From 74c6549965dd6f775b57d02322bbdf9410be7891 Mon Sep 17 00:00:00 2001 From: jenkins Date: Mon, 24 Aug 2026 00:37:09 -0300 Subject: [PATCH] docs(hux): record the Wave A review outcome in the threat model --- docs/hux/THREAT-MODEL.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/hux/THREAT-MODEL.md b/docs/hux/THREAT-MODEL.md index 6ea2b2a5..365bfb07 100644 --- a/docs/hux/THREAT-MODEL.md +++ b/docs/hux/THREAT-MODEL.md @@ -245,3 +245,25 @@ Sized for 4-8 tenants, one human each, on a 10 Gi PVC shared with the WebUI. - SO-52 Disabling a flag hides routes; TTL, forget and purge continue. - SO-53 Rate limits (30 writes/min, 300 reads/min per subject) return `429` with `Retry-After`. - SO-54 Bodies over 64 KiB (JSON) or 25 MiB (blob) are rejected with `413` before parsing. + + +## Wave A review outcome (2026-08-24) + +A fresh adversarial review of HEAD `124206b7` produced thirteen findings +(see `docs/hux/HANDOFF.md`, "Wave A review"). Corrections to the obligations +above as a result: + +- SO-08 is amended: `trust: worker` is the agent hook, not only the operator + surface. It may call the hook allowlist in `hux/flags.py` (`WORKER_ROUTES`: + capabilities, manifest, releases, approvals create, run gate/budget/stop, + event emit, privacy policy read, memory proposal and retrieval, source/ + passage/citation and artifact creation). Everything else is 403. Policy + writes and approval decisions are human-surface only (F1, F2). +- SO-29 is satisfied by a source test (no `urllib.request`, `requests`, + `httpx` or raw `socket` use in the service modules), not by a module-graph + assertion: `http.server` legitimately loads `http.client`. +- SO-46 (hash-chained audit), SO-48 (`v1/.lock` single-writer) and SO-53 + (rate limits) are **not implemented** in this increment and are tracked as + open items, not claimed controls. +- On-disk documents carry a `revision` field the 1.0.0 fixtures did not have; + served bodies strip it where the record schema forbids it (F11).