docs(hux): record live foundation canary evidence

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf

docs/hux/HANDOFF.md

@@ -373,3 +373,17 @@ tolerance fix in the voice gate).
 4. HUX-11 live gates → card-by-card flag enablement with lifecycle
    acceptance → enforcement after park/resume + stop receipts pass live →
    HUX-12 after the runbook above → Worker separately.
+
+
+## Live canary evidence (2026-08-24 ~09:05 UTC)
+
+Foundation canary LIVE and verified on hermes-chat-tenant-3:
+- Commits: source 2f535d3a (build 21), Flux digest 1d29c25c, activation 39a54482 (partition 3, HUX_FLAGS=hux.foundation, enforcement 0).
+- Image: registry.bstein.dev/bstein/hermes-webui:git-2f535d3a...-build-21-release@sha256:e5b9b2fa8296a7b8a6065c63e7b288cd3305d70a3acc4312055b819bb5f64c04 on webui + hux + hux-evidence-producer (pod imageIDs verified); agent digest unchanged (sha256:c64c06e6...).
+- canary_verify: 15/15 PASS (all containers ready, ordinals 0-2 untouched and huxless, loopback /healthz ok, subject binding present, public https://chat.bstein.dev/healthz 200, Flux Ready).
+- Live route matrix: unauth 401, bad key 401, wrong slot 401, relay capabilities 200 with only HUX-11 enabled, worker capabilities 200, disabled card 404 flag_off. Subject usr_224348fa... consistent with the HMAC binding.
+- Identity hashes for the restart-persistence gate: context-key 8a1c474d..., subject c4ebe353... (compare after the next roll).
+- Rollback target: WebUI build-18 digest sha256:df91f8a3... (previous fleet image); activation rollback = revert 39a54482.
+- Retention scheduler reports disabled until hux.privacy is enabled (by design).
+
+Next: Wave-A canary flags (activity_timeline, projects, privacy, memory_control) on ordinal 3, lifecycle gates per card, then widen partition.

services/hermes/chat-statefulset.yaml

@@ -587,7 +587,7 @@ spec:
             - {name: HUX_BIND, value: 127.0.0.1}
             - {name: HUX_PORT, value: "8790"}
             - {name: HUX_DATA_ROOT, value: /var/lib/hux/store}
-            - {name: HUX_FLAGS, value: 'hux.foundation'}
+            - {name: HUX_FLAGS, value: 'hux.foundation,hux.activity_timeline,hux.projects,hux.privacy,hux.memory_control'}
             - {name: HUX_RELAY_KEY_FILE, value: /run/hermes-webui-hux/relay-key}
             - {name: HUX_WORKER_KEY_FILE, value: /run/hermes-hux-worker/worker-key}
             - {name: HUX_SUBJECT_BINDING_FILE, value: /var/lib/hux/binding/subject}