Bot Framework / A365 channel infra retries deliveries on 5xx and slow
ACK; without a dedupe the operator webhook is hit multiple times for
the same activity. Add a TTL-keyed in-memory cache on
`(conversationId, activityId)` so duplicate POSTs short-circuit
before touching the webhook.

`_IdempotencyCache` is a small TTL-pruned dict (matching the
`_JwksCache` pattern), driven by `BridgeConfig.idempotency_ttl_seconds`
(default 1h). Activities without either id (channel-control flows
sometimes lack `id`) bypass dedupe — better to over-deliver than to
risk dropping legitimate traffic on missing-id alone.

Pattern adapted from NousResearch/hermes-agent#10037
(`gateway/platforms/msteams.py::_is_duplicate_delivery`). Their
adapter is classic-BF shaped (issue #7) so we re-implement in our
idiom rather than vendor.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The bridge's outbound reply path POSTs the inbound activity's
`serviceUrl` plus a freshly minted user-FIC bearer for the Messaging
Bot API SP. JWT validation (slice 19f) ties that bearer to our
tenant + audience, but once we POST to the URL the destination has
full control over the bearer's traffic. A forged or malformed
activity could redirect us anywhere.

Gate the messages handler on `_is_trusted_service_url(activity.serviceUrl,
cfg.trusted_service_url_suffixes)` — must be `https`, must have a
hostname, and the hostname must end with one of the configured DNS
suffixes. Untrusted: 403 with `untrusted serviceUrl: <repr>`.

Default suffixes adapted from NousResearch/hermes-agent#10037's
`TRUSTED_SERVICE_URL_HOST_SUFFIXES`. The round-3 walkthrough pinned
real Teams traffic at `*.trafficmanager.net` so that's the
load-bearing entry; `.botframework.com`, `.botframework.us`,
`.cloud.microsoft`, `.azure.com` cover cross-channel and Bot
Service-hosted endpoints.

The DNS-boundary detail matters: each suffix carries a leading `.`
so `evil-trafficmanager.net` doesn't slip through a naive endswith.
Tested.

Empty `cfg.trusted_service_url_suffixes` is treated as a config bug
and 403s every request, matching the empty-allowlist behaviour from
slice 19f.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

After the 2026-05-12 walkthrough surfaced Azure Bot Service as a
hard prerequisite for Custom Engine Agent / Copilot Chat
surfacing, the project's value props sharpen materially:

- Path A (AI Teammate): agent-as-M365-tenant-directory-identity.
  Teams 1:1 chat with M365-native identity. No Azure subscription.
- Path B (Custom Engine Agent + Azure Bot Service): Copilot Chat
  agents picker + side-panels in Word/Excel/PowerPoint/Outlook.
  Requires Azure subscription.

Both are structurally distinct from Hermes' sibling Teams adapter
at plugins/platforms/teams/adapter.py (classic Bot Framework,
shipped v2026.4.30; in-flight in NousResearch/hermes-agent#10037
and #13767). The sibling has none of:
- M365 tenant directory identity (Path A's value prop)
- Copilot Chat fabric surfacing (Path B's value prop)

And Hermes-A365 has none of the sibling's:
- Generic Teams chat reach (group, channel, threading,
  attachments without M365 directory presence)

So no overlap. The reframe makes that explicit.

Changes:
- references/m365-surface-coverage.md -- new "Positioning"
  section with two-path table, sibling-plugin signposts, when-
  to-pick-what guidance. Coverage matrix rewritten to attribute
  each surface to its right home (Hermes-A365 Path A / Path B /
  sibling / separate skill). Validation status updated for
  round-8 + slice 19u-a. Highest-value walkthroughs ranked
  against unique Hermes-A365 lane.
- README.md -- new "Hermes-A365 vs sibling Teams plugins"
  section near the top. Surface table reworked for path
  attribution. Known limitations refreshed (streaming shipped,
  wizard shipped, Path B Azure prerequisite documented, #25 +
  #26 follow-ups listed).
- SKILL.md -- frontmatter description and Overview rewritten
  with two-path framing + sibling-plugin distinction. When/
  Don't-Use sections clarified. Surfaces-that-work-today
  refreshed for round-8 + slice 19u-a + Path B Azure
  prerequisite.

Issue cleanup:
- #17 (Teams group + channel walkthrough) closed -- explicitly
  sibling-plugin lane under reframe.
- #18 (invoke activities umbrella) scope-narrowed via comment
  -- composeExtension invokes move to sibling lane; Path
  B-relevant invokes (Outlook task/* via Copilot, search,
  signin/verifyState) stay.
- #16 (Copilot Chat walkthrough) classified as Path B's
  primary validation in comment.
- Upstream comment posted on NousResearch/hermes-agent#20133
  to clarify the non-overlap to maintainers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>