docs: define autonomy-first human-control architecture

[yava-code]

What changed

• ADR-007: Executable Operator Model and shadow control
• ADR-008: Evidence-Carrying Generation through a bidirectional Intent Ledger
• ADR-009: Decision Futures and a project-scoped Takeover Envelope
• requirement-by-requirement completion audit, post-R7 contracts, falsifiers, and prior-art boundaries

Product architecture

PureFlow now defines three independent outputs beside autonomous code:

1. Intent Ledger — every changed line resolves to a bounded semantic unit and an honest attribution state.
2. Executable Operator Model — only behavior the developer demonstrated through prediction, evidence selection, direction, recovery, or delayed transfer.
3. Decision Futures — agents speculatively implement real alternatives while an on-time pre-reveal human commitment may determine the live integrated branch.

Agents may still write every implementation line. The Takeover Envelope exposes where agent capability exceeds current human takeover evidence without blocking normal autonomy or inventing a developer score.

Why

Diff review, generated explanations, quizzes, and plan approvals do not put the developer back into the causal loop. This architecture preserves artifact accountability, behavioral control, and real engineering decision authority while keeping production agents off the human-practice critical path by default.

Validation

• spec-driven strict validator for the Operator Model: 98/100, no errors
• ADR-008 and ADR-009 contract assertions: pass
• git diff --check: pass
• all five protected checks for 10339fe: extension, extension-windows, contract, web, jules-rnd-policy

Honest gate status

ADR-007, ADR-008, and ADR-009 are Proposed. This PR does not start R5/R6, implement the v0.3 runtime, or claim skill retention. Two independent R7 expert ratings and adjudication remain required before implementation.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d2bf970e-5467-41eb-b6d1-0f17ccec49d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.