docs(security): drop the withdrawn third-party worker from the threat model (#1831)

Co-authored-by: Felix T.J. Dietrich <felix.dietrich@financial-health-initiative.org>

Author: FelixTJDietrich

docs/admin/runtime-roles.mdx

@@ -43,7 +43,6 @@ Split the worker out when:
 
 - LLM reviews and HTTP traffic compete for the same JVM heap / sandbox quota.
 - You want to scale practice-review throughput independently of webhook ingestion.
-- You're running BYO worker pods behind enterprise MITM proxies (ADR 0009 — WSS over TLS-443).
 
 Split the webhook receiver out when:
 

docs/admin/threat-model.mdx

@@ -114,7 +114,7 @@ Repository, chat, and model content is untrusted and can influence tool use. Mod
 | ID and threat | Enforced control | Enforcement | Verification | Residual risk |
 | --- | --- | --- | --- | --- |
 | SB-1 — privilege escalation, host escape, or resource exhaustion | Apply non-privileged execution, dropped capabilities, `no-new-privileges`, private cgroup/IPC namespaces, seccomp, CPU/memory/PID/file limits, disabled core dumps, and bounded `nosuid,nodev` tmpfs mounts with `noexec` where compatible. | [`ContainerSecurityPolicy`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/ContainerSecurityPolicy.java) | [`SandboxArchitectureTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/SandboxArchitectureTest.java), [`DockerSandboxAdapterTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/DockerSandboxAdapterTest.java), [`DockerSandboxLiveTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/DockerSandboxLiveTest.java) | The root filesystem is writable and standard Docker shares the host kernel and daemon. Use gVisor and dedicated, patched worker hosts for hostile multi-tenant workloads. Never mount the Docker socket or secret-bearing host paths into a sandbox. |
-| SB-2 — provider-secret theft or proxy abuse | Keep the provider key in the application catalog. Job credentials are accepted only while the job is running; mentor credentials follow the live session lifecycle. The proxy binds requests to the admitted connection, model, API, and path. | [ADR 0006](https://github.com/ls1intum/Hephaestus/blob/main/docs/decisions/0006-llm-proxy-on-coordinator-trust-model.md), [`JobTokenAuthenticationFilter`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/proxy/JobTokenAuthenticationFilter.java), [`LlmProxyController`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxyController.java) | [`JobTokenAuthenticationFilterTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/JobTokenAuthenticationFilterTest.java), [`LlmProxyControllerTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxyControllerTest.java), [`SandboxEnvBlocklistTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxEnvBlocklistTest.java) | The worker-side application process holds catalog credentials. A third-party worker is not trusted under this topology; [#1166](https://github.com/ls1intum/Hephaestus/issues/1166) owns that design gap. |
+| SB-2 — provider-secret theft or proxy abuse | Keep the provider key in the application catalog. Job credentials are accepted only while the job is running; mentor credentials follow the live session lifecycle. The proxy binds requests to the admitted connection, model, API, and path, serves it only on the worker's sandbox gateway connector, and bounds each authenticated principal's request rate and declared request size. | [ADR 0006](https://github.com/ls1intum/Hephaestus/blob/main/docs/decisions/0006-llm-proxy-on-coordinator-trust-model.md), [`JobTokenAuthenticationFilter`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/proxy/JobTokenAuthenticationFilter.java), [`LlmProxyController`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxyController.java), [`LlmProxySecurityConfig`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxySecurityConfig.java) | [`JobTokenAuthenticationFilterTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/JobTokenAuthenticationFilterTest.java), [`LlmProxyControllerTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxyControllerTest.java), [`LlmProxySecurityConfigTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxySecurityConfigTest.java), [`SandboxGatewayRateLimitFilterTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/SandboxGatewayRateLimitFilterTest.java), [`SandboxGatewayPayloadSizeFilterTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/SandboxGatewayPayloadSizeFilterTest.java), [`SandboxEnvBlocklistTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxEnvBlocklistTest.java) | The worker-side application process holds catalog credentials. A third-party worker is outside the supported topology; [ADR 0041](https://github.com/ls1intum/Hephaestus/blob/main/docs/decisions/0041-compose-1x-kubernetes-2.md) owns that decision. |
 | SB-3 — network exfiltration or cross-execution access | Create per-execution Docker resources. With internet access disabled, use an internal network with no external route and configure an unusable DNS resolver. | [`SandboxNetworkManager`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxNetworkManager.java), [`ContainerSecurityPolicy`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/ContainerSecurityPolicy.java) | [`SandboxNetworkManagerTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxNetworkManagerTest.java), [`DockerSandboxLiveTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/DockerSandboxLiveTest.java) | The job network can reach other application-server routes; those routes must independently authenticate and authorize sandbox-originated requests. `internetAccess=true` creates a normal bridge, not a hostname allow-list. |
 | SB-4 — persistence after execution | Reconcile managed containers and networks against durable job state. | [`SandboxReconciler`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxReconciler.java) | [`SandboxReconcilerTest`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/docker/SandboxReconcilerTest.java) | Host or daemon compromise is outside this control. |