[chaodu-agent]

Summary

• New ADR docs/adr/trust-model.md: one user, one OS account, pane programs trusted, no over-defense. It states what Shepherd adds over herdr and Orca, the decision test, the non-goals (same-account attacker, ptrace, /proc, socket squatting, fd races, status forgery, symlink swaps, kernel attestation, and the phases once planned in Multi-client authorization and audit #4), and a freeze on new screen-scraped dialects. It supersedes the mitigation items in native-core.md, which is left unchanged.
• docs/operations.md: the forged-status paragraph is cut to two lines, the token check-then-read caveat is removed, and Later phases becomes a Non-goals pointer to the ADR. The ADR is linked from operations.md and the README.
• Restart survival is worded as planned (ADR: restart survival and where the guarded write lives #66).

Diff

3 files changed, 56 insertions(+), 28 deletions(-)

Verified

• git diff --stat shows only README.md, docs/operations.md and docs/adr/trust-model.md. No Rust sources touched; no build run (docs only).
• No doc claims a defense against a same-account process. No behaviour change.