release: secure Zeus v0.5.0

[brainx]

Summary

• migrate the pinned real-Hermes baseline to the verified 0.20.0 source tag and its egress-aware Docker/session transcript
• upgrade the reviewed cryptography override to 50.0.0 and validate every permitted upstream metadata conflict
• reject unsafe Feishu webhook activation across rendered, ambient, persisted, legacy, and launch-time profile sources while preserving WebSocket mode
• harden audit-broker cleanup against outstanding terminal work and add a mandatory real Linux Docker-isolation CI gate
• ship the selected dark Midnight Systems project hero and tighten the signed release workflow/checklist

Security alerts

• Alert chore(deps): bump ruamel-yaml from 0.18.17 to 0.19.1 #17 / GHSA-g6cj-pr64-35w5 (cryptography, high): the release lock replaces affected 48.0.1 with patched 50.0.0. The real-Hermes job passed with this exact reviewed override. Owner: brainx. Removal/review deadline: close when GitHub recalculates the merged manifest; recheck before tagging.
• Alert chore(deps): bump tqdm from 4.69.1 to 4.70.0 #15 / GHSA-xq8w-9jvx-gm3v (hermes-agent, medium): the affected range is <=0.19.0; this branch removes the 0.19 package baseline and installs verified 0.20.0 source from the signed v2026.8.3 tag, pinned commit, and checked archive digest. Owner: brainx. Removal/review deadline: close when GitHub recalculates the merged manifest; review again on the next Hermes baseline update or before v0.6.0.
• Alert chore(deps): bump prompt-toolkit from 3.0.52 to 3.0.53 #16 / GHSA-pmqc-57g8-c22c (hermes-agent Feishu webhook, medium): Zeus supports only Feishu WebSocket mode at its managed boundary. Webhook activation is rejected fail-closed at render, effective-environment, persisted-config, legacy-config, and launch-time boundaries; absent mode is reserved as WebSocket. The documented global Hermes administrator environment remains external authority. Owner: brainx. Removal/review deadline: review on every Hermes baseline update and before v0.6.0; remove the guard only after an upstream fix is independently verified.

No release-relevant alert is left without a fix or explicit compensating control.

Verification

• local make release-check and distribution checksum verification — passed at 4baa30f before the bounded Docker-engine compatibility follow-ups
• exact head 3bd818d hosted CI — all 9 jobs passed
• exact-head unit suite — ran 1,184 tests; OK with 2 expected environment-dependent skips
• exact-head coverage suite — ran 1,184 tests; OK with 2 expected environment-dependent skips; total 82.02%
• exact-head real Docker isolation and real Hermes 0.20 jobs — passed
• exact pinned-image Docker isolation test — passed locally after the final mount-contract change
• repository, Ruff format/lint, mypy, Bandit, and ShellCheck gates — passed
• exact-head package build, installed-wheel smoke test, metadata check, and dependency consistency — passed
• OpenAPI SHA-256 remains dbf873a17a2a5d10af5193312b6789a7fb95782576d3f8dd2492845b18762a71

The required hosted real-hermes and audit-docker-isolation release gates both passed on the exact merge candidate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d63e8d569

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle profile validation errors in bot doctor

When a persisted profile enables Feishu webhook mode, this validation raises UnsupportedFeishuWebhookModeError directly from HermesAdapter.command. The zeus bot doctor path catches only TemplateError in cli.py, so running the diagnostic on exactly the unsafe profile it should report cleanly instead emits a full traceback and exits without the CLI error contract; convert these new validation exceptions at the adapter boundary or catch them in the doctor path.

Useful? React with 👍 / 👎.