feat!: unify sandbox configuration and permission application

Replace the split executable approval and sandbox resolution workflows with schema_version 2 and a YAML-driven execution.entries model. Resolve workspace, mount, executable, runtime, network, and resource settings into one config-scoped Applied Configuration snapshot protected by a user-only DACL and written with atomic replacement.

Reduce the public CLI to implicit server startup, show, and apply. Remove serve/check, executable and sandbox subcommands, and configuration override flags including --config, --lang, --transport, --path, and --runtime-root. Add migration diagnostics for every removed schema and command surface, and keep server preflight mandatory for both stdio and HTTP.

Update effective-policy compilation to validate the applied fingerprint, resolved paths, and executable hashes before startup. Preserve fail-closed behavior while allowing execution entries and runtime roots inside a development workspace to inherit that workspace capability without creating an impossible narrower ACL boundary.

Rewrite the README around the consolidated permission matrix and document configuration, application, store location, startup, transport-specific elevation, Python 3.14, PowerShell, and cmd usage. Align specifications, design, implementation plan, traceability, audit report, localization, publish scripts, and operational verification with the breaking schema.

Verification: Release build completed with zero warnings and errors; Agent.Core.Tests 104/104 and Agent.Planner.Tests 10/10 passed; administrator Windows Security/Recovery 56/56 and README operational 19/19 passed with no skips; published HTTP MCP completed a cmd/curl/venv-Python task with network deny and zero ACL, WFP, journal, backup, or process residue.

2 files changed, 23 insertions, 16 deletions

diff --git a/plans/ImplementationPlan.md b/plans/ImplementationPlan.md
index c2c348e..4ec765f 100644
--- a/plans/ImplementationPlan.md
+++ b/plans/ImplementationPlan.md
@@ -1,6 +1,6 @@
 # AI Agent Sandbox MCP Server — 実装・監査作業計画
 
-> Current status (2026-08-11): 現行実装の再監査・是正・再検証結果は`RequirementTraceability.md`と`doc/AuditReport.md`を正本とする。`plans/progress/`の完了報告は各記録作成時のcommitに対する履歴であり、現行PASS根拠には使用しない。Internal Toolの構成とschemaは`Design.md`のTool catalogを参照し、件数をRequirementまたはGateにしない。
+> Current status (2026-08-13): Sandbox Configuration schema version 2を破壊的に導入した。YAMLを唯一のdesired stateとし、CLIはServer起動、`apply`、`show`へ限定する。個別Executable Approval StoreとSandbox Resolution Storeは廃止し、config別Applied Configuration Storeへ統合する。旧完了報告と旧schemaの証跡は履歴であり、schema version 2のPASS根拠には使用しない。
 
 **文書名:** `ImplementationPlan.md`  
 **版:** 0.1 Draft  
@@ -177,7 +177,8 @@ Security境界を後回しにした状態で、実際の任意Process実行を�
 - `en.json` / `ja.json`
 - locale loader / validator
 - named placeholder
-- CLI `--config` / `--lang`
+- config path位置引数と、YAMLだけからlanguage/transportを取得するCLI
+- `show`によるread-only権限matrixと`apply [--yes]`による一括atomic適用
 - fallback `selected locale → en → key`
 - Fixed System Promptの埋め込み基盤
 - User System Prompt path
@@ -190,7 +191,8 @@ Security境界を後回しにした状態で、実際の任意Process実行を�
 ## 6.4 必須テスト
 - [ ] `en` 起動
 - [ ] `ja` 起動
-- [ ] `--lang` がconfigより優先
+- [ ] CLIからlanguage/transportを上書きできない
+- [ ] 旧commandと旧optionが具体的な移行診断で拒否される
 - [ ] 追加locale fileをコード変更なしで読める
 - [ ] missing keyはfallbackする
 - [ ] unknown keyでfatal
@@ -199,7 +201,7 @@ Security境界を後回しにした状態で、実際の任意Process実行を�
 - [ ] invalid YAML/schemaでfatal
 ## 6.5 監査証跡
 - locale key一覧比較結果
-- `agent-mcp check --lang en/ja` の結果
+- `agent-mcp show`、`agent-mcp apply --yes`、command省略起動の結果
 - stderr/file log sample
 - Fixed Promptの格納場所
 ### Gate G1
@@ -369,22 +371,22 @@ LLM→Internal Tool Call→Policy Engineの境界が固定され、Effective San
 ## 11.2 実装対象
 - Application固定LPAC Profileと`ALL APPLICATION PACKAGES` opt-out
 - User Sandbox ConfigurationからEffective Sandbox Policyへの変換
-- Logical Pathのreparse chain解決、config別Resolution Store、変更時fail-closed
+- Logical Pathのreparse chain解決、config別Applied Configuration Store、変更時fail-closed
 - Workspace/Mount/Runtime/Artifact/OS RuntimeのFilesystem capability
 - NTFS ACL（readとexecuteを分離した継承ACE、root単位snapshot、protected descendantのfail-safe維持）
-- Executable Alias、Approved Entry ExecutableのResolved Path + SHA-256、user-local Approval Store
+- Execution EntryのAlias、Approved Entry ExecutableのResolved Path + SHA-256を含むuser-local一括snapshot
 - Runtime Component／development Workspace Artifact／External Unknown Entryの分類
 - Entry ProcessとDescendant ProcessへLPAC、ACL、WFP、Job Objectを継承
 - breakaway禁止、process count / memory limit / timeout / KILL_ON_JOB_CLOSE
 - Named Pipeが必要ならtask固有DACL
-## 11.3 Executable Approval
+## 11.3 Execution Entryの適用identity
 BrokerがApproved Entry ExecutableまたはApproved Shell Executableを直接起動する条件は以下をすべて満たすこと。
 ```text
-Alias         == approval.alias
-Resolved Path == approval.resolved_path
-SHA-256       == approval.sha256
+Alias         == applied entry.alias
+Resolved Path == applied entry.resolved_path
+SHA-256       == applied entry.sha256
 ```
-hash、Logical Path、Resolved Pathの変更は再承認を必要とする。Descendant Processには個別Approvalを要求せず、Sandbox Process Treeのconfinementで制御する。
+hash、Logical Path、Resolved Pathの変更は権限matrix全体の再applyを必要とする。Descendant Processには個別Entry登録を要求せず、Sandbox Process Treeのconfinementで制御する。
 ## 11.4 必須Security Test
 - [ ] readonly Workspaceでread成功、write/delete/Artifact Entry拒否
 - [ ] development Workspaceでread/write/delete/Artifact Entry成功
@@ -562,7 +564,7 @@ AT-01〜AT-20をすべて再実行する。
 ## 16.2.1 Release Bundle
 - `dotnet publish -c Release -r win-x64 --self-contained true` を実行する。
 - `agent-mcp.exe`、runtime/dependency、`agent.yaml`、en/ja locale、User Prompt、`skills/`、READMEを含むversion付きZIP、manifest、SHA-256を生成する。
-- ソースツリー外の空directoryへ展開し、Bundle内の資源だけで`agent-mcp sandbox resolve`まで実行する。`check`、stdio、HTTPは、利用者がResolutionを確認し必要なExecutableを承認したOperational配置で実行する。
+- ソースツリー外の空directoryへ展開し、Bundle内の資源だけで`agent-mcp show`まで実行する。stdio、HTTPは、利用者がYAMLの権限matrixを確認して`agent-mcp apply`したOperational配置で実行する。
 
 ## 16.2.2 Operational E2E Test
 - E2E-01: Release Bundle、`deepseek-v4-flash:cloud`、Python 3.14の実測Approval、stdio MCP Clientで一時fixtureへ複雑なPython programとtestを作成し、Python subprocessを含むtest、日本語応答、Audit追跡、cleanupまで完走する。
diff --git a/plans/RequirementTraceability.md b/plans/RequirementTraceability.md
index ae32290..1aab2a2 100644
--- a/plans/RequirementTraceability.md
+++ b/plans/RequirementTraceability.md
@@ -1,6 +1,6 @@
 # Requirement Traceability
 
-Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8`（2026-08-11 JST）以前の結果は`plans/progress/`と本書末尾に履歴として保持するが、現行PASS判定には使用しない。
+Sandbox Configuration schema version 2後の現行実装を対象とする。2026-08-13以前の結果は`plans/progress/`と本書末尾に履歴として保持するが、schema version 2の現行PASS判定には使用しない。
 
 状態は`PASS / PARTIAL / FAIL / NOT REVERIFIED`を使う。2026-08-12の現行working-tree管理者証跡は`artifacts/evidence/sandbox-usability-final-working-tree-2/`、2026-08-13のLPAC Descendant再監査は`artifacts/evidence/lpac-descendant-reaudit-working-tree/`に保存する。
 
@@ -15,8 +15,8 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8
 | AGT-01〜06 | `AgentRuntime`, `InternalToolDispatcher`, MCP公開境界 | completion/replan/iteration/catalog tests、stdio/HTTP E2E | PASS |
 | PLN-01〜06 | `TaskGraph`, `PlannerService`, structural `task_update` | Planner 10件、structured-plan retry、Task固有Tool証跡test | PASS |
 | SES-01〜06 | `SessionStore`、会話/graph/result保持、structured要約 | summary成功/失敗、session/runtime tests | PASS |
-| FS-01〜10 | `ResolvedPath`, `PathPolicy`, `TaskAclManager`, `SandboxEnvironmentResolver` | Resolution/fingerprint/nested root、read/execute分離、readonly/development LPAC実効果、管理者suite | PASS |
-| PRC-01〜09 | `EntryExecutablePolicy`, `RestrictedProcessLauncher`, Approval Store、Job Process Tree | Alias-only Entry、hash、Runtime/Artifact分類、PowerShell/Python/.NET build/test、breakaway、process/memory/timeout、Entry×Descendant matrix | PASS — cmdを含む全9組をPATH解決名／Workspace相対pathで再検証し、publish済みHTTP MCPでもcmd→cmd/curl/venv Pythonを完走 |
+| FS-01〜10 | `ResolvedPath`, `PathPolicy`, `TaskAclManager`, `AppliedSandboxConfiguration` | schema v2 apply/fingerprint/nested root、read/execute分離、readonly/development LPAC実効果 | PASS — Core 104件、管理者Security/Recovery 56件、README operational 19件 |
+| PRC-01〜09 | `EntryExecutablePolicy`, `RestrictedProcessLauncher`, Applied Configuration Store、Job Process Tree | Alias/path/hash/Runtime分類、Process Tree matrix、publish HTTP MCP | PASS — PowerShell/cmd/venv Python、cmd→cmd/curl/venv Pythonをschema v2で再検証 |
 | REC-01〜07 | retry、timeout、cancel cleanup、`RecoveryManager` | Core lifecycle、elevated crash/recovery matrix、残留0 | PASS |
 | SEC-INV-01〜05 | deny-by-default、Policy非変更、Resolved Path/hash/Entry分類 | Core境界、管理者Windows suite、Operational E2E | PASS |
 | SEC-INV-06〜08、13 | WFP none/local/restricted、credential非継承、Process Tree confinement | credential非継承、全Network mode、Process Tree実効果 | PASS |
@@ -26,7 +26,7 @@ Sandbox Usability Revision後の現行実装を対象とする。commit `37386b8
 | NFR-01〜03 | default deny、決定的Policy/Graph/PERT、journal recovery | Core/Planner、elevated recovery tests | PASS |
 | NFR-04〜06 | 公開MCP Tool 2個、依存管理、Windows限定設計 | MCP schema、Release build/Bundle | PASS |
 | NFR-07 | Task/Tool/Process/Token/deny相関log | `ObservabilityTests`、Audit event、E2E log | PASS |
-| NFR-08〜09 | en/ja catalog、同一key検証、用語/設定索引 | locale/configuration tests、文書監査 | PASS |
+| NFR-08〜09 | en/ja catalog、同一key検証、用語/設定索引 | locale/configuration tests、文書監査、ja `show/apply`実行 | PASS |
 
 ## Acceptance Tests
 
@@ -57,6 +57,11 @@ Internal Tool testは件数を仕様としてassertしない。`Design.md`のToo
 
 | Verification | Date / privilege | Result |
 |---|---|---|
+| schema v2 Release build | 2026-08-13 / non-elevated | warning 0、error 0 |
+| schema v2 Agent.Core.Tests / Planner.Tests | 2026-08-13 / non-elevated | Core 104 PASS、Planner 10 PASS、fail/skip 0 |
+| schema v2 Windows Security/Recovery + README operational | 2026-08-13 / administrator | 環境非依存56件と実環境19件の計75 PASS、fail/skip 0。LPAC/ACL/Job/WFP、PowerShell/cmd/venv Python、Network、ACL monkeyを含む |
+| schema v2 published HTTP MCP | 2026-08-13 / administrator / `deepseek-v4-flash:cloud` | `agent_run` completed 3/3、cmd→cmd/curl/C:\tmp\.venv Python、Network none、ACL/WFP/Journal/backup/process残留0 |
+| schema v2 win-x64 self-contained Bundle | 2026-08-13 / fresh展開 | `show` PASS、local設定保持、ZIP SHA-256 `9fd60acd32ef6b031378cfa8ae7b4ff18b8c74daab410a7aa2e445101e73e87f` |
 | Release build | 2026-08-12 / non-elevated | warning 0、error 0 |
 | Agent.Core.Tests | 2026-08-12 / administrator | 103 PASS、0 FAIL、0 skip |
 | Agent.Planner.Tests | 2026-08-12 / administrator | 10 PASS、0 FAIL、0 skip |