docs(hux): record the Wave A review outcome in the threat model

docs/hux/THREAT-MODEL.md

@@ -245,3 +245,25 @@ Sized for 4-8 tenants, one human each, on a 10 Gi PVC shared with the WebUI.
 - SO-52 Disabling a flag hides routes; TTL, forget and purge continue.
 - SO-53 Rate limits (30 writes/min, 300 reads/min per subject) return `429` with `Retry-After`.
 - SO-54 Bodies over 64 KiB (JSON) or 25 MiB (blob) are rejected with `413` before parsing.
+
+
+## Wave A review outcome (2026-08-24)
+
+A fresh adversarial review of HEAD `124206b7` produced thirteen findings
+(see `docs/hux/HANDOFF.md`, "Wave A review"). Corrections to the obligations
+above as a result:
+
+- SO-08 is amended: `trust: worker` is the agent hook, not only the operator
+  surface. It may call the hook allowlist in `hux/flags.py` (`WORKER_ROUTES`:
+  capabilities, manifest, releases, approvals create, run gate/budget/stop,
+  event emit, privacy policy read, memory proposal and retrieval, source/
+  passage/citation and artifact creation). Everything else is 403. Policy
+  writes and approval decisions are human-surface only (F1, F2).
+- SO-29 is satisfied by a source test (no `urllib.request`, `requests`,
+  `httpx` or raw `socket` use in the service modules), not by a module-graph
+  assertion: `http.server` legitimately loads `http.client`.
+- SO-46 (hash-chained audit), SO-48 (`v1/.lock` single-writer) and SO-53
+  (rate limits) are **not implemented** in this increment and are tracked as
+  open items, not claimed controls.
+- On-disk documents carry a `revision` field the 1.0.0 fixtures did not have;
+  served bodies strip it where the record schema forbids it (F11).