ADR-0020: Managed process launch goes through one boundary

• Status: Accepted
• Date: 2026-09-10

Context

Ad-hoc process spawning spreads quoting, signals, env leakage, and logging mistakes.

Decision

Git, verification, setup scripts, and process-shaped adapters use one ProcessRunner with executable+argv, cwd, environment, cancellation, and output controls.

Consequences

Avoid shell strings where direct argv execution works; renderer never gets this primitive.

Change rule

If implementation evidence proves this wrong, update the canonical architecture/product document first and then supersede/amend this ADR. The ADR is not allowed to keep current docs stale.