feat!: isolate privileged sandbox network operations per task

Run agent-mcp with an explicit asInvoker manifest and move WFP and loopback mutations into a fixed requireAdministrator helper under the release admin directory.

Add the Agent.Admin client and host projects with task-scoped runas launch, a logon-SID and Administrators-only local named pipe, remote-client rejection, mutual PID validation, strict versioned JSON framing, fixed network-only operations, and bounded messages.

Delay ACL and network Task Resource application until the first process_run. Verify executable identity, managed entry points, DNS snapshots, and normal-token WRITE_DAC access before elevation; reuse the helper only within the Task and keep elevation failures terminal without policy replanning.

Keep LPAC creation, executable approval, Job confinement, and ACL leases in the normal process. Make startup platform checks read-only, create the fixed Application Profile during apply, preserve dynamic WFP lifetime in the helper, and route persistent loopback recovery through the same elevated boundary.

Update recovery journaling, localized elevation and IPC errors, audit events, release publishing, manifests, README guidance, Specifications, Design, implementation records, and requirement traceability for the on-demand elevation model.

Add administrative-boundary, file-only no-elevation, elevation-terminal, lazy-resource, crash-recovery, manifest, IPC schema, and operational verification coverage. Verified Release build with zero warnings, Core 105/105, Planner 10/10, administrative boundary 4/4, elevated Windows suite 79/79, and published stdio/HTTP MCP E2E.

2 files changed, 16 insertions, 4 deletions

diff --git a/config/locales/en.json b/config/locales/en.json
index c8ec474..7877f20 100644
--- a/config/locales/en.json
+++ b/config/locales/en.json
@@ -1,12 +1,17 @@
 {
   "app.starting": "Starting agent.",
-  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal and ensure the Base Filtering Engine service is running.",
+  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; platform={platform}; application_profile={profile}; BFE={bfe}; helper={helper}; helper_version={version}. Restore the Release Bundle or start the Base Filtering Engine service.",
   "app.ready.http": "Agent is ready for MCP requests. endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "Agent stdio transport is ready. protocol={protocol}; pid={pid}; logs={logs}",
   "config.invalid": "Invalid configuration: {message}",
   "locale.invalid": "Invalid locale: {message}",
   "cli.invalid": "Invalid command line: {message}",
   "app.io_error": "Startup I/O failed: {message}",
+  "runtime.platform.elevation_cancelled": "Windows elevation was cancelled. The current Task failed; the MCP Server is still running. Detail: {message}",
+  "runtime.platform.elevation_failed": "Windows elevation failed. The current Task failed; the MCP Server is still running. Detail: {message}",
+  "runtime.platform.helper_incompatible": "The bundled elevated helper is missing or incompatible. Restore the Release Bundle. Detail: {message}",
+  "runtime.platform.ipc_rejected": "The elevated helper connection was rejected by the Sandbox Broker. Detail: {message}",
+  "runtime.platform.network_apply_failed": "The Windows network Task Resource could not be applied safely. Detail: {message}",
   "show.configuration": "Configuration: {path}",
   "show.applied": "Applied: {value}",
   "show.fingerprint": "Fingerprint: {value}",
@@ -15,7 +20,7 @@
   "show.not_applied": "not-applied",
   "show.matched": "matched",
   "show.changed": "changed",
-  "show.platform": "Platform: not probed; startup performs the full privileged preflight",
+  "show.platform": "Platform: not probed; startup performs read-only platform and helper validation",
   "show.filesystem": "FILESYSTEM",
   "show.filesystem_columns": "TYPE\tLOGICAL\tRESOLVED\tACCESS\tSTATUS",
   "show.execution": "EXECUTION",
@@ -49,6 +54,7 @@
   "runtime.policy_repeated": "The same sandbox policy denial occurred again, so replanning was stopped.",
   "runtime.replan_unchanged": "Replanning did not change the incomplete task plan.",
   "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability in YAML, then run agent-mcp apply.",
+  "runtime.policy_resolution.acl": "Use a root owned by the current user or grant that user WRITE_DAC. Elevation does not bypass this requirement.",
   "runtime.policy_resolution.process": "Use an Alias declared in execution.entries, an allowed Runtime Component, or a development Workspace Artifact; review and apply changed identity in YAML.",
   "runtime.policy_resolution.network": "Review the selected Network access mode and endpoint list; the Agent cannot widen it during a Task.",
   "runtime.policy_resolution.default": "Review the YAML permission matrix with agent-mcp show, then run agent-mcp apply.",
diff --git a/config/locales/ja.json b/config/locales/ja.json
index 708bf47..96eb3a6 100644
--- a/config/locales/ja.json
+++ b/config/locales/ja.json
@@ -1,12 +1,17 @@
 {
   "app.starting": "エージェントを起動しています。",
-  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}。管理者権限のターミナルで起動し、Base Filtering Engineサービスを確認してください。",
+  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; platform={platform}; application_profile={profile}; BFE={bfe}; helper={helper}; helper_version={version}。Release Bundleを復元するかBase Filtering Engineサービスを確認してください。",
   "app.ready.http": "MCPリクエストを受け付けられます。endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "stdio transportでMCPリクエストを受け付けられます。protocol={protocol}; pid={pid}; logs={logs}",
   "config.invalid": "設定が不正です: {message}",
   "locale.invalid": "ロケールが不正です: {message}",
   "cli.invalid": "コマンドラインが不正です: {message}",
   "app.io_error": "起動時のI/O処理に失敗しました: {message}",
+  "runtime.platform.elevation_cancelled": "Windowsの権限昇格が拒否されました。当該Taskは失敗しましたがMCP Serverは継続しています。詳細: {message}",
+  "runtime.platform.elevation_failed": "Windowsの権限昇格に失敗しました。当該Taskは失敗しましたがMCP Serverは継続しています。詳細: {message}",
+  "runtime.platform.helper_incompatible": "同梱された昇格用Executableが存在しないか互換性がありません。Release Bundleを復元してください。詳細: {message}",
+  "runtime.platform.ipc_rejected": "昇格用Executableとの接続をSandbox Brokerが拒否しました。詳細: {message}",
+  "runtime.platform.network_apply_failed": "WindowsのNetwork Task Resourceを安全に適用できませんでした。詳細: {message}",
   "show.configuration": "設定: {path}",
   "show.applied": "適用済み: {value}",
   "show.fingerprint": "fingerprint: {value}",
@@ -15,7 +20,7 @@
   "show.not_applied": "未適用",
   "show.matched": "一致",
   "show.changed": "変更あり",
-  "show.platform": "Windows preflight: 未実行（Server起動時に管理者権限で完全検査）",
+  "show.platform": "Windows preflight: 未実行（Server起動時にread-onlyのPlatform/helper検査）",
   "show.filesystem": "FILESYSTEM権限",
   "show.filesystem_columns": "種別\t論理PATH\t解決済みPATH\tアクセス\t状態",
   "show.execution": "EXECUTION権限",
@@ -49,6 +54,7 @@
   "runtime.policy_repeated": "同一のSandbox Policy拒否が再発したため、再計画を停止しました。",
   "runtime.replan_unchanged": "再計画後も未完了のタスク計画が変更されませんでした。",
   "runtime.policy_resolution.filesystem": "YAMLのWorkspaceまたはMountと必要なFilesystem Capabilityを確認し、agent-mcp applyを実行してください。",
+  "runtime.policy_resolution.acl": "現在のユーザーが所有するrootを使用するか、そのユーザーへWRITE_DACを付与してください。昇格でこの要件を迂回することはありません。",
   "runtime.policy_resolution.process": "execution.entriesのAlias、許可されたRuntime Component、またはdevelopment Workspace Artifactを使用し、変更されたidentityはYAMLで確認してapplyしてください。",
   "runtime.policy_resolution.network": "Network access modeとendpoint一覧を確認してください。AgentはTask中に許可範囲を拡張できません。",
   "runtime.policy_resolution.default": "agent-mcp showでYAMLの権限マトリックスを確認し、agent-mcp applyを実行してください。",