applied, skip
@@ -657,7 +657,7 @@ hint directly, otherwise do nothing. For the uniquely matched current heartbeat,
 `host_observation.status=drift_detected` result reopens `apply_needed`:
 
 If `automation_update` is unavailable in the session and
-`scheduler_hint.codex_app.fallback_hint.available=true`, run the bound
+`scheduler_hint.app_automation.fallback_hint.available=true`, run the bound
 `fallback_hint.cli_args` (`loopx-apply-rrule`) once instead. It backs up
 `codex-dev.db`, syncs the automation TOML and SQLite row, and runs the bound
 ACK; direct SQLite edits bypass the app API, so this is a bounded fallback and
@@ -813,10 +813,10 @@ This prompt is intentionally a lifecycle template. Scheduling policy lives in
 controller loop, Codex CLI TUI, Claude Code loop, or future Codex goal-mode
 automations can all share the same LoopX quota guard without hard-coding
 different wait loops. Host implementations should first honor a terminal
-`codex_app.host_action=pause_or_delete_current_heartbeat` by stopping the
+`app_automation.host_action=pause_or_delete_current_heartbeat` by stopping the
 current heartbeat once, verifying the result, and ending without scheduler ACK
 or quota spend. Otherwise they should read the compact
-`codex_app.stateful_backoff` packet, call `automation_update` only when
+`app_automation.stateful_backoff` packet, call `automation_update` only when
 `apply_needed=true`, and then let `quota scheduler-ack-current` persist the
 applied RRULE state from the latest scheduler hint without spending quota. A
 matching reset readback may instead set `ack_needed=true`; in that case skip the

docs/integrations/runtime-connector-catalog.md

@@ -32,7 +32,8 @@ about the work.
 
 | id | surface | execution_mode | wake_triggers | state_writeback | liveness_signal | stop_reset_policy | budget_meter | human_visibility | boundary | smoke_expectation |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| `codex_app_heartbeat` | Codex App automation | Scheduled headless app thread | Codex App heartbeat RRULE; `scheduler_hint.reset_policy.reset_token` | `todo` lifecycle, `refresh-state`, then `quota spend-slot` after validation | Heartbeat run plus quota event | Apply `scheduler_hint.codex_app` reset/backoff; cadence-only changes do not spend | Per-goal/per-agent quota slot after validated writeback | Visible thread, heartbeat XML, concrete user todo when required | Generated heartbeat prompt; scoped `--agent-id`; no project-specific prompt branches | Prompt smoke covers scheduler hint, reset token, identity, and no-spend cadence change. |
+| `codex_app_heartbeat` | Codex App automation | Scheduled headless app thread | Codex App heartbeat RRULE; `scheduler_hint.reset_policy.reset_token` | `todo` lifecycle, `refresh-state`, then `quota spend-slot` after validation | Heartbeat run plus quota event | Apply `scheduler_hint.app_automation` reset/backoff; cadence-only changes do not spend | Per-goal/per-agent quota slot after validated writeback | Visible thread, heartbeat XML, concrete user todo when required | Generated heartbeat prompt; scoped `--agent-id`; no project-specific prompt branches | Prompt smoke covers scheduler hint, reset token, identity, and no-spend cadence change. |
+| `trae_app` | Trae App automation | Scheduled app thread | Trae App heartbeat schedule; `scheduler_hint.reset_policy.reset_token` | `todo` lifecycle, `refresh-state`, then `quota spend-slot` after validation | Heartbeat run plus quota event | Apply the provider-neutral `scheduler_hint.app_automation` cadence packet with `host_surface=trae_app` through Trae `automation_update`; keep non-terminal settled turns active; no Codex packet or local-store fallback | Per-goal/per-agent quota slot after validated writeback | Visible Trae thread and concrete user todo when required | Generated heartbeat prompt; scoped `--agent-id`; ambient `TRAECLI_THREAD_ID`; no Codex local automation-store mutation | Host activation smoke covers distinct runtime identity, automation setup, three-minute initial cadence contract, and non-terminal continuation. |
 | `codex_app_ssh_goal` | Codex App connected to a remote workspace over SSH | Visible interactive Goal loop | Host `/goal` continuation; no automation-tool dependency | Same CLI todo/refresh/spend path, with `--source visible-goal` after validation | Visible Goal state plus compact LoopX status | Complete only on terminal no-follow-up; after three unchanged blocked turns, native `update_goal(status=blocked)` stops host continuation while LoopX remains active; user `/goal resume` reactivates it | Quota slot after validated writeback; no spend for gates, waits, final checks, or host blocking | User sees the active Codex task and its concrete gate or next action | Generated body stays within the `/goal` 4000-character limit and never invents `LOOPX_TURN` or calls `automation_update` | Agent-onboard smoke proves exact host selection, typed scheduler context, body budget, bounded quiet stop, and absence of heartbeat-only instructions. |
 | `codex_cli_tui` | Codex CLI TUI | Visible interactive terminal loop | User bootstrap, `/goal`, or visible continuation | Same CLI todo/refresh/spend path | TUI transcript plus compact LoopX status | Uses the same native `update_goal(status=blocked)` and `/goal resume` contract after the typed unchanged limit | Quota slot after validated writeback; no spend for blocked/final-check transitions | User sees the active TUI turn | Do not silently switch to hidden headless execution or copy raw transcripts | TUI prompt/bootstrap smoke covers scoped identity and native blocked/resume semantics. |
 | `claude_code_loop` | Claude Code loop | Visible local agent loop | Slash command, local loop tick, or host loop continuation | Same CLI todo/refresh/spend path | Loop status plus compact transcript pointer | Final quota/replan check before stop when unchanged limit is configured | Quota slot after validated writeback; no spend for stop/final check | User sees local loop status and response | No private material, credentials, production action, or hidden approval bypass | Loop smoke covers scoped identity, unchanged final check, and stop-without-spend. |
@@ -49,7 +50,7 @@ about the work.
 ### Reusable shell_worker reference
 
 `scripts/external_scheduler_worker.py` is a scheduler-hint-aware `shell_worker`
-for generic visible CLI loops (for example TraeX). Each tick runs
+for generic visible CLI loops (for example TraeX CLI). Each tick runs
 `quota should-run --include-detail scheduler`, projects a one-line public-safe
 status (`waiting`/`should_run`/`terminal`, cadence class, next check minutes,
 unchanged count), and sleeps per the `local_scheduler` progression ladder. It

docs/quota-allocation.md

@@ -883,7 +883,7 @@ of an error string.
       "execution_required": false,
       "request": "loopx quota should-run --include-detail scheduler",
       "hot_path_runtime_fields": [
-        "codex_app",
+        "app_automation",
         "unchanged_poll",
         "reset_policy"
       ],
@@ -900,8 +900,8 @@ of an error string.
     "reset_policy": {
       "reset_token": "0123456789abcdef",
       "host_state_key": "scheduler_hint.reset_policy.reset_token",
-      "codex_app_initial_interval_minutes": 30,
-      "codex_app_initial_rrule": "FREQ=MINUTELY;INTERVAL=30",
+      "app_automation_initial_interval_minutes": 30,
+      "app_automation_initial_rrule": "FREQ=MINUTELY;INTERVAL=30",
       "identity_signature": "123456789abc"
     }
   },
@@ -1088,19 +1088,19 @@ agent-to-agent handoff cadence too quickly;
 `backoff_until_fresh_evidence` handles mapped or post-handoff no-op waits.
 For Codex App and local schedulers, `recommended_interval_minutes` is the next
 target interval. For Codex App heartbeats, `recommended_rrule` is emitted only
-when `codex_app.stateful_backoff.apply_needed=true`; if the desired RRULE is
+when `app_automation.stateful_backoff.apply_needed=true`; if the desired RRULE is
 already applied, it is omitted so the agent does not call a host tool again.
 If that match still needs a reset-token/identity binding,
 `stateful_backoff.ack_needed=true` and the bound ack runs without a host update.
 When an apply is required but `automation_update` is unavailable in the
-session, `codex_app.fallback_hint` carries the bounded `loopx-apply-rrule`
+session, `app_automation.fallback_hint` carries the bounded `loopx-apply-rrule`
 command for the resolved automation (backup `codex-dev.db`, sync TOML+SQLite,
 run the bound ACK). Direct SQLite edits bypass the app API, so the fallback is
 projected only for this gap and never as the routine path; an unresolved
 automation id projects `available=false` and requires the pasteable heartbeat
 gate instead of guessing.
 After a successful host RRULE update, the agent records that fact with
-`loopx` plus `codex_app.ack_hint.cli_args`; current payloads use
+`loopx` plus `app_automation.ack_hint.cli_args`; current payloads use
 `quota scheduler-ack-current` to re-read the latest scheduler hint before LoopX
 advances the per goal/agent scheduler state without spending quota. Human gates
 can move Codex App heartbeats through `[30, 60]` after the concrete user todo
@@ -1131,7 +1131,7 @@ Agent-scope waits use a more conservative adjustment curve such as
 agent-to-agent interaction cadence before cooling further.
 The compact hot path carries only the reset fields hosts need to act:
 `reset_policy.reset_token`, `host_state_key`,
-`codex_app_initial_interval_minutes`, `codex_app_initial_rrule`, and the short
+`app_automation_initial_interval_minutes`, `app_automation_initial_rrule`, and the short
 `identity_signature`. Hosts should cache and compare `reset_token` across
 unchanged polls and reset the unchanged streak whenever the token changes. The
 token is derived from scheduler action plus the current identity/profile inputs;
@@ -1140,13 +1140,13 @@ stateful-backoff policy live in `scheduler_hint.cold_path_detail` when callers
 request `loopx quota should-run --include-detail scheduler`. Hosts should also
 reset when an external event makes the goal actionable again, such as user
 feedback in the thread, a new or reassigned todo, a resolved gate, or material
-evidence transition. A reset applies `codex_app_initial_interval_minutes` (and
+evidence transition. A reset applies `app_automation_initial_interval_minutes` (and
 the matching local scheduler initial interval) before starting unchanged
 backoff again; it never spends quota.
 For Codex App heartbeats, hosts and agents should use `automation_update` only
-when `codex_app.stateful_backoff.apply_needed=true` and
-`codex_app.recommended_rrule` is present. After `automation_update` succeeds,
-the agent must run `codex_app.ack_hint.cli_args`. Current payloads use
+when `app_automation.stateful_backoff.apply_needed=true` and
+`app_automation.recommended_rrule` is present. After `automation_update` succeeds,
+the agent must run `app_automation.ack_hint.cli_args`. Current payloads use
 `quota scheduler-ack-current`, so LoopX then persists `reset_token`,
 `identity_signature`, `progression_index`, and
 `last_applied_rrule` under the runtime root. Repeated unchanged identity
@@ -1160,7 +1160,7 @@ quota state. If `apply_needed=false` and `ack_needed=true`, the same command
 records an exact matching host readback without calling `automation_update`.
 If `automation_update` fails or times out, the agent must not ACK. LoopX keeps
 the observed host RRULE authoritative. The agent runs
-`codex_app.failure_hint.cli_args` once to persist the failed target/observed-host
+`app_automation.failure_hint.cli_args` once to persist the failed target/observed-host
 pair without quota spend. LoopX retains up to four distinct pairs for 24 hours,
 so active-work and monitor-wait targets cannot overwrite one another while the
 host RRULE remains unchanged. Later heartbeats expose `apply_needed=false` and

docs/reference/contracts/dashboard-budget-governance-contract.md

@@ -12,7 +12,7 @@ creating a browser-side source of truth.
 | Operator concept | Source fields | Meaning in the dashboard |
 | --- | --- | --- |
 | Budget | `quota.compute`, `quota.allowed_slots`, `quota.spent_slots`, `quota.state` | How much automatic agent time this goal may consume in the current quota window, and whether it can run now. |
-| Cadence | `scheduler_hint.codex_app`, `scheduler_hint.unchanged_poll`, `scheduler_hint.reset_policy`; opt-in cold detail from `scheduler_hint.cold_path_detail.local_scheduler` | How often the host should wake the agent, when backoff applies, and when user feedback or new work resets the interval. |
+| Cadence | `scheduler_hint.app_automation`, `scheduler_hint.unchanged_poll`, `scheduler_hint.reset_policy`; opt-in cold detail from `scheduler_hint.cold_path_detail.local_scheduler` | How often the host should wake the agent, when backoff applies, and when user feedback or new work resets the interval. |
 | Spend rule | `interaction_contract.cli_channel.spend_policy`, `scheduler_hint.unchanged_poll.spend_policy`, `work_lane_contract` | Which transitions spend quota and which lifecycle checks are no-spend. |
 | Human controls | user todos, operator gates, `local_dashboard_api`, future control-plane dry-run/apply paths | What a human can approve, pause, override, or resume, and whether the browser is allowed to preview or apply a change. |
 | Evidence | todo ids, run ids, quota spend events, compact artifacts, source warnings | Why the dashboard believes the current budget/governance state and where to audit it. |

docs/reference/contracts/interface-budget-contract.md

@@ -10,7 +10,7 @@ and size/count budgets.
 | --- | --- | --- | --- | --- | --- | --- |
 | `heartbeat_prompt_json` | heartbeat automation | wake and route one bounded turn | `quota should-run`, `status`, or `review-packet --handoff-only` | `json_chars <= 4800` plus `interface_budget.within_budget=true` | `nested_keys <= 40` | `top_level_keys <= 30` |
 | `review_packet_handoff_only_json` | project-agent handoff | forward the smallest sufficient task packet | full `review-packet` or run-history artifact | `json_chars <= 3000` plus `handoff_interface_budget.within_budget=true` | `nested_keys <= 40` | `top_level_keys <= 18` |
-| `quota_should_run_json` | quota guard | decide whether the selected goal may spend compute | `status`, `history`, or active state | `json_chars <= 13000` | `nested_keys <= 330` | `top_level_keys <= 52` |
+| `quota_should_run_json` | quota guard | decide whether the selected goal may spend compute | `status`, `history`, or active state | `json_chars <= 14000` | `nested_keys <= 350` | `top_level_keys <= 52` |
 | `dashboard_status_json` | operator dashboard | render first-screen operator state | `history`, run artifacts, or project-local adapter output | `json_chars <= 19500` | `nested_keys <= 260` | `top_level_keys <= 25` |
 
 These four budgets measure compact machine payloads. For

docs/reference/effect-interpreter-packet.md

@@ -142,8 +142,8 @@ The observation points back into the loop:
 | `execution_mode` | Execution strategy (`serial` / `parallel` / `interleaved`) for an ordered effect program |
 | `scheduler_hint.action` | Scheduler around decision |
 | `scheduler_hint.cadence_class` | Cadence for the next host wake |
-| `scheduler_hint.codex_app.ack_hint.cli_args` | Host ACK effect |
-| `scheduler_hint.codex_app.failure_hint.cli_args` | Host failure effect |
+| `scheduler_hint.app_automation.ack_hint.cli_args` | Host ACK effect |
+| `scheduler_hint.app_automation.failure_hint.cli_args` | Host failure effect |
 
 `EffectTurn.next_effect` is the code lens for this slot. It keeps the
 data-encoded handler visible: the host invokes the CLI actions and settles