feat: revise sandbox usability around semantic policy and LPAC process trees

Rewrite the specification and design vocabulary around User Sandbox Configuration, Environment Resolution, Executable Approval, Effective Sandbox Policy, and Windows Enforcement. Move the Internal Tool catalog to the design without treating its count as a requirement, and update README, implementation planning, traceability, audit history, prompts, and the Python skill.

Introduce schema_version 1 profiles, workspaces, mounts, executable aliases, network modes, and resource presets. Add local override merging, resolution and approval stores with atomic user-only persistence, fail-closed fingerprints, localized diagnostics, and executable/sandbox management CLI commands.

Change Windows execution to LPAC entry approval with inherited descendant confinement. Separate read and execute ACLs, preserve protected OS DACLs, apply Job process/memory/timeout limits to the tree, enforce WFP network modes, prevent credential environment inheritance, disable out-of-tree MSBuild reuse, and harden transactional ACL/recovery cleanup.

Isolate planning prompts from execution instructions, reject split coding plans that cannot satisfy task-scoped evidence, preserve configured thinking, and prevent optional task_update failures from corrupting completion checks.

Add and update configuration, resolution, approval, LPAC, descendant, readonly/development, Registry/COM, WFP, recovery, .NET/Python/PowerShell process-tree, and Operational E2E coverage. Publish reproducible bundles while preserving deployment-local configuration, prompts, skills, logs, state, approvals, and resolutions.

7 files changed, 729 insertions, 88 deletions

diff --git a/src/Agent.App/Agent.App.csproj b/src/Agent.App/Agent.App.csproj
index 17b7bc9..e3447c5 100644
--- a/src/Agent.App/Agent.App.csproj
+++ b/src/Agent.App/Agent.App.csproj
@@ -12,6 +12,7 @@
   </ItemGroup>
   <ItemGroup>
     <InternalsVisibleTo Include="Agent.Core.Tests" />
+    <InternalsVisibleTo Include="Agent.Windows.Tests" />
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Hosting" />
diff --git a/src/Agent.App/Cli/CommandLine.cs b/src/Agent.App/Cli/CommandLine.cs
index 3fdac9f..3b3fde1 100644
--- a/src/Agent.App/Cli/CommandLine.cs
+++ b/src/Agent.App/Cli/CommandLine.cs
@@ -1,38 +1,104 @@
 namespace Agent.App.Cli;
 
-public enum AppCommand { Serve, Check }
+public enum AppCommand
+{
+    Serve,
+    Check,
+    ExecutableResolve,
+    ExecutableApprove,
+    ExecutableList,
+    ExecutableRevoke,
+    SandboxResolve,
+    SandboxConfirm,
+    SandboxShow
+}
 
-public sealed record CommandLine(AppCommand Command, string? ConfigPath, string? Language, string? Transport)
+public sealed record CommandLine(
+    AppCommand Command,
+    string? ConfigPath,
+    string? Language,
+    string? Transport,
+    string? Alias = null,
+    string? ExecutablePath = null,
+    string? RuntimeRoot = null,
+    bool NoRuntime = false,
+    bool Yes = false,
+    string Format = "text")
 {
     public static CommandLine Parse(string[] args)
     {
         bool implicitServe = args.Length == 0 || args[0].StartsWith("--", StringComparison.Ordinal);
-        AppCommand command = implicitServe ? AppCommand.Serve : args[0] switch
+        int index = implicitServe ? 0 : 1;
+        AppCommand command;
+        string? alias = null;
+        if (implicitServe) command = AppCommand.Serve;
+        else if (args[0] == "serve") command = AppCommand.Serve;
+        else if (args[0] == "check") command = AppCommand.Check;
+        else if (args[0] is "executable" or "sandbox")
         {
-            "serve" => AppCommand.Serve,
-            "check" => AppCommand.Check,
-            _ => throw new CommandLineException("Expected 'serve' or 'check'.")
-        };
+            if (index >= args.Length) throw new CommandLineException($"Expected a subcommand after '{args[0]}'.");
+            string subcommand = args[index++];
+            command = (args[0], subcommand) switch
+            {
+                ("executable", "resolve") => AppCommand.ExecutableResolve,
+                ("executable", "approve") => AppCommand.ExecutableApprove,
+                ("executable", "list") => AppCommand.ExecutableList,
+                ("executable", "revoke") => AppCommand.ExecutableRevoke,
+                ("sandbox", "resolve") => AppCommand.SandboxResolve,
+                ("sandbox", "confirm") => AppCommand.SandboxConfirm,
+                ("sandbox", "show") => AppCommand.SandboxShow,
+                _ => throw new CommandLineException($"Unknown subcommand '{args[0]} {subcommand}'.")
+            };
+            if (command is AppCommand.ExecutableResolve or AppCommand.ExecutableApprove or AppCommand.ExecutableRevoke)
+            {
+                if (index >= args.Length || args[index].StartsWith("--", StringComparison.Ordinal))
+                    throw new CommandLineException($"Executable Alias is required for '{args[0]} {subcommand}'.");
+                alias = args[index++];
+            }
+        }
+        else throw new CommandLineException("Expected 'serve', 'check', 'executable', or 'sandbox'.");
 
         string? config = null;
         string? language = null;
         string? transport = null;
-        for (int i = implicitServe ? 0 : 1; i < args.Length; i++)
+        string? executablePath = null;
+        string? runtimeRoot = null;
+        bool noRuntime = false;
+        bool yes = false;
+        string format = "text";
+        while (index < args.Length)
         {
-            string option = args[i];
-            if (i + 1 >= args.Length) throw new CommandLineException($"Missing value for '{option}'.");
-            string value = args[++i];
+            string option = args[index++];
             switch (option)
             {
-                case "--config" when config is null: config = value; break;
-                case "--lang" when language is null: language = value; break;
-                case "--transport" when command == AppCommand.Serve && transport is null && value is "stdio" or "http": transport = value; break;
-                case "--transport" when command == AppCommand.Check: throw new CommandLineException("--transport is only valid for serve.");
-                case "--transport": throw new CommandLineException("Transport must be stdio or http.");
-                default: throw new CommandLineException($"Unknown or duplicate option '{option}'.");
+                case "--yes" when !yes: yes = true; break;
+                case "--no-runtime" when !noRuntime && runtimeRoot is null: noRuntime = true; break;
+                case "--config" when config is null: config = Value(option); break;
+                case "--lang" when language is null: language = Value(option); break;
+                case "--transport" when command == AppCommand.Serve && transport is null:
+                    transport = Value(option);
+                    if (transport is not ("stdio" or "http")) throw new CommandLineException("Transport must be stdio or http.");
+                    break;
+                case "--path" when executablePath is null: executablePath = Value(option); break;
+                case "--runtime-root" when runtimeRoot is null && !noRuntime: runtimeRoot = Value(option); break;
+                case "--format" when command == AppCommand.SandboxShow:
+                    format = Value(option);
+                    if (format is not ("text" or "json")) throw new CommandLineException("Format must be text or json.");
+                    break;
+                default: throw new CommandLineException($"Unknown, duplicate, or invalid option '{option}' for this command.");
             }
         }
-        return new CommandLine(command, config, language, transport);
+        bool management = command is not (AppCommand.Serve or AppCommand.Check);
+        if (management && config is null) throw new CommandLineException("--config <file> is required for executable and sandbox commands.");
+        if (yes && command is not (AppCommand.ExecutableApprove or AppCommand.ExecutableRevoke or AppCommand.SandboxConfirm))
+            throw new CommandLineException("--yes is valid only for approve, revoke, and confirm.");
+        return new(command, config, language, transport, alias, executablePath, runtimeRoot, noRuntime, yes, format);
+
+        string Value(string optionName)
+        {
+            if (index >= args.Length) throw new CommandLineException($"Missing value for '{optionName}'.");
+            return args[index++];
+        }
     }
 }
 
diff --git a/src/Agent.App/Configuration/AgentConfiguration.cs b/src/Agent.App/Configuration/AgentConfiguration.cs
index c5f720b..b2f94a7 100644
--- a/src/Agent.App/Configuration/AgentConfiguration.cs
+++ b/src/Agent.App/Configuration/AgentConfiguration.cs
@@ -64,13 +64,32 @@ public sealed class OllamaGenerationOptions
 }
 
 public sealed class PlannerOptions { public int MaxTasks { get; set; } = 32; }
-public sealed class SandboxOptions { public FilesystemOptions Filesystem { get; set; } = new(); public ProcessOptions Process { get; set; } = new(); public NetworkOptions Network { get; set; } = new(); public ResourceOptions Resources { get; set; } = new(); }
-public sealed class FilesystemOptions { public List<string> Read { get; set; } = []; public List<string> Write { get; set; } = []; public List<string> Execute { get; set; } = []; public List<string> Delete { get; set; } = []; }
-public sealed class ProcessOptions { public bool AllowShell { get; set; } = true; public List<ExecutableApproval> Approvals { get; set; } = []; public int MaxProcesses { get; set; } = 16; }
-public sealed class ExecutableApproval { public string Path { get; set; } = string.Empty; public string Sha256 { get; set; } = string.Empty; }
-public sealed class NetworkOptions { public string Mode { get; set; } = "deny"; public List<NetworkAllowance> Allow { get; set; } = []; }
+public sealed class SandboxOptions
+{
+    public string Profile { get; set; } = "readonly";
+    public List<string> Workspaces { get; set; } = [];
+    public List<MountOptions> Mounts { get; set; } = [];
+    public ExecutionOptions Execution { get; set; } = new();
+    public NetworkOptions Network { get; set; } = new();
+    public ResourceOptions Resources { get; set; } = new();
+}
+public sealed class MountOptions { public string Path { get; set; } = string.Empty; public string Access { get; set; } = "read_only"; }
+public sealed class ExecutionOptions { public List<string> Executables { get; set; } = []; public List<string> Shells { get; set; } = []; }
+public sealed class NetworkOptions
+{
+    public string Access { get; set; } = "none";
+    public List<LocalEndpointOptions> LocalEndpoints { get; set; } = [];
+    public List<NetworkAllowance> RestrictedEndpoints { get; set; } = [];
+}
+public sealed class LocalEndpointOptions { public int Port { get; set; } }
 public sealed class NetworkAllowance { public string Host { get; set; } = string.Empty; public List<int> Ports { get; set; } = []; }
-public sealed class ResourceOptions { public int MemoryMb { get; set; } = 4096; public int ProcessTimeoutSeconds { get; set; } = 1800; }
+public sealed class ResourceOptions
+{
+    public string Profile { get; set; } = "normal";
+    public int? MemoryMb { get; set; }
+    public int? ProcessLimit { get; set; }
+    public int? ExecutionTimeoutSeconds { get; set; }
+}
 public sealed class FileEditOptions { public int MemoryBackupLimitMb { get; set; } = 16; }
 public sealed class LimitOptions { public long WholeReadBytes { get; set; } = 1024 * 1024; public int SearchMaxResults { get; set; } = 1000; public int TailMaxLines { get; set; } = 10000; public double ContextSummaryRatio { get; set; } = 0.8; }
 public sealed class LocalizationOptions { public string Directory { get; set; } = "config/locales"; public string Fallback { get; set; } = "en"; }
diff --git a/src/Agent.App/Configuration/ConfigurationException.cs b/src/Agent.App/Configuration/ConfigurationException.cs
index 67f38a5..dd14ea9 100644
--- a/src/Agent.App/Configuration/ConfigurationException.cs
+++ b/src/Agent.App/Configuration/ConfigurationException.cs
@@ -1,4 +1,11 @@
 namespace Agent.App.Configuration;
 
-public sealed class ConfigurationException(string message, Exception? innerException = null)
-    : Exception(message, innerException);
+public sealed class ConfigurationException(string message, Exception? innerException = null,
+    string code = "configuration.invalid", string category = "configuration", string? target = null,
+    string? resolution = null) : Exception(message, innerException)
+{
+    public string Code { get; } = code;
+    public string Category { get; } = category;
+    public string? Target { get; } = target;
+    public string? Resolution { get; } = resolution;
+}
diff --git a/src/Agent.App/Configuration/ConfigurationLoader.cs b/src/Agent.App/Configuration/ConfigurationLoader.cs
index 26c56e1..6e15904 100644
--- a/src/Agent.App/Configuration/ConfigurationLoader.cs
+++ b/src/Agent.App/Configuration/ConfigurationLoader.cs
@@ -22,6 +22,7 @@ public static partial class ConfigurationLoader
             string localPath = Path.Combine(Path.GetDirectoryName(absolutePath)!, "agent.local.yaml");
             if (!string.Equals(absolutePath, localPath, StringComparison.OrdinalIgnoreCase) && File.Exists(localPath))
                 yaml = MergeYaml(yaml, File.ReadAllText(localPath));
+            RejectLegacySandbox(yaml);
             var deserializer = new DeserializerBuilder()
                 .WithNamingConvention(UnderscoredNamingConvention.Instance)
                 .Build();
@@ -61,26 +62,7 @@ public static partial class ConfigurationLoader
         if (value.Ollama.Options.NumCtx is <= 0) Throw("ollama.options.num_ctx must be positive.");
         if (value.Ollama.Options.Temperature is < 0 or > 2) Throw("ollama.options.temperature must be in 0..2.");
         if (value.Planner.MaxTasks is < 1 or > 32) Throw("planner.max_tasks must be in 1..32.");
-        if (value.Sandbox.Process.MaxProcesses <= 0 || value.Sandbox.Resources.MemoryMb <= 0 || value.Sandbox.Resources.ProcessTimeoutSeconds <= 0) Throw("sandbox resource limits must be positive.");
-        if (value.Sandbox.Network.Mode is not ("deny" or "allow")) Throw("sandbox.network.mode must be deny or allow.");
-        foreach (NetworkAllowance allowance in value.Sandbox.Network.Allow)
-        {
-            if (string.IsNullOrWhiteSpace(allowance.Host) || allowance.Ports.Count == 0 || allowance.Ports.Any(static p => p is < 1 or > 65535)) Throw("sandbox.network.allow contains an invalid host or port.");
-        }
-        foreach (ExecutableApproval approval in value.Sandbox.Process.Approvals)
-        {
-            if (!Path.IsPathFullyQualified(approval.Path) || !Sha256Regex().IsMatch(approval.Sha256)) Throw("process approval requires an absolute path and 64 hexadecimal SHA-256 characters.");
-            string approvalPath = Path.GetFullPath(approval.Path);
-            bool executable = value.Sandbox.Filesystem.Execute.Any(entry => ContainsPath(baseDirectory, entry, approvalPath));
-            if (!executable) Throw($"sandbox.process.approvals path is not covered by sandbox.filesystem.execute: {approvalPath}. Add the path or an ancestor directory to sandbox.filesystem.execute.");
-        }
-        foreach (string executeEntry in value.Sandbox.Filesystem.Execute)
-        {
-            string executePath = Path.IsPathFullyQualified(executeEntry) ? Path.GetFullPath(executeEntry) : Resolve(baseDirectory, executeEntry);
-            if (File.Exists(executePath) && !value.Sandbox.Process.Approvals.Any(approval =>
-                    string.Equals(Path.GetFullPath(approval.Path), executePath, StringComparison.OrdinalIgnoreCase)))
-                Throw($"sandbox.filesystem.execute file has no sandbox.process.approvals entry: {executePath}. Add canonical path and SHA-256 under sandbox.process.approvals.");
-        }
+        ValidateSandbox(value.Sandbox);
         if (value.FileEdit.MemoryBackupLimitMb <= 0 || value.Limits.WholeReadBytes <= 0 || value.Limits.SearchMaxResults <= 0 || value.Limits.TailMaxLines <= 0 || value.Limits.ContextSummaryRatio is <= 0 or >= 1) Throw("file/context limits are invalid.");
         if (value.Logging.MaxFileBytes <= 0 || value.Logging.RetainedFiles < 1) Throw("logging limits are invalid.");
         if (value.Logging.Level is not ("information" or "warning" or "error" or "fatal")) Throw("logging.level must be information, warning, error, or fatal.");
@@ -102,12 +84,62 @@ public static partial class ConfigurationLoader
 
     public static string Resolve(string baseDirectory, string path) => Path.GetFullPath(path, baseDirectory);
 
-    private static bool ContainsPath(string baseDirectory, string configuredPath, string target)
+    private static void ValidateSandbox(SandboxOptions sandbox)
+    {
+        if (sandbox.Profile is not ("readonly" or "development")) Throw("sandbox.profile must be readonly or development.");
+        if (sandbox.Workspaces.Any(string.IsNullOrWhiteSpace)) Throw("sandbox.workspaces contains an empty Logical Path.");
+        foreach (MountOptions mount in sandbox.Mounts)
+        {
+            if (string.IsNullOrWhiteSpace(mount.Path) || mount.Access is not ("read_only" or "read_write" or "read_write_delete"))
+                Throw("sandbox.mounts requires a Logical Path and access read_only, read_write, or read_write_delete.");
+            if (sandbox.Profile == "readonly" && mount.Access != "read_only")
+                Throw("readonly sandbox.profile permits only read_only mounts.");
+        }
+        string[] aliases = sandbox.Execution.Executables.Concat(sandbox.Execution.Shells).ToArray();
+        if (aliases.Any(alias => !AliasRegex().IsMatch(alias))) Throw("Executable Alias must match ^[a-z0-9][a-z0-9._-]{0,63}$.");
+        if (aliases.Distinct(StringComparer.OrdinalIgnoreCase).Count() != aliases.Length)
+            Throw("Executable Alias values must be unique across sandbox.execution.executables and shells.");
+
+        if (sandbox.Network.Access is not ("none" or "local" or "restricted"))
+            Throw("sandbox.network.access must be none, local, or restricted.");
+        if (sandbox.Network.LocalEndpoints.Any(static endpoint => endpoint.Port is < 1 or > 65535))
+            Throw("sandbox.network.local_endpoints contains an invalid port.");
+        foreach (NetworkAllowance endpoint in sandbox.Network.RestrictedEndpoints)
+            if (string.IsNullOrWhiteSpace(endpoint.Host) || endpoint.Ports.Count == 0 || endpoint.Ports.Any(static port => port is < 1 or > 65535))
+                Throw("sandbox.network.restricted_endpoints contains an invalid host or port.");
+        if (sandbox.Network.Access == "none" && (sandbox.Network.LocalEndpoints.Count != 0 || sandbox.Network.RestrictedEndpoints.Count != 0))
+            Throw("sandbox.network.access none cannot contain endpoints.");
+        if (sandbox.Network.Access == "local" && (sandbox.Network.LocalEndpoints.Count == 0 || sandbox.Network.RestrictedEndpoints.Count != 0))
+            Throw("sandbox.network.access local requires local_endpoints and forbids restricted_endpoints.");
+        if (sandbox.Network.Access == "restricted" && (sandbox.Network.RestrictedEndpoints.Count == 0 || sandbox.Network.LocalEndpoints.Count != 0))
+            Throw("sandbox.network.access restricted requires restricted_endpoints and forbids local_endpoints.");
+
+        if (sandbox.Resources.Profile is not ("constrained" or "normal" or "extended"))
+            Throw("sandbox.resources.profile must be constrained, normal, or extended.");
+        if (sandbox.Resources.MemoryMb is <= 0 || sandbox.Resources.ProcessLimit is <= 0 || sandbox.Resources.ExecutionTimeoutSeconds is <= 0)
+            Throw("sandbox resource overrides must be positive.");
+    }
+
+    private static void RejectLegacySandbox(string yaml)
     {
-        string allowed = Path.IsPathFullyQualified(configuredPath) ? Path.GetFullPath(configuredPath) : Resolve(baseDirectory, configuredPath);
-        if (string.Equals(allowed, target, StringComparison.OrdinalIgnoreCase)) return true;
-        string prefix = allowed.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar) + Path.DirectorySeparatorChar;
-        return target.StartsWith(prefix, StringComparison.OrdinalIgnoreCase);
+        YamlNode root = LoadRoot(yaml, "merged configuration");
+        if (root is not YamlMappingNode rootMap || !TryGet(rootMap, "sandbox", out YamlNode? sandboxNode) || sandboxNode is not YamlMappingNode sandbox) return;
+        if (TryGet(sandbox, "filesystem", out _) || TryGet(sandbox, "process", out _))
+            Throw("Legacy sandbox.filesystem/sandbox.process configuration is no longer supported. Migrate to sandbox.profile, workspaces, mounts, execution, network, and resources; then run 'sandbox resolve' and 'sandbox confirm'.");
+    }
+
+    private static bool TryGet(YamlMappingNode map, string name, out YamlNode? value)
+    {
+        foreach (KeyValuePair<YamlNode, YamlNode> pair in map.Children)
+        {
+            if (pair.Key is YamlScalarNode key && key.Value == name)
+            {
+                value = pair.Value;
+                return true;
+            }
+        }
+        value = null;
+        return false;
     }
 
     private static string MergeYaml(string baseYaml, string localYaml)
@@ -154,6 +186,6 @@ public static partial class ConfigurationLoader
     }
 
     private static void Throw(string message) => throw new ConfigurationException(message);
-    [GeneratedRegex("^[0-9a-fA-F]{64}$", RegexOptions.CultureInvariant)]
-    private static partial Regex Sha256Regex();
+    [GeneratedRegex("^[a-z0-9][a-z0-9._-]{0,63}$", RegexOptions.CultureInvariant)]
+    private static partial Regex AliasRegex();
 }
diff --git a/src/Agent.App/Program.cs b/src/Agent.App/Program.cs
index 3d2d2db..b58c914 100644
--- a/src/Agent.App/Program.cs
+++ b/src/Agent.App/Program.cs
@@ -1,6 +1,7 @@
 using Agent.App.Cli;
 using Agent.App.Configuration;
 using Agent.App.Logging;
+using Agent.App.Sandbox;
 using Agent.Core.Localization;
 using Agent.Core.Prompts;
 using Agent.Core.Sessions;
@@ -11,6 +12,7 @@ using Agent.Core.Tools;
 using Agent.Windows.Recovery;
 using Agent.Windows.Security;
 using Agent.Windows.Tools;
+using System.Text.Json;
 
 namespace Agent.App;
 
@@ -35,8 +37,13 @@ internal static class Program
             _ = FixedPrompt.Load();
 
             string logDirectory = ConfigurationLoader.Resolve(baseDirectory, configuration.Logging.Directory);
-            UserOnlyDirectory.Ensure(logDirectory);
-            using var log = new RollingFileLog(logDirectory, configuration.Logging.MaxFileBytes, configuration.Logging.RetainedFiles, configuration.Logging.Level);
+            if (commandLine.Command is not (AppCommand.Serve or AppCommand.Check))
+                return RunManagementCommand(commandLine, configuration, configPath, logDirectory, locale);
+            string stateDirectory = Path.Combine(baseDirectory, "state");
+            string journalDirectory = Path.Combine(stateDirectory, "journals");
+            string backupDirectory = Path.Combine(stateDirectory, "backups");
+            EffectiveSandboxPolicy effectiveSandboxPolicy = new SandboxEnvironmentResolver(configPath, configuration)
+                .Compile(journalDirectory, backupDirectory);
             if (commandLine.Command == AppCommand.Check)
             {
                 WindowsPlatformCheckResult platform = WindowsPlatformCheck.Run();
@@ -48,15 +55,15 @@ internal static class Program
                 {
                     string detail = $"{locale.Get("check.wfp_admin_required")} error_code={platform.ErrorCode}; operation={platform.ErrorOperation}";
                     string failure = locale.Format("check.failure", new Dictionary<string, object?> { ["message"] = detail });
-                    log.Error(failure);
                     Console.Error.WriteLine(failure);
                     return 2;
                 }
-                log.Information(locale.Get("check.success"));
                 Console.Out.WriteLine(locale.Get("check.success"));
                 return 0;
             }
 
+            UserOnlyDirectory.Ensure(logDirectory);
+            using var log = new RollingFileLog(logDirectory, configuration.Logging.MaxFileBytes, configuration.Logging.RetainedFiles, configuration.Logging.Level);
             log.Information(locale.Get("app.starting"));
             WindowsPlatformCheckResult servePlatform = WindowsPlatformCheck.Run();
             if (!servePlatform.Success)
@@ -75,7 +82,7 @@ internal static class Program
             }
 
             var sessionStore = new SessionStore();
-            InternalToolDispatcher toolDispatcher = CreateToolDispatcher(configuration, baseDirectory, logDirectory, sessionStore);
+            InternalToolDispatcher toolDispatcher = CreateToolDispatcher(configuration, effectiveSandboxPolicy, logDirectory, sessionStore);
             using var runtimeObserver = new JsonLinesRuntimeObserver(logDirectory, configuration.Logging.MaxFileBytes, configuration.Logging.RetainedFiles);
             string taskStateDirectory = Path.Combine(baseDirectory, "state", "mcp-tasks");
             UserOnlyDirectory.Ensure(taskStateDirectory);
@@ -136,7 +143,10 @@ internal static class Program
                 LocaleException => "locale.invalid",
                 _ => "app.io_error"
             };
-            return locale.Format(key, new Dictionary<string, object?> { ["message"] = error.Message });
+            string message = error is ConfigurationException configuration
+                ? FormatConfigurationError(locale, configuration)
+                : error.Message;
+            return locale.Format(key, new Dictionary<string, object?> { ["message"] = message });
         }
         catch
         {
@@ -144,39 +154,33 @@ internal static class Program
         }
     }
 
-    private static InternalToolDispatcher CreateToolDispatcher(AgentConfiguration configuration, string baseDirectory, string logDirectory, SessionStore? sessionStore = null)
+    private static string FormatConfigurationError(LocaleCatalog locale, ConfigurationException error)
     {
-        string stateDirectory = Path.Combine(baseDirectory, "state");
-        string journalDirectory = Path.Combine(stateDirectory, "journals");
-        string backupDirectory = Path.Combine(stateDirectory, "backups");
-        Directory.CreateDirectory(journalDirectory);
-        Directory.CreateDirectory(backupDirectory);
+        string? key = error.Code switch
+        {
+            "sandbox.resolution_unconfirmed" => "sandbox.error.resolution_unconfirmed",
+            "sandbox.resolution_changed" => "sandbox.error.resolution_changed",
+            "executable.approval_missing" => "sandbox.error.approval_missing",
+            "executable.resolution_changed" => "sandbox.error.executable_resolution_changed",
+            "executable.hash_changed" => "sandbox.error.executable_hash_changed",
+            "executable.shell_unsupported" => "sandbox.error.shell_unsupported",
+            _ => null
+        };
+        string localized = key is null ? error.Message : locale.Format(key, new Dictionary<string, object?> { ["target"] = error.Target ?? "-" });
+        string resolution = key is null || error.Resolution is null ? error.Resolution ?? "-" : locale.Get(key + ".resolution");
+        return $"code={error.Code}; category={error.Category}; target={error.Target ?? "-"}; message={localized}; resolution={resolution}";
+    }
+
+    private static InternalToolDispatcher CreateToolDispatcher(AgentConfiguration configuration, EffectiveSandboxPolicy effectiveSandboxPolicy, string logDirectory, SessionStore? sessionStore = null)
+    {
+        Directory.CreateDirectory(effectiveSandboxPolicy.JournalDirectory);
+        Directory.CreateDirectory(effectiveSandboxPolicy.BackupDirectory);
         var audit = new JsonLinesSecurityAuditSink(Path.Combine(logDirectory, "audit.jsonl"));
-        RecoveryResult recovery = new RecoveryManager(journalDirectory, audit).RecoverAll();
+        RecoveryResult recovery = new RecoveryManager(effectiveSandboxPolicy.JournalDirectory, audit).RecoverAll();
         if (!recovery.IsClean) throw new InvalidOperationException("Recovery did not reach a clean state: " + string.Join(" | ", recovery.Errors));
-        var fileEntries = new List<FilePolicyEntry>();
-        Add(configuration.Sandbox.Filesystem.Read, FileCapability.Read);
-        Add(configuration.Sandbox.Filesystem.Write, FileCapability.Write);
-        Add(configuration.Sandbox.Filesystem.Execute, FileCapability.Execute);
-        Add(configuration.Sandbox.Filesystem.Delete, FileCapability.Delete);
-        var settings = new WindowsSandboxSettings(
-            fileEntries,
-            configuration.Sandbox.Process.Approvals.Select(approval => new Agent.Windows.Security.ExecutableApproval(approval.Path, approval.Sha256)).ToArray(),
-            configuration.Sandbox.Process.AllowShell,
-            new SandboxJobLimits((uint)configuration.Sandbox.Process.MaxProcesses, checked((ulong)configuration.Sandbox.Resources.MemoryMb * 1024 * 1024)),
-            configuration.Sandbox.Network.Mode,
-            configuration.Sandbox.Network.Allow.Select(item => (item.Host, (IReadOnlyList<int>)item.Ports)).ToArray(),
-            journalDirectory, backupDirectory, checked((long)configuration.FileEdit.MemoryBackupLimitMb * 1024 * 1024),
-            configuration.Limits.WholeReadBytes, configuration.Limits.SearchMaxResults, configuration.Limits.TailMaxLines,
-            configuration.Sandbox.Resources.ProcessTimeoutSeconds);
-        var backend = new WindowsToolBackend(settings, audit, new TaskGraphToolHandler(configuration.Planner.MaxTasks, sessionStore));
+        var backend = new WindowsToolBackend(effectiveSandboxPolicy, audit, new TaskGraphToolHandler(configuration.Planner.MaxTasks, sessionStore));
         var allowed = InternalToolCatalog.All.Select(static item => item.Name).ToHashSet(StringComparer.Ordinal);
         return new InternalToolDispatcher(new DenyByDefaultPolicy(allowed), backend);
-
-        void Add(IEnumerable<string> paths, FileCapability capability)
-        {
-            foreach (string path in paths) fileEntries.Add(new FilePolicyEntry(Path.IsPathFullyQualified(path) ? path : ConfigurationLoader.Resolve(baseDirectory, path), capability));
-        }
     }
 
     internal static AgentRuntimeSettings CreateRuntimeSettings(AgentConfiguration configuration, string userPrompt, string language,
@@ -184,7 +188,7 @@ internal static class Program
         userPrompt,
         language,
         skills,
-        "Windows AppContainer, ACL, Job Object, child-process restriction, and WFP sandbox capabilities.",
+        "Windows LPAC, ACL, Job Object process-tree, and WFP sandbox capabilities.",
         configuration.Agent.MaxIterations,
         configuration.Agent.SameFailureLimit,
         locale.Get("ollama.vision_unsupported"),
@@ -192,4 +196,155 @@ internal static class Program
         configuration.Limits.ContextSummaryRatio,
         MaxTasks: configuration.Planner.MaxTasks,
         Model: configuration.Ollama.Model);
+
+    private static int RunManagementCommand(CommandLine command, AgentConfiguration configuration, string configPath, string logDirectory, LocaleCatalog locale)
+    {
+        var resolver = new SandboxEnvironmentResolver(configPath, configuration);
+        var approvals = new ExecutableApprovalStore();
+        var audit = new JsonLinesSecurityAuditSink(Path.Combine(logDirectory, "audit.jsonl"));
+        switch (command.Command)
+        {
+            case AppCommand.ExecutableResolve:
+            {
+                IReadOnlyList<string> candidates = ExecutableResolver.ResolveCandidates(command.Alias!, ResolveCliPath(command.ExecutablePath, configPath));
+                foreach (string candidate in candidates) Console.Out.WriteLine(candidate);
+                if (candidates.Count > 1) Console.Out.WriteLine(locale.Get("management.ambiguous_candidates"));
+                return 0;
+            }
+            case AppCommand.ExecutableApprove:
+            {
+                UserOnlyDirectory.Ensure(logDirectory);
+                EnsureConfiguredAlias(configuration, command.Alias!, out bool shell);
+                if (command.RuntimeRoot is null && !command.NoRuntime)
+                    throw new CommandLineException("Specify either --runtime-root <path> or --no-runtime when approving an Executable Alias.");
+                IReadOnlyList<string> candidates = ExecutableResolver.ResolveCandidates(command.Alias!, ResolveCliPath(command.ExecutablePath, configPath));
+                if (candidates.Count != 1)
+                    throw new ConfigurationException($"Executable Alias '{command.Alias}' is ambiguous. Re-run with --path and one of:{Environment.NewLine}{string.Join(Environment.NewLine, candidates)}");
+                string resolved = candidates[0];
+                if (shell && !ExecutableResolver.IsSupportedShell(resolved))
+                    throw new ConfigurationException($"Shell Alias '{command.Alias}' must resolve to cmd.exe, powershell.exe, or pwsh.exe.",
+                        code: "executable.shell_unsupported", category: "sandbox", target: resolved,
+                        resolution: "Select a supported Shell executable and approve it explicitly.");
+                string? runtimeRoot = command.RuntimeRoot is null ? null : ResolvedPath.Resolve(ResolveCliPath(command.RuntimeRoot, configPath)!);
+                if (runtimeRoot is not null && !Directory.Exists(runtimeRoot)) throw new ConfigurationException($"Runtime Root is not a directory: '{runtimeRoot}'.");
+                string sha256 = EntryExecutablePolicy.ComputeSha256(resolved);
+                Console.Out.WriteLine(locale.Format("management.approval_diff", new Dictionary<string, object?>
+                {
+                    ["alias"] = command.Alias, ["classification"] = shell ? "shell" : "executable",
+                    ["path"] = resolved, ["sha256"] = sha256, ["runtime_root"] = runtimeRoot ?? "(none)"
+                }));
+                ConfirmMutation(command.Yes, locale.Get("management.approve_prompt"));
+                approvals.Approve(new(command.Alias!, shell ? "shell" : "executable", command.ExecutablePath ?? resolved,
+                    resolved, sha256, runtimeRoot, DateTimeOffset.UtcNow));
+                audit.Write(new(DateTimeOffset.UtcNow, Guid.Empty, "executable.approval.add", "approved",
+                    new Dictionary<string, string> { ["alias"] = command.Alias!, ["resolved_path"] = resolved, ["non_interactive"] = command.Yes.ToString() }));
+                return 0;
+            }
+            case AppCommand.ExecutableList:
+                foreach (ExecutableApprovalRecord item in approvals.List())
+                    Console.Out.WriteLine($"{item.Alias}\t{item.Classification}\t{item.ResolvedPath}\t{item.Sha256}\t{item.RuntimeRoot ?? "-"}");
+                return 0;
+            case AppCommand.ExecutableRevoke:
+            {
+                UserOnlyDirectory.Ensure(logDirectory);
+                ExecutableApprovalRecord record = approvals.Find(command.Alias!) ?? throw new ConfigurationException($"Executable Alias '{command.Alias}' is not approved.");
+                Console.Out.WriteLine(locale.Format("management.revoke_diff", new Dictionary<string, object?> { ["alias"] = record.Alias, ["path"] = record.ResolvedPath }));
+                ConfirmMutation(command.Yes, locale.Get("management.revoke_prompt"));
+                _ = approvals.Revoke(record.Alias);
+                audit.Write(new(DateTimeOffset.UtcNow, Guid.Empty, "executable.approval.remove", "revoked",
+                    new Dictionary<string, string> { ["alias"] = record.Alias, ["resolved_path"] = record.ResolvedPath, ["non_interactive"] = command.Yes.ToString() }));
+                return 0;
+            }
+            case AppCommand.SandboxResolve:
+                PrintResolution(resolver.Resolve(), "text", locale);
+                return 0;
+            case AppCommand.SandboxConfirm:
+            {
+                UserOnlyDirectory.Ensure(logDirectory);
+                SandboxResolutionPreview preview = resolver.Resolve();
+                PrintResolution(preview, "text", locale);
+                ConfirmMutation(command.Yes, locale.Get("management.sandbox_confirm_prompt"));
+                SandboxResolutionDocument document = resolver.Confirm();
+                audit.Write(new(DateTimeOffset.UtcNow, Guid.Empty, "sandbox.resolution.confirm", "confirmed",
+                    new Dictionary<string, string> { ["config_fingerprint"] = document.ConfigFingerprint, ["non_interactive"] = command.Yes.ToString() }));
+                return 0;
+            }
+            case AppCommand.SandboxShow:
+            {
+                SandboxResolutionPreview preview = resolver.Resolve();
+                SandboxResolutionDocument? confirmed = new SandboxResolutionStore(configPath).Load();
+                bool isConfirmed = confirmed is not null && confirmed.ConfigFingerprint == preview.Fingerprint;
+                EffectiveSandboxPolicy? policy = isConfirmed
+                    ? resolver.Compile(Path.Combine(Path.GetDirectoryName(configPath)!, "state", "journals"),
+                        Path.Combine(Path.GetDirectoryName(configPath)!, "state", "backups"))
+                    : null;
+                object? effective = policy is null ? null : EffectivePolicyView(policy);
+                if (command.Format == "json") Console.Out.WriteLine(JsonSerializer.Serialize(new { current = preview, confirmed, effective_policy = effective }, new JsonSerializerOptions { WriteIndented = true }));
+                else
+                {
+                    PrintResolution(preview, "text", locale);
+                    Console.Out.WriteLine(locale.Format("management.confirmed", new Dictionary<string, object?>
+                    { ["value"] = locale.Get(isConfirmed ? "management.yes" : "management.no") }));
+                    if (effective is not null) Console.Out.WriteLine(JsonSerializer.Serialize(effective, new JsonSerializerOptions { WriteIndented = true }));
+                }
+                return 0;
+            }
+            default: throw new CommandLineException("Unsupported management command.");
+        }
+    }
+
+    private static void EnsureConfiguredAlias(AgentConfiguration configuration, string alias, out bool shell)
+    {
+        bool executable = configuration.Sandbox.Execution.Executables.Contains(alias, StringComparer.OrdinalIgnoreCase);
+        shell = configuration.Sandbox.Execution.Shells.Contains(alias, StringComparer.OrdinalIgnoreCase);
+        if (!executable && !shell) throw new ConfigurationException($"Executable Alias '{alias}' is not declared in sandbox.execution.executables or sandbox.execution.shells.");
+    }
+
+    private static void ConfirmMutation(bool yes, string prompt)
+    {
+        if (yes) return;
+        if (Console.IsInputRedirected) throw new CommandLineException("Interactive confirmation is unavailable; review the displayed diff and re-run with --yes.");
+        Console.Out.Write($"{prompt} [y/N] ");
+        if (!string.Equals(Console.ReadLine(), "y", StringComparison.OrdinalIgnoreCase)) throw new CommandLineException("Operation cancelled.");
+    }
+
+    private static void PrintResolution(SandboxResolutionPreview preview, string format, LocaleCatalog locale)
+    {
+        if (format == "json") { Console.Out.WriteLine(JsonSerializer.Serialize(preview, new JsonSerializerOptions { WriteIndented = true })); return; }
+        Console.Out.WriteLine(locale.Format("management.resolution_header", new Dictionary<string, object?>
+        { ["config"] = preview.ConfigPath, ["fingerprint"] = preview.Fingerprint }));
+        foreach (ResolutionItem item in preview.Items)
+            Console.Out.WriteLine($"{item.Kind}\t{item.Access}\t{item.LogicalPath} -> {item.ResolvedPath}");
+    }
+
+    private static string? ResolveCliPath(string? path, string configPath) => path is null ? null :
+        (Path.IsPathFullyQualified(path) ? path : Path.Combine(Path.GetDirectoryName(configPath)!, path));
+
+    private static object EffectivePolicyView(EffectiveSandboxPolicy policy) => new
+    {
+        filesystem_roots = policy.Files.Select(item => new { resolved_path = item.Path, capabilities = item.Capabilities.ToString(), origin = item.Origin }),
+        approved_entry_executables = policy.EntryExecutables.Select(item => new
+        {
+            alias = item.Alias,
+            resolved_path = item.ResolvedPath,
+            sha256 = item.Sha256,
+            classification = item.IsShell ? "approved_shell_executable" : "approved_entry_executable",
+            runtime_root = item.RuntimeRoot
+        }),
+        runtime_roots = policy.RuntimeRoots,
+        artifact_roots = policy.ArtifactRoots,
+        network = new
+        {
+            access = policy.NetworkAccess,
+            endpoints = policy.NetworkAllowances.Select(item => new { host = item.Host, ports = item.Ports })
+        },
+        resources = new
+        {
+            profile = policy.ResourceProfile,
+            process_limit = policy.JobLimits.MaxProcesses,
+            memory_bytes = policy.JobLimits.MaxJobMemoryBytes,
+            execution_timeout_seconds = policy.ProcessTimeoutSeconds
+        },
+        baseline_capabilities = policy.BaselineCapabilities ?? ["registryRead", "lpacInstrumentation"]
+    };
 }
diff --git a/src/Agent.App/Sandbox/SandboxServices.cs b/src/Agent.App/Sandbox/SandboxServices.cs
new file mode 100644
index 0000000..93211b8
--- /dev/null
+++ b/src/Agent.App/Sandbox/SandboxServices.cs
@@ -0,0 +1,361 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Agent.App.Configuration;
+using Agent.Windows.Security;
+using Agent.Windows.Tools;
+
+namespace Agent.App.Sandbox;
+
+public sealed record ExecutableApprovalRecord(
+    string Alias,
+    string Classification,
+    string LogicalPath,
+    string ResolvedPath,
+    string Sha256,
+    string? RuntimeRoot,
+    DateTimeOffset ApprovedAt);
+
+public sealed record ExecutableApprovalDocument(int SchemaVersion, IReadOnlyList<ExecutableApprovalRecord> Approvals);
+
+public sealed class ExecutableApprovalStore
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web) { WriteIndented = true };
+    public string StorePath { get; }
+    private readonly bool _protectDirectory;
+
+    public ExecutableApprovalStore(string? storePath = null) : this(storePath, protectDirectory: true) { }
+
+    internal ExecutableApprovalStore(string? storePath, bool protectDirectory)
+    {
+        StorePath = storePath ?? Path.Combine(UserStoreRoot(), "executable-approvals.json");
+        _protectDirectory = protectDirectory;
+    }
+
+    public IReadOnlyList<ExecutableApprovalRecord> List() => Load().Approvals;
+
+    public ExecutableApprovalRecord? Find(string alias) =>
+        Load().Approvals.SingleOrDefault(item => item.Alias.Equals(alias, StringComparison.OrdinalIgnoreCase));
+
+    public void Approve(ExecutableApprovalRecord approval)
+    {
+        List<ExecutableApprovalRecord> records = Load().Approvals
+            .Where(item => !item.Alias.Equals(approval.Alias, StringComparison.OrdinalIgnoreCase)).ToList();
+        records.Add(approval);
+        Save(new(1, records.OrderBy(item => item.Alias, StringComparer.OrdinalIgnoreCase).ToArray()));
+    }
+
+    public bool Revoke(string alias)
+    {
+        ExecutableApprovalDocument current = Load();
+        ExecutableApprovalRecord[] remaining = current.Approvals
+            .Where(item => !item.Alias.Equals(alias, StringComparison.OrdinalIgnoreCase)).ToArray();
+        if (remaining.Length == current.Approvals.Count) return false;
+        Save(new(1, remaining));
+        return true;
+    }
+
+    private ExecutableApprovalDocument Load()
+    {
+        if (!File.Exists(StorePath)) return new(1, []);
+        ExecutableApprovalDocument? document = JsonSerializer.Deserialize<ExecutableApprovalDocument>(File.ReadAllText(StorePath), JsonOptions);
+        if (document is null || document.SchemaVersion != 1)
+            throw new ConfigurationException($"Unsupported Executable Approval Store schema: '{StorePath}'.");
+        if (document.Approvals.GroupBy(item => item.Alias, StringComparer.OrdinalIgnoreCase).Any(group => group.Count() != 1))
+            throw new ConfigurationException($"Executable Approval Store contains duplicate Alias records: '{StorePath}'.");
+        foreach (ExecutableApprovalRecord item in document.Approvals)
+        {
+            if (!Regex.IsMatch(item.Alias, "^[a-z0-9][a-z0-9._-]{0,63}$", RegexOptions.CultureInvariant) ||
+                item.Classification is not ("executable" or "shell") || !Path.IsPathFullyQualified(item.ResolvedPath) ||
+                !Regex.IsMatch(item.Sha256, "^[A-Fa-f0-9]{64}$", RegexOptions.CultureInvariant) ||
+                (item.RuntimeRoot is not null && !Path.IsPathFullyQualified(item.RuntimeRoot)))
+                throw new ConfigurationException($"Executable Approval Store contains an invalid record for Alias '{item.Alias}': '{StorePath}'.");
+        }
+        return document;
+    }
+
+    private void Save(ExecutableApprovalDocument document)
+    {
+        string directory = Path.GetDirectoryName(StorePath) ?? throw new ConfigurationException("Executable Approval Store path has no directory.");
+        if (_protectDirectory) UserOnlyDirectory.Ensure(directory); else Directory.CreateDirectory(directory);
+        AtomicJson.Write(StorePath, document, JsonOptions);
+    }
+
+    internal static string UserStoreRoot() => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "AgentSandboxMcp");
+}
+
+public sealed record ResolutionItem(string Kind, string LogicalPath, string ResolvedPath, string Access);
+public sealed record SandboxResolutionDocument(
+    int SchemaVersion,
+    string ConfigPath,
+    string ConfigFingerprint,
+    IReadOnlyList<ResolutionItem> Items,
+    DateTimeOffset ConfirmedAt);
+
+public sealed class SandboxResolutionStore
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web) { WriteIndented = true };
+    public string StorePath { get; }
+    private readonly bool _protectDirectory;
+
+    public SandboxResolutionStore(string configPath, string? storeRoot = null) : this(configPath, storeRoot, protectDirectory: true) { }
+
+    internal SandboxResolutionStore(string configPath, string? storeRoot, bool protectDirectory)
+    {
+        string normalized = Path.GetFullPath(configPath).ToUpperInvariant();
+        string name = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(normalized))) + ".json";
+        StorePath = Path.Combine(storeRoot ?? Path.Combine(ExecutableApprovalStore.UserStoreRoot(), "environment-resolutions"), name);
+        _protectDirectory = protectDirectory;
+    }
+
+    public SandboxResolutionDocument? Load()
+    {
+        if (!File.Exists(StorePath)) return null;
+        SandboxResolutionDocument? document = JsonSerializer.Deserialize<SandboxResolutionDocument>(File.ReadAllText(StorePath), JsonOptions);
+        if (document is null || document.SchemaVersion != 1)
+            throw new ConfigurationException($"Unsupported Sandbox Environment Resolution Store schema: '{StorePath}'.");
+        if (!Path.IsPathFullyQualified(document.ConfigPath) ||
+            !Regex.IsMatch(document.ConfigFingerprint, "^[A-Fa-f0-9]{64}$", RegexOptions.CultureInvariant) ||
+            document.Items.Any(item => item.Kind is not ("workspace" or "mount") || !Path.IsPathFullyQualified(item.ResolvedPath)))
+            throw new ConfigurationException($"Sandbox Environment Resolution Store contains an invalid record: '{StorePath}'.");
+        return document;
+    }
+
+    public void Save(SandboxResolutionDocument document)
+    {
+        string directory = Path.GetDirectoryName(StorePath) ?? throw new ConfigurationException("Resolution Store path has no directory.");
+        if (_protectDirectory) UserOnlyDirectory.Ensure(directory); else Directory.CreateDirectory(directory);
+        AtomicJson.Write(StorePath, document, JsonOptions);
+    }
+}
+
+public sealed record SandboxResolutionPreview(string ConfigPath, string Fingerprint, IReadOnlyList<ResolutionItem> Items);
+
+public sealed class SandboxEnvironmentResolver
+{
+    private readonly string _configPath;
+    private readonly string _baseDirectory;
+    private readonly AgentConfiguration _configuration;
+    private readonly SandboxResolutionStore _resolutionStore;
+    private readonly ExecutableApprovalStore _approvalStore;
+
+    public SandboxEnvironmentResolver(string configPath, AgentConfiguration configuration,
+        SandboxResolutionStore? resolutionStore = null, ExecutableApprovalStore? approvalStore = null)
+    {
+        _configPath = Path.GetFullPath(configPath);
+        _baseDirectory = Path.GetDirectoryName(_configPath)!;
+        _configuration = configuration;
+        _resolutionStore = resolutionStore ?? new SandboxResolutionStore(_configPath);
+        _approvalStore = approvalStore ?? new ExecutableApprovalStore();
+    }
+
+    public SandboxResolutionPreview Resolve()
+    {
+        var items = new List<ResolutionItem>();
+        foreach (string workspace in _configuration.Sandbox.Workspaces)
+            items.Add(ResolveDirectory("workspace", workspace,
+                _configuration.Sandbox.Profile == "development" ? "read_write_delete_execute" : "read_only"));
+        foreach (MountOptions mount in _configuration.Sandbox.Mounts)
+            items.Add(ResolveDirectory("mount", mount.Path, mount.Access));
+        return new(_configPath, Fingerprint(), items);
+    }
+
+    public SandboxResolutionDocument Confirm()
+    {
+        SandboxResolutionPreview preview = Resolve();
+        var document = new SandboxResolutionDocument(1, preview.ConfigPath, preview.Fingerprint, preview.Items, DateTimeOffset.UtcNow);
+        _resolutionStore.Save(document);
+        return document;
+    }
+
+    public EffectiveSandboxPolicy Compile(string journalDirectory, string backupDirectory)
+    {
+        SandboxResolutionPreview current = Resolve();
+        SandboxResolutionDocument? confirmed = _resolutionStore.Load();
+        if (confirmed is null)
+            throw Error("sandbox.resolution_unconfirmed", "Sandbox Environment Resolution is not confirmed.", _configPath,
+                "Run 'agent-mcp sandbox resolve --config <file>' and then 'agent-mcp sandbox confirm --config <file>'.");
+        if (!confirmed.ConfigPath.Equals(current.ConfigPath, StringComparison.OrdinalIgnoreCase) ||
+            !confirmed.ConfigFingerprint.Equals(current.Fingerprint, StringComparison.Ordinal) ||
+            !Equivalent(confirmed.Items, current.Items))
+            throw Error("sandbox.resolution_changed", "Sandbox Environment Resolution changed after confirmation.", _configPath,
+                "Review 'sandbox resolve' and run 'sandbox confirm' again.");
+
+        var files = new List<FilePolicyEntry>();
+        var artifactRoots = new List<string>();
+        foreach (ResolutionItem item in current.Items)
+        {
+            FileCapability capabilities = item.Kind == "workspace"
+                ? (_configuration.Sandbox.Profile == "development"
+                    ? FileCapability.Read | FileCapability.Write | FileCapability.Delete | FileCapability.Execute
+                    : FileCapability.Read)
+                : item.Access switch
+                {
+                    "read_only" => FileCapability.Read,
+                    "read_write" => FileCapability.Read | FileCapability.Write,
+                    "read_write_delete" => FileCapability.Read | FileCapability.Write | FileCapability.Delete,
+                    _ => throw new ConfigurationException($"Unsupported Mount access '{item.Access}'.")
+                };
+            files.Add(new(item.ResolvedPath, capabilities, item.Kind));
+            if (item.Kind == "workspace" && _configuration.Sandbox.Profile == "development") artifactRoots.Add(item.ResolvedPath);
+        }
+
+        var approvals = new List<ApprovedEntryExecutable>();
+        var runtimeRoots = new List<string>();
+        foreach ((string alias, bool shell) in RequestedAliases())
+        {
+            ExecutableApprovalRecord record = _approvalStore.Find(alias) ??
+                throw Error("executable.approval_missing", $"Executable Alias '{alias}' has no approval.", alias,
+                    $"Run 'agent-mcp executable resolve {alias} --config <file>' and 'executable approve'.");
+            if (shell != record.Classification.Equals("shell", StringComparison.Ordinal))
+                throw Error("executable.classification_changed", $"Executable Alias '{alias}' approval classification does not match sandbox.execution configuration.", alias,
+                    "Revoke and re-approve the Executable Alias using its configured classification.");
+            if (shell && !ExecutableResolver.IsSupportedShell(record.ResolvedPath))
+                throw Error("executable.shell_unsupported", $"Executable Alias '{alias}' does not resolve to a supported Shell.", record.ResolvedPath,
+                    "Select cmd.exe, powershell.exe, or pwsh.exe and explicitly approve it.");
+            string logicalExecutable = Path.IsPathFullyQualified(record.LogicalPath)
+                ? record.LogicalPath : Path.Combine(_baseDirectory, record.LogicalPath);
+            string resolved = ResolvedPath.Resolve(logicalExecutable);
+            if (!resolved.Equals(record.ResolvedPath, StringComparison.OrdinalIgnoreCase))
+                throw Error("executable.resolution_changed", $"Executable Alias '{alias}' resolution changed from '{record.ResolvedPath}' to '{resolved}'.", resolved,
+                    "Review the new Resolved Path and explicitly re-approve the Executable Alias.");
+            string hash = EntryExecutablePolicy.ComputeSha256(resolved);
+            if (!hash.Equals(record.Sha256, StringComparison.OrdinalIgnoreCase))
+                throw Error("executable.hash_changed", $"Executable Alias '{alias}' SHA-256 changed.", resolved,
+                    "Verify the Executable identity and explicitly re-approve it.");
+            string? runtimeRoot = record.RuntimeRoot is null ? null : ResolvedPath.Resolve(record.RuntimeRoot);
+            approvals.Add(new(alias, resolved, hash, shell, runtimeRoot));
+            files.Add(new(resolved, FileCapability.Read | FileCapability.Execute, shell ? "approved_shell_executable" : "approved_entry_executable"));
+            if (runtimeRoot is not null)
+            {
+                runtimeRoots.Add(runtimeRoot);
+                files.Add(new(runtimeRoot, FileCapability.Read | FileCapability.Execute, "runtime_root"));
+            }
+        }
+
+        string system32 = ResolvedPath.Resolve(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "System32"));
+        files.Add(new(system32, FileCapability.Read | FileCapability.Execute, "os_runtime_root"));
+        IReadOnlyList<FilePolicyEntry> normalizedFiles = NormalizeRoots(files);
+        (int memoryMb, int processes, int timeout) = ResourceLimits();
+        IReadOnlyList<(string Host, IReadOnlyList<int> Ports)> network = NetworkAllowances();
+        return new(normalizedFiles, approvals, runtimeRoots.Distinct(StringComparer.OrdinalIgnoreCase).ToArray(),
+            artifactRoots, new((uint)processes, checked((ulong)memoryMb * 1024 * 1024)),
+            _configuration.Sandbox.Network.Access, network, journalDirectory, backupDirectory,
+            checked((long)_configuration.FileEdit.MemoryBackupLimitMb * 1024 * 1024),
+            _configuration.Limits.WholeReadBytes, _configuration.Limits.SearchMaxResults,
+            _configuration.Limits.TailMaxLines, timeout, _configuration.Sandbox.Resources.Profile,
+            ["registryRead", "lpacInstrumentation"]);
+    }
+
+    private ResolutionItem ResolveDirectory(string kind, string logicalPath, string access)
+    {
+        string absolute = Path.IsPathFullyQualified(logicalPath) ? logicalPath : Path.Combine(_baseDirectory, logicalPath);
+        string resolved = ResolvedPath.Resolve(absolute);
+        if (!Directory.Exists(resolved)) throw Error("sandbox.resolved_directory_missing", $"{kind} Resolved Path is not a directory: '{resolved}'.", resolved,
+            "Correct the Logical Path or restore the directory, then confirm the Sandbox Environment Resolution again.");
+        return new(kind, logicalPath, resolved, access);
+    }
+
+    private string Fingerprint()
+    {
+        string json = JsonSerializer.Serialize(_configuration.Sandbox, new JsonSerializerOptions(JsonSerializerDefaults.Web));
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(json)));
+    }
+
+    private IEnumerable<(string Alias, bool Shell)> RequestedAliases() =>
+        _configuration.Sandbox.Execution.Executables.Select(alias => (alias, false))
+            .Concat(_configuration.Sandbox.Execution.Shells.Select(alias => (alias, true)));
+
+    private (int MemoryMb, int Processes, int Timeout) ResourceLimits()
+    {
+        (int memory, int processes, int timeout) = _configuration.Sandbox.Resources.Profile switch
+        {
+            "constrained" => (1024, 4, 300),
+            "normal" => (4096, 16, 1800),
+            "extended" => (8192, 32, 3600),
+            _ => throw new ConfigurationException($"Unsupported Resource Profile '{_configuration.Sandbox.Resources.Profile}'.")
+        };
+        return (_configuration.Sandbox.Resources.MemoryMb ?? memory,
+            _configuration.Sandbox.Resources.ProcessLimit ?? processes,
+            _configuration.Sandbox.Resources.ExecutionTimeoutSeconds ?? timeout);
+    }
+
+    private IReadOnlyList<(string Host, IReadOnlyList<int> Ports)> NetworkAllowances() =>
+        _configuration.Sandbox.Network.Access switch
+        {
+            "none" => [],
+            "local" => _configuration.Sandbox.Network.LocalEndpoints
+                .SelectMany(item => new[] { ("127.0.0.1", (IReadOnlyList<int>)[item.Port]), ("::1", (IReadOnlyList<int>)[item.Port]) }).ToArray(),
+            "restricted" => _configuration.Sandbox.Network.RestrictedEndpoints
+                .Select(item => (item.Host, (IReadOnlyList<int>)item.Ports)).ToArray(),
+            _ => throw new ConfigurationException($"Unsupported Network access '{_configuration.Sandbox.Network.Access}'.")
+        };
+
+    private static IReadOnlyList<FilePolicyEntry> NormalizeRoots(IEnumerable<FilePolicyEntry> input)
+    {
+        FilePolicyEntry[] roots = input.GroupBy(item => ResolvedPath.Resolve(item.Path), StringComparer.OrdinalIgnoreCase)
+            .Select(group => new FilePolicyEntry(group.Key,
+                group.Aggregate(FileCapability.None, (value, item) => value | item.Capabilities),
+                string.Join(',', group.Select(item => item.Origin).Distinct(StringComparer.Ordinal).Order(StringComparer.Ordinal)))).ToArray();
+        foreach (FilePolicyEntry parent in roots)
+        foreach (FilePolicyEntry child in roots)
+        {
+            if (ReferenceEquals(parent, child) || !IsBelow(child.Path, parent.Path)) continue;
+            if ((parent.Capabilities & child.Capabilities) != parent.Capabilities)
+                throw new ConfigurationException($"Nested Filesystem Root '{child.Path}' is narrower than inherited capabilities from '{parent.Path}' and cannot be enforced without widening it.");
+        }
+        return roots;
+    }
+
+    private static bool Equivalent(IReadOnlyList<ResolutionItem> left, IReadOnlyList<ResolutionItem> right) =>
+        left.OrderBy(Key, StringComparer.OrdinalIgnoreCase).SequenceEqual(right.OrderBy(Key, StringComparer.OrdinalIgnoreCase));
+    private static string Key(ResolutionItem item) => $"{item.Kind}|{item.LogicalPath}|{item.ResolvedPath}|{item.Access}";
+    private static bool IsBelow(string child, string parent) => child.StartsWith(parent.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);
+    private static ConfigurationException Error(string code, string message, string? target, string resolution) =>
+        new(message, code: code, category: "sandbox", target: target, resolution: resolution);
+}
+
+public static class ExecutableResolver
+{
+    public static bool IsSupportedShell(string path) => Path.GetFileName(path).ToLowerInvariant() is "cmd.exe" or "powershell.exe" or "pwsh.exe";
+
+    public static IReadOnlyList<string> ResolveCandidates(string alias, string? explicitPath)
+    {
+        if (!string.IsNullOrWhiteSpace(explicitPath))
+        {
+            string resolved = ResolvedPath.Resolve(explicitPath);
+            if (!File.Exists(resolved)) throw new ConfigurationException($"Executable Resolved Path is not a file: '{resolved}'.");
+            return [resolved];
+        }
+        string fileName = Path.HasExtension(alias) ? alias : alias + ".exe";
+        string[] candidates = (Environment.GetEnvironmentVariable("PATH") ?? string.Empty)
+            .Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+            .Select(directory => Path.Combine(directory, fileName)).Where(File.Exists)
+            .Select(path => ResolvedPath.Resolve(path)).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+        if (candidates.Length == 0) throw new ConfigurationException($"No PATH candidate was found for Executable Alias '{alias}'. Use --path <path>.");
+        return candidates;
+    }
+}
+
+internal static class AtomicJson
+{
+    public static void Write<T>(string path, T value, JsonSerializerOptions options)
+    {
+        string temporary = path + "." + Guid.NewGuid().ToString("N") + ".tmp";
+        try
+        {
+            using (var stream = new FileStream(temporary, FileMode.CreateNew, FileAccess.Write, FileShare.None, 4096, FileOptions.WriteThrough))
+            {
+                JsonSerializer.Serialize(stream, value, options);
+                stream.Flush(flushToDisk: true);
+            }
+            File.Move(temporary, path, overwrite: true);
+        }
+        finally
+        {
+            if (File.Exists(temporary)) File.Delete(temporary);
+        }
+    }
+}