ApproveOnce is the boundary between AI coding speed and silent repo execution. You see the plan first, approve once, let the run happen locally, and keep proof afterward.