Shell escape restricted by default in TeX Live 2022

TeX Live 2022 changed the default engine invocation so that pdftex, xetex, and luatex run with shell escape disabled unless explicitly enabled. Documents using \write18 to call external programs can compile without an error while producing incomplete output after an upgrade from TeX Live 2021 or earlier. The maintainers have not committed to restoring the permissive default in future releases.

The goal is to decide whether shared templates should enable shell escape globally, per document, or remove \write18 dependence entirely. Re-enabling the feature through environment variables or wrapper scripts reintroduces arbitrary code execution risks, particularly for untrusted sources, and the engine does not signal the restriction as a failure.

Specific questions:

• Should shell escape be enabled only for trusted documents, and how is that boundary enforced in a shared build environment?
• Is there a stable per-project configuration mechanism that avoids modifying wrapper scripts?
• Should templates assume restricted mode permanently, or might future TeX Live releases reconsider the default?