feat!: unify sandbox configuration and permission application

Replace the split executable approval and sandbox resolution workflows with schema_version 2 and a YAML-driven execution.entries model. Resolve workspace, mount, executable, runtime, network, and resource settings into one config-scoped Applied Configuration snapshot protected by a user-only DACL and written with atomic replacement.

Reduce the public CLI to implicit server startup, show, and apply. Remove serve/check, executable and sandbox subcommands, and configuration override flags including --config, --lang, --transport, --path, and --runtime-root. Add migration diagnostics for every removed schema and command surface, and keep server preflight mandatory for both stdio and HTTP.

Update effective-policy compilation to validate the applied fingerprint, resolved paths, and executable hashes before startup. Preserve fail-closed behavior while allowing execution entries and runtime roots inside a development workspace to inherit that workspace capability without creating an impossible narrower ACL boundary.

Rewrite the README around the consolidated permission matrix and document configuration, application, store location, startup, transport-specific elevation, Python 3.14, PowerShell, and cmd usage. Align specifications, design, implementation plan, traceability, audit report, localization, publish scripts, and operational verification with the breaking schema.

Verification: Release build completed with zero warnings and errors; Agent.Core.Tests 104/104 and Agent.Planner.Tests 10/10 passed; administrator Windows Security/Recovery 56/56 and README operational 19/19 passed with no skips; published HTTP MCP completed a cmd/curl/venv-Python task with network deny and zero ACL, WFP, journal, backup, or process residue.

2 files changed, 60 insertions, 58 deletions

diff --git a/config/locales/en.json b/config/locales/en.json
index 3e9a5fa..c8ec474 100644
--- a/config/locales/en.json
+++ b/config/locales/en.json
@@ -1,15 +1,36 @@
 {
   "app.starting": "Starting agent.",
-  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal, ensure the Base Filtering Engine service is running, and run 'agent-mcp check'.",
+  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal and ensure the Base Filtering Engine service is running.",
   "app.ready.http": "Agent is ready for MCP requests. endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "Agent stdio transport is ready. protocol={protocol}; pid={pid}; logs={logs}",
-  "check.success": "Configuration and runtime checks passed.",
-  "check.failure": "Check failed: {message}",
-  "check.wfp_admin_required": "Windows administrator elevation is required for WFP task isolation. Start agent-mcp.exe from an elevated terminal.",
   "config.invalid": "Invalid configuration: {message}",
   "locale.invalid": "Invalid locale: {message}",
   "cli.invalid": "Invalid command line: {message}",
   "app.io_error": "Startup I/O failed: {message}",
+  "show.configuration": "Configuration: {path}",
+  "show.applied": "Applied: {value}",
+  "show.fingerprint": "Fingerprint: {value}",
+  "show.yes": "yes",
+  "show.no": "no",
+  "show.not_applied": "not-applied",
+  "show.matched": "matched",
+  "show.changed": "changed",
+  "show.platform": "Platform: not probed; startup performs the full privileged preflight",
+  "show.filesystem": "FILESYSTEM",
+  "show.filesystem_columns": "TYPE\tLOGICAL\tRESOLVED\tACCESS\tSTATUS",
+  "show.execution": "EXECUTION",
+  "show.execution_columns": "ALIAS\tTYPE\tRESOLVED\tRUNTIME\tSHA-256\tSTATUS",
+  "show.network": "NETWORK",
+  "show.resources": "RESOURCES",
+  "show.status.active": "active",
+  "show.status.added": "added",
+  "show.status.changed": "changed",
+  "show.status.removed": "removed-on-apply",
+  "apply.no_changes": "No applied configuration changes.",
+  "apply.replace_snapshot": "The complete configuration snapshot will be replaced.",
+  "apply.prompt": "Apply this configuration?",
+  "apply.success": "Configuration applied atomically.",
+  "apply.store_unreadable": "Existing Applied Configuration Store is unreadable and will be replaced only after confirmation: {message}",
   "mcp.task_queued": "Task {task} was queued in session {session}.",
   "mcp.task_not_found": "Task {task} was not found.",
   "mcp.status.queued": "The task is queued.",
@@ -27,30 +48,10 @@
   "runtime.policy_replan_exhausted": "The sandbox policy denial remained unresolved after {message} replans.",
   "runtime.policy_repeated": "The same sandbox policy denial occurred again, so replanning was stopped.",
   "runtime.replan_unchanged": "Replanning did not change the incomplete task plan.",
-  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability, then confirm the Sandbox Environment Resolution.",
-  "runtime.policy_resolution.process": "Use a configured Alias or an allowed Runtime Component or development Workspace Artifact; re-approve a changed Executable identity.",
+  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability in YAML, then run agent-mcp apply.",
+  "runtime.policy_resolution.process": "Use an Alias declared in execution.entries, an allowed Runtime Component, or a development Workspace Artifact; review and apply changed identity in YAML.",
   "runtime.policy_resolution.network": "Review the selected Network access mode and endpoint list; the Agent cannot widen it during a Task.",
-  "runtime.policy_resolution.default": "Review the User Sandbox Configuration and confirmed Effective Sandbox Policy.",
-  "management.approval_diff": "Alias: {alias}\nClassification: {classification}\nResolved Path: {path}\nSHA-256: {sha256}\nRuntime Root: {runtime_root}",
-  "management.approve_prompt": "Approve this Executable Alias?",
-  "management.revoke_diff": "Revoke {alias}: {path}",
-  "management.revoke_prompt": "Revoke this Executable Alias?",
-  "management.sandbox_confirm_prompt": "Confirm this Sandbox Environment Resolution?",
-  "management.resolution_header": "Configuration: {config}\nFingerprint: {fingerprint}",
-  "management.confirmed": "Confirmed: {value}",
-  "management.yes": "yes",
-  "management.no": "no",
-  "management.ambiguous_candidates": "Multiple candidates were found. No candidate was selected; re-run with --path <path>.",
-  "sandbox.error.resolution_unconfirmed": "The Sandbox Environment Resolution is not confirmed.",
-  "sandbox.error.resolution_unconfirmed.resolution": "Review sandbox resolve, then run sandbox confirm.",
-  "sandbox.error.resolution_changed": "The Sandbox Environment Resolution changed after confirmation.",
-  "sandbox.error.resolution_changed.resolution": "Review the changed Logical and Resolved Paths, then confirm again.",
-  "sandbox.error.approval_missing": "The Executable Alias is not approved: {target}",
-  "sandbox.error.approval_missing.resolution": "Resolve the Alias, review one candidate, and explicitly approve it.",
-  "sandbox.error.executable_resolution_changed": "The Executable Resolved Path changed: {target}",
-  "sandbox.error.executable_resolution_changed.resolution": "Verify the new identity and explicitly re-approve it.",
-  "sandbox.error.executable_hash_changed": "The Executable SHA-256 changed: {target}",
-  "sandbox.error.executable_hash_changed.resolution": "Verify the updated file and explicitly re-approve it.",
-  "sandbox.error.shell_unsupported": "The selected file is not a supported Shell: {target}",
-  "sandbox.error.shell_unsupported.resolution": "Select cmd.exe, powershell.exe, or pwsh.exe."
+  "runtime.policy_resolution.default": "Review the YAML permission matrix with agent-mcp show, then run agent-mcp apply.",
+  "sandbox.error.configuration_not_applied": "The configuration has not been applied or its resolved identity changed: {target}",
+  "sandbox.error.configuration_not_applied.resolution": "Review the complete permission matrix with agent-mcp show, then run agent-mcp apply."
 }
diff --git a/config/locales/ja.json b/config/locales/ja.json
index 7d51334..708bf47 100644
--- a/config/locales/ja.json
+++ b/config/locales/ja.json
@@ -1,15 +1,36 @@
 {
   "app.starting": "エージェントを起動しています。",
-  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}。管理者権限のターミナルで起動し、Base Filtering Engineサービスを確認してから 'agent-mcp check' を実行してください。",
+  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}。管理者権限のターミナルで起動し、Base Filtering Engineサービスを確認してください。",
   "app.ready.http": "MCPリクエストを受け付けられます。endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "stdio transportでMCPリクエストを受け付けられます。protocol={protocol}; pid={pid}; logs={logs}",
-  "check.success": "設定と実行環境の確認に成功しました。",
-  "check.failure": "確認に失敗しました: {message}",
-  "check.wfp_admin_required": "WFPによるTask分離にはWindows管理者権限が必要です。管理者として起動したターミナルからagent-mcp.exeを起動してください。",
   "config.invalid": "設定が不正です: {message}",
   "locale.invalid": "ロケールが不正です: {message}",
   "cli.invalid": "コマンドラインが不正です: {message}",
   "app.io_error": "起動時のI/O処理に失敗しました: {message}",
+  "show.configuration": "設定: {path}",
+  "show.applied": "適用済み: {value}",
+  "show.fingerprint": "fingerprint: {value}",
+  "show.yes": "はい",
+  "show.no": "いいえ",
+  "show.not_applied": "未適用",
+  "show.matched": "一致",
+  "show.changed": "変更あり",
+  "show.platform": "Windows preflight: 未実行（Server起動時に管理者権限で完全検査）",
+  "show.filesystem": "FILESYSTEM権限",
+  "show.filesystem_columns": "種別\t論理PATH\t解決済みPATH\tアクセス\t状態",
+  "show.execution": "EXECUTION権限",
+  "show.execution_columns": "ALIAS\t種別\t解決済みPATH\tRUNTIME\tSHA-256\t状態",
+  "show.network": "NETWORK権限",
+  "show.resources": "RESOURCE制限",
+  "show.status.active": "適用中",
+  "show.status.added": "追加予定",
+  "show.status.changed": "変更予定",
+  "show.status.removed": "apply時に削除",
+  "apply.no_changes": "適用済み設定に変更はありません。",
+  "apply.replace_snapshot": "設定スナップショット全体を置換します。",
+  "apply.prompt": "この設定を適用しますか？",
+  "apply.success": "設定全体をatomicに適用しました。",
+  "apply.store_unreadable": "既存のApplied Configuration Storeを読み取れません。確認後に限り置換します: {message}",
   "mcp.task_queued": "タスク {task} をセッション {session} に登録しました。",
   "mcp.task_not_found": "タスク {task} が見つかりません。",
   "mcp.status.queued": "タスクは待機中です。",
@@ -27,30 +48,10 @@
   "runtime.policy_replan_exhausted": "Sandbox Policyによる拒否を{message}回の再計画で解消できませんでした。",
   "runtime.policy_repeated": "同一のSandbox Policy拒否が再発したため、再計画を停止しました。",
   "runtime.replan_unchanged": "再計画後も未完了のタスク計画が変更されませんでした。",
-  "runtime.policy_resolution.filesystem": "WorkspaceまたはMountと必要なFilesystem Capabilityを確認し、Sandbox Environment Resolutionを再確認してください。",
-  "runtime.policy_resolution.process": "設定済みAlias、許可されたRuntime Component、またはdevelopment Workspace Artifactを使用し、identityが変わったExecutableは再承認してください。",
+  "runtime.policy_resolution.filesystem": "YAMLのWorkspaceまたはMountと必要なFilesystem Capabilityを確認し、agent-mcp applyを実行してください。",
+  "runtime.policy_resolution.process": "execution.entriesのAlias、許可されたRuntime Component、またはdevelopment Workspace Artifactを使用し、変更されたidentityはYAMLで確認してapplyしてください。",
   "runtime.policy_resolution.network": "Network access modeとendpoint一覧を確認してください。AgentはTask中に許可範囲を拡張できません。",
-  "runtime.policy_resolution.default": "User Sandbox Configurationと確認済みEffective Sandbox Policyを確認してください。",
-  "management.approval_diff": "Alias: {alias}\n分類: {classification}\n解決済みpath: {path}\nSHA-256: {sha256}\nRuntime Root: {runtime_root}",
-  "management.approve_prompt": "このExecutable Aliasを承認しますか？",
-  "management.revoke_diff": "承認取消 {alias}: {path}",
-  "management.revoke_prompt": "このExecutable Aliasの承認を取り消しますか？",
-  "management.sandbox_confirm_prompt": "このSandbox Environment Resolutionを確認済みにしますか？",
-  "management.resolution_header": "設定: {config}\nfingerprint: {fingerprint}",
-  "management.confirmed": "確認済み: {value}",
-  "management.yes": "はい",
-  "management.no": "いいえ",
-  "management.ambiguous_candidates": "複数の候補が見つかりました。自動選択していません。--path <path>を指定して再実行してください。",
-  "sandbox.error.resolution_unconfirmed": "Sandbox Environment Resolutionが未確認です。",
-  "sandbox.error.resolution_unconfirmed.resolution": "sandbox resolveの差分を確認してからsandbox confirmを実行してください。",
-  "sandbox.error.resolution_changed": "確認後にSandbox Environment Resolutionが変更されました。",
-  "sandbox.error.resolution_changed.resolution": "Logical PathとResolved Pathの変更を確認してから、再度confirmしてください。",
-  "sandbox.error.approval_missing": "Executable Aliasが未承認です: {target}",
-  "sandbox.error.approval_missing.resolution": "Alias候補をresolveし、1つの候補を確認して明示的にapproveしてください。",
-  "sandbox.error.executable_resolution_changed": "ExecutableのResolved Pathが変更されました: {target}",
-  "sandbox.error.executable_resolution_changed.resolution": "新しいidentityを確認し、明示的に再承認してください。",
-  "sandbox.error.executable_hash_changed": "ExecutableのSHA-256が変更されました: {target}",
-  "sandbox.error.executable_hash_changed.resolution": "更新されたfileを確認し、明示的に再承認してください。",
-  "sandbox.error.shell_unsupported": "選択されたfileは対応Shellではありません: {target}",
-  "sandbox.error.shell_unsupported.resolution": "cmd.exe、powershell.exe、pwsh.exeのいずれかを選択してください。"
+  "runtime.policy_resolution.default": "agent-mcp showでYAMLの権限マトリックスを確認し、agent-mcp applyを実行してください。",
+  "sandbox.error.configuration_not_applied": "設定が未適用、または解決された実体が変更されています: {target}",
+  "sandbox.error.configuration_not_applied.resolution": "agent-mcp showで権限マトリックス全体を確認し、agent-mcp applyを実行してください。"
 }