feat: revise sandbox usability around semantic policy and LPAC process trees

Rewrite the specification and design vocabulary around User Sandbox Configuration, Environment Resolution, Executable Approval, Effective Sandbox Policy, and Windows Enforcement. Move the Internal Tool catalog to the design without treating its count as a requirement, and update README, implementation planning, traceability, audit history, prompts, and the Python skill.

Introduce schema_version 1 profiles, workspaces, mounts, executable aliases, network modes, and resource presets. Add local override merging, resolution and approval stores with atomic user-only persistence, fail-closed fingerprints, localized diagnostics, and executable/sandbox management CLI commands.

Change Windows execution to LPAC entry approval with inherited descendant confinement. Separate read and execute ACLs, preserve protected OS DACLs, apply Job process/memory/timeout limits to the tree, enforce WFP network modes, prevent credential environment inheritance, disable out-of-tree MSBuild reuse, and harden transactional ACL/recovery cleanup.

Isolate planning prompts from execution instructions, reject split coding plans that cannot satisfy task-scoped evidence, preserve configured thinking, and prevent optional task_update failures from corrupting completion checks.

Add and update configuration, resolution, approval, LPAC, descendant, readonly/development, Registry/COM, WFP, recovery, .NET/Python/PowerShell process-tree, and Operational E2E coverage. Publish reproducible bundles while preserving deployment-local configuration, prompts, skills, logs, state, approvals, and resolutions.

1 files changed, 61 insertions, 13 deletions

diff --git a/src/Agent.Windows/Security/TaskAclManager.cs b/src/Agent.Windows/Security/TaskAclManager.cs
index 2b091a6..be0080d 100644
--- a/src/Agent.Windows/Security/TaskAclManager.cs
+++ b/src/Agent.Windows/Security/TaskAclManager.cs
@@ -10,27 +10,64 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
 {
     public AclSnapshot Grant(Guid taskId, string path, FileCapability capabilities)
     {
-        string canonical = CanonicalPath.Resolve(path);
+        string canonical = ResolvedPath.Resolve(path);
         FileSystemSecurity security = ReadSecurity(canonical);
         byte[] original = security.GetSecurityDescriptorBinaryForm();
         Guid? journalEntry = journal?.Prepare("acl", canonical, new Dictionary<string, string>
         {
             ["security_descriptor"] = Convert.ToBase64String(original)
         });
-        FileSystemRights rights = ToRights(capabilities);
-        if (rights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
         bool directory = Directory.Exists(canonical);
-        var rule = new FileSystemAccessRule(appContainerSid, rights,
-            directory ? InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit : InheritanceFlags.None,
-            PropagationFlags.None, AccessControlType.Allow);
-        security.AddAccessRule(rule);
-        WriteSecurity(canonical, security);
-        if (journalEntry is not null) journal!.MarkApplied(journalEntry.Value);
+        FileSystemRights auditRights;
+        if (directory)
+        {
+            FileSystemRights directoryRights = ToDirectoryRights(capabilities);
+            FileSystemRights fileRights = ToFileRights(capabilities);
+            if (directoryRights == 0 || fileRights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, directoryRights,
+                InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, fileRights,
+                InheritanceFlags.ObjectInherit, PropagationFlags.InheritOnly, AccessControlType.Allow));
+            auditRights = directoryRights | fileRights;
+        }
+        else
+        {
+            auditRights = ToFileRights(capabilities);
+            if (auditRights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, auditRights,
+                InheritanceFlags.None, PropagationFlags.None, AccessControlType.Allow));
+        }
+        try
+        {
+            WriteSecurity(canonical, security);
+            if (journalEntry is not null) journal!.MarkApplied(journalEntry.Value);
+        }
+        catch (Exception applyFailure)
+        {
+            try
+            {
+                byte[] current = ReadSecurity(canonical).GetSecurityDescriptorBinaryForm();
+                if (!current.AsSpan().SequenceEqual(original))
+                {
+                    FileSystemSecurity rollback = Directory.Exists(canonical) ? new DirectorySecurity() : new FileSecurity();
+                    rollback.SetSecurityDescriptorBinaryForm(original, AccessControlSections.Access);
+                    WriteSecurity(canonical, rollback);
+                    byte[] restored = ReadSecurity(canonical).GetSecurityDescriptorBinaryForm();
+                    if (!restored.AsSpan().SequenceEqual(original)) throw new InvalidOperationException("ACL rollback verification failed.");
+                }
+                if (journalEntry is not null) journal!.MarkCleaned(journalEntry.Value);
+            }
+            catch (Exception rollbackFailure)
+            {
+                throw new AggregateException("ACL apply failed and immediate rollback did not reach a verified clean state.", applyFailure, rollbackFailure);
+            }
+            throw;
+        }
         audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.apply", "applied", new Dictionary<string, string>
         {
             ["path"] = canonical,
             ["sid"] = appContainerSid.Value,
-            ["rights"] = rights.ToString(),
+            ["rights"] = auditRights.ToString(),
             ["scope"] = directory ? "root_inheritance" : "file"
         }));
         return new(canonical, original, journalEntry);
@@ -55,12 +92,23 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
         else FileSystemAclExtensions.SetAccessControl(new FileInfo(path), (FileSecurity)security);
     }
 
-    private static FileSystemRights ToRights(FileCapability capabilities)
+    private static FileSystemRights ToFileRights(FileCapability capabilities)
     {
         FileSystemRights rights = 0;
-        if ((capabilities & FileCapability.Read) != 0) rights |= FileSystemRights.ReadAndExecute | FileSystemRights.ListDirectory;
+        if ((capabilities & FileCapability.Read) != 0)
+            rights |= FileSystemRights.ReadData | FileSystemRights.ReadAttributes | FileSystemRights.ReadExtendedAttributes | FileSystemRights.ReadPermissions;
         if ((capabilities & FileCapability.Write) != 0) rights |= FileSystemRights.Write;
-        if ((capabilities & FileCapability.Execute) != 0) rights |= FileSystemRights.ReadAndExecute;
+        if ((capabilities & FileCapability.Execute) != 0) rights |= FileSystemRights.ExecuteFile | FileSystemRights.ReadData | FileSystemRights.ReadAttributes;
+        if ((capabilities & FileCapability.Delete) != 0) rights |= FileSystemRights.Delete;
+        return rights;
+    }
+
+    private static FileSystemRights ToDirectoryRights(FileCapability capabilities)
+    {
+        FileSystemRights rights = FileSystemRights.Traverse | FileSystemRights.ReadAttributes | FileSystemRights.ReadPermissions;
+        if ((capabilities & FileCapability.Read) != 0) rights |= FileSystemRights.ListDirectory | FileSystemRights.ReadExtendedAttributes;
+        if ((capabilities & FileCapability.Write) != 0) rights |= FileSystemRights.CreateFiles | FileSystemRights.CreateDirectories |
+            FileSystemRights.WriteAttributes | FileSystemRights.WriteExtendedAttributes;
         if ((capabilities & FileCapability.Delete) != 0) rights |= FileSystemRights.Delete | FileSystemRights.DeleteSubdirectoriesAndFiles;
         return rights;
     }