feat!: unify sandbox configuration and permission application

Replace the split executable approval and sandbox resolution workflows with schema_version 2 and a YAML-driven execution.entries model. Resolve workspace, mount, executable, runtime, network, and resource settings into one config-scoped Applied Configuration snapshot protected by a user-only DACL and written with atomic replacement.

Reduce the public CLI to implicit server startup, show, and apply. Remove serve/check, executable and sandbox subcommands, and configuration override flags including --config, --lang, --transport, --path, and --runtime-root. Add migration diagnostics for every removed schema and command surface, and keep server preflight mandatory for both stdio and HTTP.

Update effective-policy compilation to validate the applied fingerprint, resolved paths, and executable hashes before startup. Preserve fail-closed behavior while allowing execution entries and runtime roots inside a development workspace to inherit that workspace capability without creating an impossible narrower ACL boundary.

Rewrite the README around the consolidated permission matrix and document configuration, application, store location, startup, transport-specific elevation, Python 3.14, PowerShell, and cmd usage. Align specifications, design, implementation plan, traceability, audit report, localization, publish scripts, and operational verification with the breaking schema.

Verification: Release build completed with zero warnings and errors; Agent.Core.Tests 104/104 and Agent.Planner.Tests 10/10 passed; administrator Windows Security/Recovery 56/56 and README operational 19/19 passed with no skips; published HTTP MCP completed a cmd/curl/venv-Python task with network deny and zero ACL, WFP, journal, backup, or process residue.

1 files changed, 30 insertions, 29 deletions

diff --git a/config/locales/en.json b/config/locales/en.json
index 3e9a5fa..c8ec474 100644
--- a/config/locales/en.json
+++ b/config/locales/en.json
@@ -1,15 +1,36 @@
 {
   "app.starting": "Starting agent.",
-  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal, ensure the Base Filtering Engine service is running, and run 'agent-mcp check'.",
+  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal and ensure the Base Filtering Engine service is running.",
   "app.ready.http": "Agent is ready for MCP requests. endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "Agent stdio transport is ready. protocol={protocol}; pid={pid}; logs={logs}",
-  "check.success": "Configuration and runtime checks passed.",
-  "check.failure": "Check failed: {message}",
-  "check.wfp_admin_required": "Windows administrator elevation is required for WFP task isolation. Start agent-mcp.exe from an elevated terminal.",
   "config.invalid": "Invalid configuration: {message}",
   "locale.invalid": "Invalid locale: {message}",
   "cli.invalid": "Invalid command line: {message}",
   "app.io_error": "Startup I/O failed: {message}",
+  "show.configuration": "Configuration: {path}",
+  "show.applied": "Applied: {value}",
+  "show.fingerprint": "Fingerprint: {value}",
+  "show.yes": "yes",
+  "show.no": "no",
+  "show.not_applied": "not-applied",
+  "show.matched": "matched",
+  "show.changed": "changed",
+  "show.platform": "Platform: not probed; startup performs the full privileged preflight",
+  "show.filesystem": "FILESYSTEM",
+  "show.filesystem_columns": "TYPE\tLOGICAL\tRESOLVED\tACCESS\tSTATUS",
+  "show.execution": "EXECUTION",
+  "show.execution_columns": "ALIAS\tTYPE\tRESOLVED\tRUNTIME\tSHA-256\tSTATUS",
+  "show.network": "NETWORK",
+  "show.resources": "RESOURCES",
+  "show.status.active": "active",
+  "show.status.added": "added",
+  "show.status.changed": "changed",
+  "show.status.removed": "removed-on-apply",
+  "apply.no_changes": "No applied configuration changes.",
+  "apply.replace_snapshot": "The complete configuration snapshot will be replaced.",
+  "apply.prompt": "Apply this configuration?",
+  "apply.success": "Configuration applied atomically.",
+  "apply.store_unreadable": "Existing Applied Configuration Store is unreadable and will be replaced only after confirmation: {message}",
   "mcp.task_queued": "Task {task} was queued in session {session}.",
   "mcp.task_not_found": "Task {task} was not found.",
   "mcp.status.queued": "The task is queued.",
@@ -27,30 +48,10 @@
   "runtime.policy_replan_exhausted": "The sandbox policy denial remained unresolved after {message} replans.",
   "runtime.policy_repeated": "The same sandbox policy denial occurred again, so replanning was stopped.",
   "runtime.replan_unchanged": "Replanning did not change the incomplete task plan.",
-  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability, then confirm the Sandbox Environment Resolution.",
-  "runtime.policy_resolution.process": "Use a configured Alias or an allowed Runtime Component or development Workspace Artifact; re-approve a changed Executable identity.",
+  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability in YAML, then run agent-mcp apply.",
+  "runtime.policy_resolution.process": "Use an Alias declared in execution.entries, an allowed Runtime Component, or a development Workspace Artifact; review and apply changed identity in YAML.",
   "runtime.policy_resolution.network": "Review the selected Network access mode and endpoint list; the Agent cannot widen it during a Task.",
-  "runtime.policy_resolution.default": "Review the User Sandbox Configuration and confirmed Effective Sandbox Policy.",
-  "management.approval_diff": "Alias: {alias}\nClassification: {classification}\nResolved Path: {path}\nSHA-256: {sha256}\nRuntime Root: {runtime_root}",
-  "management.approve_prompt": "Approve this Executable Alias?",
-  "management.revoke_diff": "Revoke {alias}: {path}",
-  "management.revoke_prompt": "Revoke this Executable Alias?",
-  "management.sandbox_confirm_prompt": "Confirm this Sandbox Environment Resolution?",
-  "management.resolution_header": "Configuration: {config}\nFingerprint: {fingerprint}",
-  "management.confirmed": "Confirmed: {value}",
-  "management.yes": "yes",
-  "management.no": "no",
-  "management.ambiguous_candidates": "Multiple candidates were found. No candidate was selected; re-run with --path <path>.",
-  "sandbox.error.resolution_unconfirmed": "The Sandbox Environment Resolution is not confirmed.",
-  "sandbox.error.resolution_unconfirmed.resolution": "Review sandbox resolve, then run sandbox confirm.",
-  "sandbox.error.resolution_changed": "The Sandbox Environment Resolution changed after confirmation.",
-  "sandbox.error.resolution_changed.resolution": "Review the changed Logical and Resolved Paths, then confirm again.",
-  "sandbox.error.approval_missing": "The Executable Alias is not approved: {target}",
-  "sandbox.error.approval_missing.resolution": "Resolve the Alias, review one candidate, and explicitly approve it.",
-  "sandbox.error.executable_resolution_changed": "The Executable Resolved Path changed: {target}",
-  "sandbox.error.executable_resolution_changed.resolution": "Verify the new identity and explicitly re-approve it.",
-  "sandbox.error.executable_hash_changed": "The Executable SHA-256 changed: {target}",
-  "sandbox.error.executable_hash_changed.resolution": "Verify the updated file and explicitly re-approve it.",
-  "sandbox.error.shell_unsupported": "The selected file is not a supported Shell: {target}",
-  "sandbox.error.shell_unsupported.resolution": "Select cmd.exe, powershell.exe, or pwsh.exe."
+  "runtime.policy_resolution.default": "Review the YAML permission matrix with agent-mcp show, then run agent-mcp apply.",
+  "sandbox.error.configuration_not_applied": "The configuration has not been applied or its resolved identity changed: {target}",
+  "sandbox.error.configuration_not_applied.resolution": "Review the complete permission matrix with agent-mcp show, then run agent-mcp apply."
 }