# ADR-003 — No direct code execution in MVP

## Status

Accepted

## Context

Direct Codex or shell execution introduces local-repository access, command approval, sandboxing, worktrees, credentials, streaming, cancellation and audit complexity.

## Decision

The MVP generates prompts and Run Packs only. It does not clone repositories, execute package scripts or launch Codex. A future local companion or controlled bridge requires a separate threat model and ADR.

## Consequences

- smaller security boundary;
- immediate usefulness across Codex app, CLI and IDE;
- execution evidence remains user-imported initially;
- future bridge can evolve independently.