v5.0.12 — 隔离 Feishu 消息锚点与完成交接来源

本补丁针对 #474 和 #469。是否已发布以 GitHub Release 为准。

修复与边界

HFC 的消息锚点发布限定为 Feishu，避免改写 LOCAL 等其他平台的 source.message_id。报告者指出该写入会让 LOCAL 现存 source 与恢复 receipt 的来源字典不同，第二轮被 Hermes 拒绝。这个修复不代表所有原生 Hermes storage_unavailable 故障都由 HFC 引起。

Feishu 的完成交接需区别已核验的当前轮消息锚点与原生执行身份。仅当 Feishu 的 admission source 缺少 message_id，而 live source 的 message_id 和 HFC turn marker 都精确等于当前 canonical message ID 时允许这一个差异；反向缺失、不同非空锚点与未知轮次仍拒绝。除此之外，保留其余原生字段的严格比较，以及原 Task、claim、durable row、profile、路由、sender、thread、generation/epoch 与单次终局确认。不能把报告者的身份字段白名单直接当作安全证明。

安装与恢复

仅安装新 wheel 不保证运行中的 Gateway 已加载新 hook。旧安装必须通过正常安装/修复入口刷新受管补丁，并由原服务管理方重启 Gateway 和相关 sidecar。保留 manifest、marker、备份与 journal，不手改 Hermes 源码或删除保护记录。旧补丁升级、重复安装与逐字恢复需单独验收。

对本次安装操作自身产生的受管 PM generation 切换，先核验旧 observer、源码、配置和 runtime 来源，再将 observer 的 runtime identity 交给本次已验证的新 generation；不改配置内容。源码修复放在 admission 完成后，交接失败按原注册事务回滚。安装前已存在的外部运行时漂移不会被自动接受。

失败回滚若由 PM 为旧包重建运行环境，安装器还需核验本次回滚的运行时证据，并让 observer 绑定与已恢复的旧包环境一致。PM facts 保持由 Hermes 管理；证据缺失或漂移会明确报告回滚未完成。

若旧安装升级时 PM generation 已变化，setup 可能先以 legacy observer runtime binding changed 安全拒绝。这时用同一实际 checkout 和 HOME 执行官方 integrity rebind-legacy --hermes-dir <checkout> --hermes-home <HOME> 预览；核对后加 --yes，再重试原来的 setup --repair。该路径核验已安装源码与备份的归属，不把新版 renderer 的变化误判为旧源码未安装；它不接受源码漂移、部分恢复或未知备份。不要删 marker 绕过重绑。

本补丁不扩大 v5.0.11 的精确 Hermes 9b904 安装前态支持范围；全新 PM、旧 receipt、未核验 SDK 和来源漂移仍按原合同拒绝。解压后进入 hermes-feishu-card-v5.0.12-/ 再执行安装器。

验收状态

固定 v0.22.5 源码下已独立复现两条故障；修复后 LOCAL 连续三轮的恢复检查通过（receipt/policy 为测试端口）。v0.22.5 与固定 9b904 的普通/内部事件均通过实际 rendered hook 到完成事件的受控链路。受影响的完成交接回归 434 项通过，本机未提供的两个 9b904 checkout 检查单列跳过，须由对应 CI 门禁补齐，不能视为通过。普通 wheel 升级/恢复、精确完整 CI、tag、公开安装和实际发行包验收分别记录，最终结果绑定正式 Release 中的精确提交。真实 Gateway/model、报告者现场与 Feishu 客户端视觉/实际交互不能由模拟或 CI 代替；最终结果以正式 Release 的证据为准。

#459 已依据报告者提供的原 macOS/POSIX PM 环境成功复测回复并关闭，与本补丁的独立验收分开记录。

贡献

感谢 Alex-HJY 的 #474 报告、源码分析及现场补丁证据，感谢 leavrcn 的 #469 复测与差异分析。代码作者以 Git 提交为准，问题证据不冒作代码署名；既有贡献和历史发行记录保留。

v5.0.12 — Feishu source anchors and bounded terminal handoff

This patch addresses #474 and #469. Publication status follows the GitHub Release.

Changes and boundaries

HFC publishes its source message anchor only for Feishu, preserving LOCAL and other platform sources. The reporter identified a LOCAL live/receipt source mismatch that prevents subsequent turns. This does not attribute every upstream storage_unavailable failure to HFC.

Feishu terminal handoff distinguishes a verified current-turn anchor from native execution identity. The exception only accepts a missing message_id on the Feishu admission source when both the live source anchor and HFC turn marker exactly equal the current canonical message ID. Reverse omissions, different nonempty anchors and unknown turns remain rejected. It retains strict comparison of all other native source fields, original Task/claim/durable row, profile, route, sender, thread, generation/epoch and single-use acknowledgement. The reporter's identity-field allowlist alone is not a safety proof.

Upgrade and recovery

Installing a new wheel alone does not refresh the hook already loaded by Gateway. Existing installations must use the normal installer/repair entry to refresh the managed patch and restart Gateway and the applicable sidecar through their service owner. Keep manifests, markers, backups and journals. Do not edit Hermes source or delete protection records. Old-patch upgrade, repeated installation and byte-for-byte restore require separate verification.

For a managed PM generation change performed by this installation itself, the installer first verifies the old observer, source, config and runtime provenance, then hands only the observer runtime identity to that operation’s verified new generation. Config contents remain unchanged. Source repair follows admission, and failed handoff rolls back through the registration transaction. Pre-existing external runtime drift is not automatically accepted.

If PM rebuilds an environment for the old package during rollback, the installer verifies that rollback's runtime evidence before aligning the observer with the restored package environment. Hermes retains ownership of PM facts; missing or changed evidence is reported as incomplete rollback.

If PM generation changed during an upgrade, setup can first refuse safely with legacy observer runtime binding changed. Preview the official integrity rebind-legacy --hermes-dir <checkout> --hermes-home <HOME> using the same actual checkout and HOME, then explicitly apply with --yes and retry the original setup --repair. Rebinding verifies ownership of the installed source and backups without mistaking a newer renderer for an uninstalled source; source drift, partial restore and unknown backups remain rejected. Do not delete markers to bypass rebinding.

This patch does not expand v5.0.11's restricted exact Hermes 9b904 installation starting states. Fresh PM, old receipts, unverified SDKs and source drift retain their existing refusal contracts. Enter hermes-feishu-card-v5.0.12-/ after extraction before running an installer.

Validation boundaries

Both failures were independently reproduced against pinned v0.22.5 source. The repaired LOCAL recovery check passed three consecutive turns, with receipt/policy test ports. Normal/internal events passed the rendered-hook-to-completion chain on v0.22.5 and pinned 9b904. The affected completion suite passed 434 tests; two missing local 9b904-checkout checks were skipped and require the corresponding CI gate, not an assumed pass. Ordinary-wheel upgrade/restore, exact full CI, tag, public installation and actual assets remain separate gates tied to the published Release commit. Simulation and CI do not replace real Gateway/model, reporter deployment or Feishu client visual/interaction acceptance. The published Release records final evidence.

Issue #459 was acknowledged and closed based on the reporter's successful original macOS/POSIX PM environment retest, separately from this patch's acceptance.

Credits

Thanks to Alex-HJY for #474, source analysis and field-patch evidence, and leavrcn for the #469 retest and mismatch analysis. Code authorship follows Git commits; issue evidence is credited separately. Existing credits and release history remain intact.

Final release verification / 最终发布验证

• Merge: fd3881205d10a3c898d0724aee8b482d1a0e0c71; annotated tag v5.0.12 (4a9b193260703f7fd88081285eb844dd80518c00).
• PR full matrix: 57/57, exact main matrix: 57/57, and both CodeQL runs passed.
• Tag gate and assets: 59/59. Actual Linux archive extraction: eight root/nonroot cases passed. Actual macOS archives passed four cases. Destination identity/owner/mode, sentinels, file contents and executable modes were preserved; the old flat-layout negative control was detected. All four asset digests match across platforms.
• Anonymous public Git tag installation passed in a private HOME with a noneditable package, exact commit provenance, all 153 package resources matching the release source, real plugin entry-point load and CLI help.
• Ordinary-wheel same-HOME 5.0.11 upgrade, repeat setup and restore passed; 20,799 source files restored byte-for-byte. Post-source-write and pre-handoff SDK fault injection preserved the old package/config/source state, reconciled the observer with the verified rollback runtime and allowed direct setup retry without manual rebind. The final test-only commit has the same package resources as the accepted lifecycle wheel.
• Controlled real Feishu API verification hit the new one-sided anchor branch, created and updated one card, read back its terminal content, recorded no native fallback and confirmed recall. One earlier update required a retry and then succeeded; that evidence was retained (the proof does not identify its exact HTTP/platform error code). A separate final run passed without update errors.
• Actual Gateway/model execution, reporter field retesting and desktop/mobile visual or click acceptance remain unverified. These are not inferred from CI or the controlled API checks.

#474 and #469 remain open for field confirmation; #459 was separately replied to and closed after the reporter confirmed recovery.

Public download follow-up: anonymous Release HTML and all four asset URLs returned successfully; downloaded digests matched the verified draft, and four macOS extraction cases passed again. Anonymous API metadata hit GitHub rate limiting (HTTP 403), so metadata readback used the authenticated API; the page and asset bytes were fetched without Authorization headers.