launcher-next/docs/pilots/controlled-execution-design.md

Controlled NextPilot execution

NextPilot is opt-in. Missing or invalid local configuration defaults to DryRun, with process start disabled and plugin mode Smoke. Prepare builds a deterministic plan only; Execute requires all safety conditions and a one-time, short-lived permit. RealExecutionReleaseEnabled is compile-time false in this foundation, so the process adapter always returns REAL_EXECUTION_RELEASE_NOT_ENABLED before calling the OS invoker.