feat: revise sandbox usability around semantic policy and LPAC process trees

Rewrite the specification and design vocabulary around User Sandbox Configuration, Environment Resolution, Executable Approval, Effective Sandbox Policy, and Windows Enforcement. Move the Internal Tool catalog to the design without treating its count as a requirement, and update README, implementation planning, traceability, audit history, prompts, and the Python skill.

Introduce schema_version 1 profiles, workspaces, mounts, executable aliases, network modes, and resource presets. Add local override merging, resolution and approval stores with atomic user-only persistence, fail-closed fingerprints, localized diagnostics, and executable/sandbox management CLI commands.

Change Windows execution to LPAC entry approval with inherited descendant confinement. Separate read and execute ACLs, preserve protected OS DACLs, apply Job process/memory/timeout limits to the tree, enforce WFP network modes, prevent credential environment inheritance, disable out-of-tree MSBuild reuse, and harden transactional ACL/recovery cleanup.

Isolate planning prompts from execution instructions, reject split coding plans that cannot satisfy task-scoped evidence, preserve configured thinking, and prevent optional task_update failures from corrupting completion checks.

Add and update configuration, resolution, approval, LPAC, descendant, readonly/development, Registry/COM, WFP, recovery, .NET/Python/PowerShell process-tree, and Operational E2E coverage. Publish reproducible bundles while preserving deployment-local configuration, prompts, skills, logs, state, approvals, and resolutions.

8 files changed, 381 insertions, 134 deletions

diff --git a/src/Agent.Windows/NativeMethods.txt b/src/Agent.Windows/NativeMethods.txt
index 471b47d..61efc53 100644
--- a/src/Agent.Windows/NativeMethods.txt
+++ b/src/Agent.Windows/NativeMethods.txt
@@ -4,18 +4,25 @@ CreateJobObject
 CreateProcess
 DeleteProcThreadAttributeList
 GetExitCodeProcess
+GetTokenInformation
 InitializeProcThreadAttributeList
+IsProcessInJob
 JOBOBJECT_EXTENDED_LIMIT_INFORMATION
 JOB_OBJECT_LIMIT
-PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY
 PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+PROC_THREAD_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY
 PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+DeriveCapabilitySidsFromName
+LocalFree
+OpenProcessToken
 ResumeThread
 SetHandleInformation
 SetInformationJobObject
 TerminateJobObject
 UpdateProcThreadAttribute
 STARTUPINFOEXW
+TOKEN_INFORMATION_CLASS
+TOKEN_APPCONTAINER_INFORMATION
 WaitForSingleObject
 Windows.Win32.NetworkManagement.WindowsFilteringPlatform.FwpmEngineOpen0
 Windows.Win32.NetworkManagement.WindowsFilteringPlatform.FwpmEngineClose0
diff --git a/src/Agent.Windows/Network/TaskNetworkPolicy.cs b/src/Agent.Windows/Network/TaskNetworkPolicy.cs
index bc4d291..9f78b3d 100644
--- a/src/Agent.Windows/Network/TaskNetworkPolicy.cs
+++ b/src/Agent.Windows/Network/TaskNetworkPolicy.cs
@@ -11,24 +11,25 @@ public sealed class TaskNetworkPolicy : IDisposable
     private readonly ISecurityAuditSink _audit;
     private readonly Guid _entryId;
     private readonly SecurityIdentifier _appContainerSid;
-    private readonly Guid _loopbackEntryId;
+    private readonly Guid? _loopbackEntryId;
     private readonly bool _loopbackAdded;
     private readonly Guid? _sessionId;
     private bool _disposed;
 
     private TaskNetworkPolicy(WfpDynamicSession session, TaskResourceJournal journal, ISecurityAuditSink audit, Guid entryId,
-        SecurityIdentifier appContainerSid, Guid loopbackEntryId, bool loopbackAdded, Guid? sessionId)
+        SecurityIdentifier appContainerSid, Guid? loopbackEntryId, bool loopbackAdded, Guid? sessionId)
     {
         _session = session; _journal = journal; _audit = audit; _entryId = entryId;
         _appContainerSid = appContainerSid; _loopbackEntryId = loopbackEntryId; _loopbackAdded = loopbackAdded;
         _sessionId = sessionId;
     }
 
-    public static TaskNetworkPolicy Apply(TaskResourceJournal journal, SecurityIdentifier appContainerSid, IReadOnlyList<NetworkEndpoint> allowances, ISecurityAuditSink audit, Guid? sessionId = null)
+    public static TaskNetworkPolicy Apply(TaskResourceJournal journal, SecurityIdentifier appContainerSid, IReadOnlyList<NetworkEndpoint> allowances,
+        ISecurityAuditSink audit, Guid? sessionId = null, bool enableLoopback = true)
     {
-        bool originallyExempt = LoopbackExemption.Contains(appContainerSid);
-        Guid loopbackEntryId = journal.Prepare("network.loopback_exemption", appContainerSid.Value,
-            new Dictionary<string, string> { ["originally_present"] = originallyExempt.ToString() });
+        bool originallyExempt = enableLoopback && LoopbackExemption.Contains(appContainerSid);
+        Guid? loopbackEntryId = enableLoopback ? journal.Prepare("network.loopback_exemption", appContainerSid.Value,
+            new Dictionary<string, string> { ["originally_present"] = originallyExempt.ToString() }) : null;
         bool loopbackAdded = false;
         Guid entryId = journal.Prepare("wfp.dynamic", appContainerSid.Value, new Dictionary<string, string>
         {
@@ -37,15 +38,18 @@ public sealed class TaskNetworkPolicy : IDisposable
         WfpDynamicSession session = WfpDynamicSession.Open();
         try
         {
-            loopbackAdded = LoopbackExemption.Ensure(appContainerSid);
-            journal.MarkApplied(loopbackEntryId, new Dictionary<string, string> { ["added"] = loopbackAdded.ToString() });
+            if (enableLoopback)
+            {
+                loopbackAdded = LoopbackExemption.Ensure(appContainerSid);
+                journal.MarkApplied(loopbackEntryId!.Value, new Dictionary<string, string> { ["added"] = loopbackAdded.ToString() });
+            }
             IReadOnlyList<ulong> ids = session.ApplyDefaultBlock(appContainerSid, allowances);
             journal.MarkApplied(entryId, new Dictionary<string, string> { ["filter_ids"] = string.Join(',', ids) });
             audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "network.rule.apply", "applied", new Dictionary<string, string>
             {
                 ["ipv4_ipv6_default_block"] = "true", ["filter_count"] = ids.Count.ToString(), ["session"] = "dynamic"
             }, SessionId: sessionId));
-            audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "network.loopback.apply", loopbackAdded ? "added" : "preserved",
+            if (enableLoopback) audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "network.loopback.apply", loopbackAdded ? "added" : "preserved",
                 new Dictionary<string, string> { ["app_container_sid"] = appContainerSid.Value }, SessionId: sessionId));
             return new(session, journal, audit, entryId, appContainerSid, loopbackEntryId, loopbackAdded, sessionId);
         }
@@ -54,7 +58,7 @@ public sealed class TaskNetworkPolicy : IDisposable
             session.Dispose();
             journal.MarkCleaned(entryId);
             if (loopbackAdded) LoopbackExemption.Remove(appContainerSid);
-            journal.MarkCleaned(loopbackEntryId);
+            if (loopbackEntryId is not null) journal.MarkCleaned(loopbackEntryId.Value);
             throw;
         }
     }
@@ -66,9 +70,9 @@ public sealed class TaskNetworkPolicy : IDisposable
         _session.Dispose();
         _journal.MarkCleaned(_entryId);
         if (_loopbackAdded) LoopbackExemption.Remove(_appContainerSid);
-        _journal.MarkCleaned(_loopbackEntryId);
+        if (_loopbackEntryId is not null) _journal.MarkCleaned(_loopbackEntryId.Value);
         _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "network.rule.remove", "removed", new Dictionary<string, string> { ["residual_filters"] = "0" }, SessionId: _sessionId));
-        _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "network.loopback.remove", "removed",
+        if (_loopbackEntryId is not null) _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "network.loopback.remove", "removed",
             new Dictionary<string, string> { ["residual_exemptions"] = LoopbackExemption.Contains(_appContainerSid) ? "preexisting" : "0" }, SessionId: _sessionId));
         _disposed = true;
     }
diff --git a/src/Agent.Windows/Recovery/TransactionalFileEditor.cs b/src/Agent.Windows/Recovery/TransactionalFileEditor.cs
index 25c949d..ff4ac5a 100644
--- a/src/Agent.Windows/Recovery/TransactionalFileEditor.cs
+++ b/src/Agent.Windows/Recovery/TransactionalFileEditor.cs
@@ -11,7 +11,7 @@ public sealed class TransactionalFileEditor(TaskResourceJournal journal, string
 
     public FileEditTransaction Replace(string path, ReadOnlySpan<byte> content, string? expectedSha256 = null)
     {
-        string canonical = CanonicalPath.Resolve(path, requireExisting: false);
+        string canonical = ResolvedPath.Resolve(path, requireExisting: false);
         bool existed = File.Exists(canonical);
         byte[]? original = existed ? File.ReadAllBytes(canonical) : null;
         string originalHash = original is null ? string.Empty : Convert.ToHexString(SHA256.HashData(original));
@@ -45,7 +45,7 @@ public sealed class TransactionalFileEditor(TaskResourceJournal journal, string
 
     public FileDeleteTransaction Delete(string path, string? expectedSha256 = null)
     {
-        string canonical = CanonicalPath.Resolve(path);
+        string canonical = ResolvedPath.Resolve(path);
         byte[] original = File.ReadAllBytes(canonical);
         string originalHash = Convert.ToHexString(SHA256.HashData(original));
         if (expectedSha256 is not null && !originalHash.Equals(NormalizeHash(expectedSha256), StringComparison.Ordinal))
@@ -71,7 +71,7 @@ public sealed class TransactionalFileEditor(TaskResourceJournal journal, string
 
     public DirectoryMkdirTransaction Mkdir(string path)
     {
-        string canonical = CanonicalPath.Resolve(path, requireExisting: false);
+        string canonical = ResolvedPath.Resolve(path, requireExisting: false);
         bool existed = Directory.Exists(canonical);
         if (existed) throw new InvalidOperationException($"Directory already exists: '{canonical}'.");
         if (File.Exists(canonical)) throw new InvalidOperationException($"A file exists at the target path: '{canonical}'.");
@@ -83,7 +83,7 @@ public sealed class TransactionalFileEditor(TaskResourceJournal journal, string
 
     public DirectoryRmdirTransaction Rmdir(string path)
     {
-        string canonical = CanonicalPath.Resolve(path);
+        string canonical = ResolvedPath.Resolve(path);
         if (!Directory.Exists(canonical)) throw new DirectoryNotFoundException($"Directory does not exist: '{canonical}'.");
         if (Directory.EnumerateFileSystemEntries(canonical, "*", SearchOption.TopDirectoryOnly).Any())
             throw new ToolValidationException("Directory is not empty. Remove contents first before removing the directory.");
@@ -95,8 +95,8 @@ public sealed class TransactionalFileEditor(TaskResourceJournal journal, string
 
     public FileRenameTransaction Rename(string sourcePath, string destinationPath)
     {
-        string source = CanonicalPath.Resolve(sourcePath);
-        string destination = CanonicalPath.Resolve(destinationPath, requireExisting: false);
+        string source = ResolvedPath.Resolve(sourcePath);
+        string destination = ResolvedPath.Resolve(destinationPath, requireExisting: false);
         if (!File.Exists(source)) throw new FileNotFoundException($"Source file does not exist: '{source}'.");
         if (File.Exists(destination)) throw new ToolValidationException($"Destination already exists: '{destination}'. Rename overwrite is not allowed.");
         if (!source.StartsWith(System.IO.Path.GetPathRoot(source)!, StringComparison.OrdinalIgnoreCase) ||
diff --git a/src/Agent.Windows/Security/ExecutablePolicy.cs b/src/Agent.Windows/Security/ExecutablePolicy.cs
index 6c72724..02306fd 100644
--- a/src/Agent.Windows/Security/ExecutablePolicy.cs
+++ b/src/Agent.Windows/Security/ExecutablePolicy.cs
@@ -2,46 +2,91 @@ using System.Security.Cryptography;
 
 namespace Agent.Windows.Security;
 
-public sealed record ExecutableApproval(string Path, string Sha256);
-public sealed record VerifiedExecutable(string CanonicalPath, string Sha256);
+public enum EntryExecutableClassification { ApprovedEntryExecutable, ApprovedShellExecutable, RuntimeComponent, WorkspaceArtifact }
 
-public sealed class ExecutablePolicy(IEnumerable<ExecutableApproval> approvals, bool allowShell)
+public sealed record ApprovedEntryExecutable(string Alias, string ResolvedPath, string Sha256, bool IsShell, string? RuntimeRoot);
+public sealed record VerifiedEntryExecutable(string ResolvedPath, string Sha256, EntryExecutableClassification Classification, string? Alias = null);
+
+public sealed class EntryExecutablePolicy(
+    IEnumerable<ApprovedEntryExecutable> approvals,
+    IEnumerable<string> runtimeRoots,
+    IEnumerable<string> artifactRoots)
 {
-    private readonly IReadOnlyDictionary<string, string> _approvals = approvals.ToDictionary(
-        approval => CanonicalPath.Resolve(approval.Path), approval => NormalizeHash(approval.Sha256), StringComparer.OrdinalIgnoreCase);
+    private readonly IReadOnlyDictionary<string, ApprovedEntryExecutable> _aliases = approvals.ToDictionary(
+        approval => approval.Alias, Normalize, StringComparer.OrdinalIgnoreCase);
+    private readonly string[] _runtimeRoots = runtimeRoots.Select(path => ResolvedPath.Resolve(path)).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+    private readonly string[] _artifactRoots = artifactRoots.Select(path => ResolvedPath.Resolve(path)).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
 
-    public VerifiedExecutable Verify(string executable)
+    public VerifiedEntryExecutable VerifyEntry(string executable, string? baseDirectory = null)
     {
-        string canonical = CanonicalPath.Resolve(executable);
-        if (!allowShell && IsShell(canonical)) throw new SandboxPolicyException("process.shell_denied", "Shell execution is disabled.", "process", canonical, "execute", "sandbox.process.allow_shell");
-        if (!_approvals.TryGetValue(canonical, out string? approvedHash)) throw new SandboxPolicyException("process.path_denied", $"Executable path is not approved: '{canonical}'. Add its canonical path and SHA-256 to sandbox.process.approvals.", "process", canonical, "execute", "sandbox.process.approvals");
-        using FileStream stream = new(canonical, FileMode.Open, FileAccess.Read, FileShare.Read);
-        string actualHash = Convert.ToHexString(SHA256.HashData(stream));
-        if (!CryptographicOperations.FixedTimeEquals(Convert.FromHexString(approvedHash), Convert.FromHexString(actualHash)))
-            throw new SandboxPolicyException("process.hash_denied", $"Executable SHA-256 does not match its approval: '{canonical}'. Recalculate SHA-256 and update sandbox.process.approvals.", "process", canonical, "execute", "sandbox.process.approvals");
-        return new(canonical, actualHash);
+        if (_aliases.TryGetValue(executable, out ApprovedEntryExecutable? byAlias)) return VerifyApproved(byAlias);
+        string candidate = Path.IsPathFullyQualified(executable) ? executable : Path.Combine(baseDirectory ?? Environment.CurrentDirectory, executable);
+        string resolved;
+        try { resolved = ResolvedPath.Resolve(candidate); }
+        catch (FileNotFoundException)
+        {
+            throw new SandboxPolicyException("process.alias_or_path_unknown", $"Executable Alias or Logical Path does not resolve to an existing file: '{executable}'.",
+                "process", Path.GetFullPath(candidate), "execute", "Use a configured Executable Alias or an existing Runtime Component/development Workspace Artifact path.");
+        }
+        if (_runtimeRoots.Any(root => IsAtOrBelow(resolved, root)))
+            return new(resolved, ComputeSha256(resolved), EntryExecutableClassification.RuntimeComponent);
+        if (_artifactRoots.Any(root => IsAtOrBelow(resolved, root)))
+            return new(resolved, ComputeSha256(resolved), EntryExecutableClassification.WorkspaceArtifact);
+        throw new SandboxPolicyException("process.entry_unknown", $"External Unknown Executable cannot be started as an Entry Process: '{resolved}'.",
+            "process", resolved, "execute", "Configure an Executable Alias and approve it, or place the Workspace Artifact in a development Workspace.");
     }
 
-    public static string? ManagedEntryPoint(string executable, IReadOnlyList<string> arguments)
+    public string? ManagedEntryPoint(string executable, IReadOnlyList<string> arguments, string? baseDirectory = null)
     {
-        if (!Path.GetFileName(executable).Equals("dotnet.exe", StringComparison.OrdinalIgnoreCase) || arguments.Count == 0) return null;
+        string executablePath = Path.IsPathFullyQualified(executable) ? executable : Path.Combine(baseDirectory ?? Environment.CurrentDirectory, executable);
+        string resolved = _aliases.TryGetValue(executable, out ApprovedEntryExecutable? approval) ? approval.ResolvedPath : ResolvedPath.Resolve(executablePath);
+        if (!Path.GetFileName(resolved).Equals("dotnet.exe", StringComparison.OrdinalIgnoreCase) || arguments.Count == 0) return null;
         if (arguments[0].Equals("exec", StringComparison.OrdinalIgnoreCase))
         {
             if (arguments.Count < 2 || arguments[1].StartsWith("-", StringComparison.Ordinal))
                 throw new SandboxPolicyException("process.managed_entry_invalid", "dotnet exec requires an explicit managed entry assembly as its next argument.");
-            return arguments[1];
+            return ResolveArgument(arguments[1], baseDirectory);
         }
-        return arguments[0].EndsWith(".dll", StringComparison.OrdinalIgnoreCase) ? arguments[0] : null;
+        return arguments[0].EndsWith(".dll", StringComparison.OrdinalIgnoreCase) ? ResolveArgument(arguments[0], baseDirectory) : null;
+    }
+
+    public void VerifyManagedEntryPoint(string path)
+    {
+        string resolved = ResolvedPath.Resolve(path);
+        if (_runtimeRoots.Any(root => IsAtOrBelow(resolved, root)) || _artifactRoots.Any(root => IsAtOrBelow(resolved, root))) return;
+        throw new SandboxPolicyException("process.managed_entry_unknown", $"Managed Entry Artifact is outside every confirmed Runtime Root and development Workspace: '{resolved}'.",
+            "process", resolved, "execute", "Place the artifact in a development Workspace or confirm its Runtime Root.");
     }
 
     public static string ComputeSha256(string executable)
     {
-        using FileStream stream = new(CanonicalPath.Resolve(executable), FileMode.Open, FileAccess.Read, FileShare.Read);
+        using FileStream stream = new(ResolvedPath.Resolve(executable), FileMode.Open, FileAccess.Read, FileShare.Read);
         return Convert.ToHexString(SHA256.HashData(stream));
     }
 
-    private static bool IsShell(string path) => Path.GetFileName(path) is string name &&
-        (name.Equals("cmd.exe", StringComparison.OrdinalIgnoreCase) || name.Equals("powershell.exe", StringComparison.OrdinalIgnoreCase) || name.Equals("pwsh.exe", StringComparison.OrdinalIgnoreCase));
+    private static ApprovedEntryExecutable Normalize(ApprovedEntryExecutable approval) => approval with
+    {
+        ResolvedPath = ResolvedPath.Resolve(approval.ResolvedPath),
+        Sha256 = NormalizeHash(approval.Sha256),
+        RuntimeRoot = approval.RuntimeRoot is null ? null : ResolvedPath.Resolve(approval.RuntimeRoot)
+    };
+
+    private static VerifiedEntryExecutable VerifyApproved(ApprovedEntryExecutable approval)
+    {
+        string resolved = ResolvedPath.Resolve(approval.ResolvedPath);
+        string actualHash = ComputeSha256(resolved);
+        if (!CryptographicOperations.FixedTimeEquals(Convert.FromHexString(approval.Sha256), Convert.FromHexString(actualHash)))
+            throw new SandboxPolicyException("process.hash_denied", $"Approved Entry Executable SHA-256 changed: '{resolved}'.",
+                "process", resolved, "execute", $"Re-run executable approve for Alias '{approval.Alias}'.");
+        return new(resolved, actualHash, approval.IsShell ? EntryExecutableClassification.ApprovedShellExecutable : EntryExecutableClassification.ApprovedEntryExecutable, approval.Alias);
+    }
+
+    private static bool IsAtOrBelow(string candidate, string root) =>
+        candidate.Equals(root, StringComparison.OrdinalIgnoreCase) ||
+        candidate.StartsWith(root.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);
+    private static string ResolveArgument(string path, string? baseDirectory) => Path.IsPathFullyQualified(path)
+        ? path : Path.GetFullPath(path, baseDirectory ?? Environment.CurrentDirectory);
+
     private static string NormalizeHash(string hash)
     {
         string normalized = hash.Replace("-", string.Empty, StringComparison.Ordinal).Trim().ToUpperInvariant();
diff --git a/src/Agent.Windows/Security/PathPolicy.cs b/src/Agent.Windows/Security/PathPolicy.cs
index 3de4804..67c7340 100644
--- a/src/Agent.Windows/Security/PathPolicy.cs
+++ b/src/Agent.Windows/Security/PathPolicy.cs
@@ -3,23 +3,23 @@ namespace Agent.Windows.Security;
 [Flags]
 public enum FileCapability { None = 0, Read = 1, Write = 2, Execute = 4, Delete = 8 }
 
-public sealed record FilePolicyEntry(string Path, FileCapability Capabilities);
+public sealed record FilePolicyEntry(string Path, FileCapability Capabilities, string Origin = "unspecified");
 
 public sealed class PathPolicy(IEnumerable<FilePolicyEntry> entries)
 {
-    private readonly IReadOnlyList<FilePolicyEntry> _entries = entries.Select(entry => entry with { Path = CanonicalPath.Resolve(entry.Path, requireExisting: false) }).ToArray();
+    private readonly IReadOnlyList<FilePolicyEntry> _entries = entries.Select(entry => entry with { Path = ResolvedPath.Resolve(entry.Path, requireExisting: false) }).ToArray();
 
     public bool IsAllowed(string path, FileCapability required)
     {
-        string canonical = CanonicalPath.Resolve(path, requireExisting: required is FileCapability.Read or FileCapability.Execute or FileCapability.Delete);
+        string canonical = ResolvedPath.Resolve(path, requireExisting: required is FileCapability.Read or FileCapability.Execute or FileCapability.Delete);
         return _entries.Any(entry => IsAtOrBelow(canonical, entry.Path) && (entry.Capabilities & required) == required);
     }
 
     public void Demand(string path, FileCapability required)
     {
         if (!IsAllowed(path, required))
-            throw new SandboxPolicyException("policy.deny", $"'{path}' is not approved for {required}. Add the canonical path to sandbox.filesystem.{required.ToString().ToLowerInvariant()} and restart the server.",
-                "filesystem", Path.GetFullPath(path), required.ToString().ToLowerInvariant(), $"sandbox.filesystem.{required.ToString().ToLowerInvariant()}");
+            throw new SandboxPolicyException("policy.deny", $"Resolved Path '{path}' is outside the Effective Sandbox Policy for {required}.",
+                "filesystem", Path.GetFullPath(path), required.ToString().ToLowerInvariant(), "Confirm a Workspace or Mount that grants the required Filesystem Capability, then restart the server.");
     }
 
     private static bool IsAtOrBelow(string candidate, string root) =>
@@ -27,7 +27,7 @@ public sealed class PathPolicy(IEnumerable<FilePolicyEntry> entries)
         candidate.StartsWith(root.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);
 }
 
-public static class CanonicalPath
+public static class ResolvedPath
 {
     public static string Resolve(string path, bool requireExisting = true)
     {
@@ -35,21 +35,34 @@ public static class CanonicalPath
         string fullPath = Path.GetFullPath(path);
         string? root = Path.GetPathRoot(fullPath);
         if (string.IsNullOrEmpty(root)) throw new SandboxPolicyException("path.invalid", "Path has no filesystem root.");
+        if (root.StartsWith("\\\\", StringComparison.Ordinal))
+            throw new SandboxPolicyException("path.non_local", "Only local filesystem paths are supported.", "filesystem", fullPath, null, "Select a local Workspace, Mount, Runtime Root, or Executable.");
         string current = root;
+        var visited = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
         foreach (string segment in fullPath[root.Length..].Split(Path.DirectorySeparatorChar, StringSplitOptions.RemoveEmptyEntries))
         {
             current = Path.Combine(current, segment);
             if (!File.Exists(current) && !Directory.Exists(current)) continue;
-            if ((File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
+            while ((File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
             {
+                string reparsePath = Path.GetFullPath(current);
+                if (!visited.Add(reparsePath))
+                    throw new SandboxPolicyException("path.reparse_cycle", $"Reparse resolution cycle detected at '{reparsePath}'.", "filesystem", reparsePath, null, "Remove the reparse cycle.");
                 FileSystemInfo info = Directory.Exists(current) ? new DirectoryInfo(current) : new FileInfo(current);
-                string? target = info.ResolveLinkTarget(returnFinalTarget: true)?.FullName ?? info.LinkTarget;
-                throw new SandboxPolicyException("path.reparse", $"Reparse points are not allowed: component='{current}'. Approve the resolved canonical target{(string.IsNullOrWhiteSpace(target) ? string.Empty : $" '{Path.GetFullPath(target)}'")} instead.",
-                    "filesystem", current, null, string.IsNullOrWhiteSpace(target) ? "sandbox.filesystem" : Path.GetFullPath(target));
+                string? target;
+                try { target = info.ResolveLinkTarget(returnFinalTarget: false)?.FullName; }
+                catch (IOException ex)
+                {
+                    throw new SandboxPolicyException("path.reparse_unresolved", $"Could not resolve reparse component '{current}': {ex.Message}",
+                        "filesystem", current, null, "Repair or remove the reparse point.");
+                }
+                if (string.IsNullOrWhiteSpace(target))
+                    throw new SandboxPolicyException("path.reparse_unresolved", $"Could not resolve reparse component '{current}'.", "filesystem", current, null, "Repair or remove the reparse point.");
+                current = Path.GetFullPath(target);
             }
         }
-        if (requireExisting && !File.Exists(fullPath) && !Directory.Exists(fullPath)) throw new FileNotFoundException("Approved path does not exist.", fullPath);
-        return Path.TrimEndingDirectorySeparator(fullPath);
+        if (requireExisting && !File.Exists(current) && !Directory.Exists(current)) throw new FileNotFoundException("Resolved Path does not exist.", current);
+        return Path.TrimEndingDirectorySeparator(current);
     }
 }
 
diff --git a/src/Agent.Windows/Security/RestrictedProcessLauncher.cs b/src/Agent.Windows/Security/RestrictedProcessLauncher.cs
index 687af94..c3a19da 100644
--- a/src/Agent.Windows/Security/RestrictedProcessLauncher.cs
+++ b/src/Agent.Windows/Security/RestrictedProcessLauncher.cs
@@ -14,21 +14,27 @@ namespace Agent.Windows.Security;
 public sealed record RestrictedProcessResult(uint ProcessId, uint ExitCode, string StandardOutput, string StandardError);
 public sealed record SandboxJobLimits(uint MaxProcesses = 16, ulong MaxJobMemoryBytes = 4UL * 1024 * 1024 * 1024);
 
-public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executablePolicy, ISecurityAuditSink audit, SecurityIdentifier? appContainerSid = null, SandboxJobLimits? jobLimits = null)
+public sealed unsafe class RestrictedProcessLauncher(EntryExecutablePolicy executablePolicy, ISecurityAuditSink audit, SecurityIdentifier? appContainerSid = null,
+    SandboxJobLimits? jobLimits = null, bool allowNetwork = false)
 {
-    private const uint ProcessCreationChildProcessRestricted = 0x1;
+    private const uint ProcessCreationAllApplicationPackagesOptOut = 0x1;
     private readonly SandboxJobLimits _jobLimits = jobLimits ?? new();
 
     public RestrictedProcessResult Run(Guid taskId, string executable, IReadOnlyList<string> arguments, string workingDirectory, TimeSpan timeout,
-        string? standardInput = null, Guid? sessionId = null)
+        string? standardInput = null, Guid? sessionId = null) =>
+        Run(taskId, executable, arguments, workingDirectory, timeout, standardInput, sessionId, CancellationToken.None);
+
+    public RestrictedProcessResult Run(Guid taskId, string executable, IReadOnlyList<string> arguments, string workingDirectory, TimeSpan timeout,
+        string? standardInput, Guid? sessionId, CancellationToken cancellationToken)
     {
-        VerifiedExecutable verified;
-        VerifiedExecutable? managedEntry = null;
+        string cwd = ResolvedPath.Resolve(workingDirectory);
+        VerifiedEntryExecutable verified;
+        string? managedEntry = null;
         try
         {
-            verified = executablePolicy.Verify(executable);
-            string? managedEntryPath = ExecutablePolicy.ManagedEntryPoint(verified.CanonicalPath, arguments);
-            if (managedEntryPath is not null) managedEntry = executablePolicy.Verify(managedEntryPath);
+            verified = executablePolicy.VerifyEntry(executable, cwd);
+            managedEntry = executablePolicy.ManagedEntryPoint(verified.ResolvedPath, arguments, cwd);
+            if (managedEntry is not null) executablePolicy.VerifyManagedEntryPoint(managedEntry);
         }
         catch (SandboxPolicyException ex)
         {
@@ -36,7 +42,6 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
             throw;
         }
 
-        string cwd = CanonicalPath.Resolve(workingDirectory);
         using FileStream stdin = CaptureFile();
         using FileStream stdout = CaptureFile();
         using FileStream stderr = CaptureFile();
@@ -63,18 +68,14 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
                 throw LastError("SetInformationJobObject");
 
             nuint attributeSize = 0;
-            uint attributeCount = appContainerSid is null ? 2u : 3u;
+            uint attributeCount = appContainerSid is null ? 1u : 3u;
             _ = PInvoke.InitializeProcThreadAttributeList(default, attributeCount, 0, &attributeSize);
             LPPROC_THREAD_ATTRIBUTE_LIST attributes = (LPPROC_THREAD_ATTRIBUTE_LIST)NativeMemory.Alloc(attributeSize);
             void* sidBuffer = null;
-            void* internetClientSidBuffer = null;
-            void* privateNetworkSidBuffer = null;
+            var capabilityBuffers = new List<nint>();
             try
             {
                 if (!PInvoke.InitializeProcThreadAttributeList(attributes, attributeCount, 0, &attributeSize)) throw LastError("InitializeProcThreadAttributeList");
-                uint childPolicy = ProcessCreationChildProcessRestricted;
-                if (!PInvoke.UpdateProcThreadAttribute(attributes, 0, PInvoke.PROC_THREAD_ATTRIBUTE_CHILD_PROCESS_POLICY, &childPolicy, sizeof(uint), null, null))
-                    throw LastError("UpdateProcThreadAttribute");
                 HANDLE[] inheritedHandles =
                 [
                     new(stdin.SafeFileHandle.DangerousGetHandle()),
@@ -95,17 +96,24 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
                     sidBuffer = NativeMemory.Alloc((nuint)sidBytes.Length);
                     Marshal.Copy(sidBytes, 0, (nint)sidBuffer, sidBytes.Length);
                     securityCapabilities.AppContainerSid = (nint)sidBuffer;
-                    internetClientSidBuffer = AllocateSid(new SecurityIdentifier("S-1-15-3-1"));
-                    privateNetworkSidBuffer = AllocateSid(new SecurityIdentifier("S-1-15-3-3"));
-                    SID_AND_ATTRIBUTES* capabilities = stackalloc SID_AND_ATTRIBUTES[2];
-                    capabilities[0].Sid = new PSID(internetClientSidBuffer);
-                    capabilities[0].Attributes = 0x00000004;
-                    capabilities[1].Sid = new PSID(privateNetworkSidBuffer);
-                    capabilities[1].Attributes = 0x00000004;
+                    SecurityIdentifier[] capabilitySids = allowNetwork
+                        ? [DeriveCapabilitySid("registryRead"), DeriveCapabilitySid("lpacInstrumentation"), new("S-1-15-3-1"), new("S-1-15-3-3")]
+                        : [DeriveCapabilitySid("registryRead"), DeriveCapabilitySid("lpacInstrumentation")];
+                    SID_AND_ATTRIBUTES* capabilities = stackalloc SID_AND_ATTRIBUTES[capabilitySids.Length];
+                    for (int i = 0; i < capabilitySids.Length; i++)
+                    {
+                        void* buffer = AllocateSid(capabilitySids[i]);
+                        capabilityBuffers.Add((nint)buffer);
+                        capabilities[i].Sid = new PSID(buffer);
+                        capabilities[i].Attributes = 0x00000004;
+                    }
                     securityCapabilities.Capabilities = (nint)capabilities;
-                    securityCapabilities.CapabilityCount = 2;
+                    securityCapabilities.CapabilityCount = (uint)capabilitySids.Length;
                     if (!PInvoke.UpdateProcThreadAttribute(attributes, 0, PInvoke.PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES,
-                        &securityCapabilities, (nuint)sizeof(SecurityCapabilities), null, null)) throw LastError("UpdateProcThreadAttribute(SecurityCapabilities)");
+                        &securityCapabilities, (nuint)sizeof(SecurityCapabilities), null, null)) throw LpacFailure("UpdateProcThreadAttribute(SecurityCapabilities)", verified.ResolvedPath);
+                    uint allApplicationPackagesPolicy = ProcessCreationAllApplicationPackagesOptOut;
+                    if (!PInvoke.UpdateProcThreadAttribute(attributes, 0, PInvoke.PROC_THREAD_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY,
+                        &allApplicationPackagesPolicy, sizeof(uint), null, null)) throw LpacFailure("UpdateProcThreadAttribute(AllApplicationPackagesPolicy)", verified.ResolvedPath);
                 }
                 STARTUPINFOEXW startup = default;
                 startup.StartupInfo.cb = (uint)sizeof(STARTUPINFOEXW);
@@ -115,28 +123,29 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
                 startup.StartupInfo.hStdError = inheritedHandles[2];
                 startup.lpAttributeList = attributes;
                 PROCESS_INFORMATION process = default;
-                string commandLine = BuildCommandLine(verified.CanonicalPath, arguments);
+                string commandLine = BuildCommandLine(verified.ResolvedPath, arguments);
                 Span<char> commandBuffer = new char[commandLine.Length + 1];
                 commandLine.AsSpan().CopyTo(commandBuffer);
-                if (!PInvoke.CreateProcess(null, ref commandBuffer, null, null, true,
-                    PROCESS_CREATION_FLAGS.EXTENDED_STARTUPINFO_PRESENT | PROCESS_CREATION_FLAGS.CREATE_SUSPENDED,
-                    null, cwd, in startup.StartupInfo, out process)) throw LastError("CreateProcess");
+                char[] environmentBlock = BuildEnvironmentBlock(cwd);
+                fixed (char* environment = environmentBlock)
+                {
+                    if (!PInvoke.CreateProcess(null, ref commandBuffer, null, null, true,
+                        PROCESS_CREATION_FLAGS.EXTENDED_STARTUPINFO_PRESENT | PROCESS_CREATION_FLAGS.CREATE_SUSPENDED |
+                        PROCESS_CREATION_FLAGS.CREATE_UNICODE_ENVIRONMENT,
+                        environment, cwd, in startup.StartupInfo, out process)) throw LastError("CreateProcess");
+                }
                 try
                 {
                     using var processView = new SafeFileHandle(process.hProcess, ownsHandle: false);
                     if (!PInvoke.AssignProcessToJobObject(job, processView)) throw LastError("AssignProcessToJobObject");
                     try
                     {
-                        VerifiedExecutable postCreate = executablePolicy.Verify(executable);
-                        if (!string.Equals(postCreate.CanonicalPath, verified.CanonicalPath, StringComparison.OrdinalIgnoreCase) ||
+                        VerifiedEntryExecutable postCreate = executablePolicy.VerifyEntry(executable, cwd);
+                        if (!string.Equals(postCreate.ResolvedPath, verified.ResolvedPath, StringComparison.OrdinalIgnoreCase) ||
                             !string.Equals(postCreate.Sha256, verified.Sha256, StringComparison.Ordinal))
                             throw new SandboxPolicyException("process.identity_changed", "Executable identity changed during process creation.");
                         if (managedEntry is not null)
-                        {
-                            VerifiedExecutable postCreateManaged = executablePolicy.Verify(managedEntry.CanonicalPath);
-                            if (!string.Equals(postCreateManaged.Sha256, managedEntry.Sha256, StringComparison.Ordinal))
-                                throw new SandboxPolicyException("process.managed_identity_changed", "Managed entry assembly identity changed during process creation.");
-                        }
+                            executablePolicy.VerifyManagedEntryPoint(managedEntry);
                     }
                     catch (SandboxPolicyException ex)
                     {
@@ -146,20 +155,41 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
                         }, SessionId: sessionId, ErrorCode: ex.Code));
                         throw;
                     }
+                    (bool tokenIsAppContainer, string? tokenAppContainerSid, bool processInJob) = InspectConfinement(processView, job);
+                    if (appContainerSid is not null && (!tokenIsAppContainer ||
+                        !string.Equals(tokenAppContainerSid, appContainerSid.Value, StringComparison.Ordinal) || !processInJob))
+                        throw new SandboxPolicyException("process.lpac_mismatch",
+                            "Entry Process did not receive the required LPAC identity and Job Object confinement.",
+                            "process", verified.ResolvedPath, "execute", "Verify LPAC support on this Windows host; no fallback is permitted.");
                     if (PInvoke.ResumeThread(process.hThread) == uint.MaxValue) throw LastError("ResumeThread");
                     var processAudit = new Dictionary<string, string>
                     {
-                        ["path"] = verified.CanonicalPath, ["sha256"] = verified.Sha256, ["child_process_policy"] = "restricted",
-                        ["app_container_sid"] = appContainerSid?.Value ?? "none", ["network_capabilities"] = appContainerSid is null ? "none" : "internetClient,privateNetworkClientServer",
+                        ["path"] = verified.ResolvedPath, ["sha256"] = verified.Sha256, ["entry_classification"] = verified.Classification.ToString(),
+                        ["alias"] = verified.Alias ?? string.Empty, ["descendant_policy"] = "lpac_inherited",
+                        ["app_container_sid"] = appContainerSid?.Value ?? "none", ["lpac"] = (appContainerSid is not null).ToString(),
+                        ["token_is_app_container"] = tokenIsAppContainer.ToString(), ["token_app_container_sid"] = tokenAppContainerSid ?? "none",
+                        ["process_in_job"] = processInJob.ToString(), ["all_application_packages_opt_out"] = (appContainerSid is not null).ToString(),
+                        ["network_capabilities"] = appContainerSid is null || !allowNetwork ? "none" : "internetClient,privateNetworkClientServer",
+                        ["baseline_capabilities"] = appContainerSid is null ? "none" : "registryRead,lpacInstrumentation",
+                        ["environment_policy"] = "minimal_no_broker_credentials",
+                        ["arguments"] = "redacted", ["argument_count"] = arguments.Count.ToString(System.Globalization.CultureInfo.InvariantCulture),
                         ["pid"] = process.dwProcessId.ToString()
                     };
                     if (managedEntry is not null)
                     {
-                        processAudit["managed_entry_path"] = managedEntry.CanonicalPath;
-                        processAudit["managed_entry_sha256"] = managedEntry.Sha256;
+                        processAudit["managed_entry_path"] = ResolvedPath.Resolve(managedEntry);
                     }
                     audit.Write(new(DateTimeOffset.UtcNow, taskId, "process.start", "allowed", processAudit, SessionId: sessionId));
-                    WAIT_EVENT wait = PInvoke.WaitForSingleObject(process.hProcess, checked((uint)Math.Clamp(timeout.TotalMilliseconds, 1, uint.MaxValue - 1)));
+                    long deadline = Environment.TickCount64 + checked((long)Math.Clamp(timeout.TotalMilliseconds, 1, int.MaxValue));
+                    WAIT_EVENT wait;
+                    while (true)
+                    {
+                        cancellationToken.ThrowIfCancellationRequested();
+                        long remaining = deadline - Environment.TickCount64;
+                        if (remaining <= 0) { wait = WAIT_EVENT.WAIT_TIMEOUT; break; }
+                        wait = PInvoke.WaitForSingleObject(process.hProcess, (uint)Math.Min(remaining, 100));
+                        if (wait != WAIT_EVENT.WAIT_TIMEOUT) break;
+                    }
                     if (wait == WAIT_EVENT.WAIT_TIMEOUT)
                     {
                         _ = PInvoke.TerminateJobObject(job, 1460);
@@ -172,12 +202,20 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
                     {
                         audit.Write(new(DateTimeOffset.UtcNow, taskId, "policy.deny", "observed", new Dictionary<string, string>
                         {
-                            ["code"] = "restricted_process_failure", ["pid"] = process.dwProcessId.ToString(),
-                            ["child_process_policy"] = "restricted", ["exit_code"] = exitCode.ToString()
-                        }, SessionId: sessionId, ErrorCode: "process.child_denied"));
+                            ["code"] = "sandbox_process_failure", ["pid"] = process.dwProcessId.ToString(),
+                            ["descendant_policy"] = "lpac_inherited", ["exit_code"] = exitCode.ToString()
+                        }, SessionId: sessionId, ErrorCode: "process.nonzero_exit"));
                     }
                     return new(process.dwProcessId, exitCode, ReadCapture(stdout), ReadCapture(stderr));
                 }
+                catch (OperationCanceledException)
+                {
+                    _ = PInvoke.TerminateJobObject(job, 1223);
+                    _ = PInvoke.WaitForSingleObject(process.hProcess, 5000);
+                    audit.Write(new(DateTimeOffset.UtcNow, taskId, "process.cancel", "terminated",
+                        new Dictionary<string, string> { ["pid"] = process.dwProcessId.ToString() }, SessionId: sessionId));
+                    throw;
+                }
                 finally
                 {
                     PInvoke.CloseHandle(process.hThread);
@@ -188,8 +226,7 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
             {
                 if (attributes.Value is not null) PInvoke.DeleteProcThreadAttributeList(attributes);
                 NativeMemory.Free(sidBuffer);
-                NativeMemory.Free(internetClientSidBuffer);
-                NativeMemory.Free(privateNetworkSidBuffer);
+                foreach (nint buffer in capabilityBuffers) NativeMemory.Free((void*)buffer);
                 NativeMemory.Free(attributes.Value);
             }
         }
@@ -201,6 +238,34 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
         int code = Marshal.GetLastWin32Error();
         return new(code, $"{operation} failed with Win32 error {code}.");
     }
+
+    private static SandboxPolicyException LpacFailure(string operation, string executable)
+    {
+        int code = Marshal.GetLastWin32Error();
+        return new("process.lpac_unsupported", $"{operation} failed with Win32 error {code}; no fallback is permitted.",
+            "process", executable, "execute", "Use a supported Windows 11 host and verify LPAC capability derivation and process-attribute support.");
+    }
+
+    private static (bool IsAppContainer, string? AppContainerSid, bool InJob) InspectConfinement(SafeFileHandle process, SafeFileHandle job)
+    {
+        if (!PInvoke.IsProcessInJob(process, job, out BOOL inJob)) throw LastError("IsProcessInJob");
+        if (!PInvoke.OpenProcessToken(process, TOKEN_ACCESS_MASK.TOKEN_QUERY, out SafeFileHandle token)) throw LastError("OpenProcessToken");
+        using (token)
+        {
+            Span<byte> flag = stackalloc byte[sizeof(uint)];
+            if (!PInvoke.GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenIsAppContainer, flag, out _))
+                throw LastError("GetTokenInformation(TokenIsAppContainer)");
+            bool isAppContainer = MemoryMarshal.Read<uint>(flag) != 0;
+            _ = PInvoke.GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenAppContainerSid, Span<byte>.Empty, out uint sidInformationLength);
+            if (sidInformationLength < IntPtr.Size) throw LastError("GetTokenInformation(TokenAppContainerSid size)");
+            Span<byte> sidInformation = sidInformationLength <= 256 ? stackalloc byte[(int)sidInformationLength] : new byte[sidInformationLength];
+            if (!PInvoke.GetTokenInformation(token, TOKEN_INFORMATION_CLASS.TokenAppContainerSid, sidInformation, out _))
+                throw LastError("GetTokenInformation(TokenAppContainerSid)");
+            nint sidPointer = MemoryMarshal.Read<nint>(sidInformation);
+            string? sid = sidPointer == 0 ? null : new SecurityIdentifier(sidPointer).Value;
+            return (isAppContainer, sid, inJob);
+        }
+    }
     private static FileStream CaptureFile()
     {
         string path = Path.Combine(Path.GetTempPath(), "agent-mcp-process-" + Guid.NewGuid().ToString("N") + ".tmp");
@@ -215,6 +280,20 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
         Marshal.Copy(bytes, 0, (nint)buffer, bytes.Length);
         return buffer;
     }
+
+    private static SecurityIdentifier DeriveCapabilitySid(string name)
+    {
+        if (!PInvoke.DeriveCapabilitySidsFromName(name, out PSID* groupSids, out uint groupCount, out PSID* capabilitySids, out uint capabilityCount) || capabilityCount != 1)
+            throw LastError($"DeriveCapabilitySidsFromName({name})");
+        try { return new SecurityIdentifier((nint)capabilitySids[0].Value); }
+        finally
+        {
+            for (uint i = 0; i < groupCount; i++) _ = PInvoke.LocalFree(new HLOCAL((nint)groupSids[i].Value));
+            for (uint i = 0; i < capabilityCount; i++) _ = PInvoke.LocalFree(new HLOCAL((nint)capabilitySids[i].Value));
+            _ = PInvoke.LocalFree(new HLOCAL((nint)groupSids));
+            _ = PInvoke.LocalFree(new HLOCAL((nint)capabilitySids));
+        }
+    }
     private static void MakeInheritable(SafeFileHandle handle)
     {
         if (!PInvoke.SetHandleInformation(handle, (uint)HANDLE_FLAGS.HANDLE_FLAG_INHERIT, HANDLE_FLAGS.HANDLE_FLAG_INHERIT))
@@ -230,6 +309,45 @@ public sealed unsafe class RestrictedProcessLauncher(ExecutablePolicy executable
         return count > maxCharacters ? new string(buffer, 0, maxCharacters) + "\n[output truncated]" : new string(buffer, 0, count);
     }
     private static string BuildCommandLine(string executable, IReadOnlyList<string> arguments) => string.Join(' ', [Quote(executable), .. arguments.Select(Quote)]);
+    private static char[] BuildEnvironmentBlock(string cwd)
+    {
+        string systemRoot = Environment.GetFolderPath(Environment.SpecialFolder.Windows);
+        var values = new SortedDictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["ComSpec"] = Path.Combine(systemRoot, "System32", "cmd.exe"),
+            ["DOTNET_CLI_HOME"] = cwd,
+            ["DOTNET_CLI_TELEMETRY_OPTOUT"] = "1",
+            ["DOTNET_CLI_USE_MSBUILD_SERVER"] = "0",
+            ["DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE"] = "true",
+            ["DOTNET_NOLOGO"] = "1",
+            ["DOTNET_SKIP_FIRST_TIME_EXPERIENCE"] = "1",
+            ["DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK"] = "true",
+            ["MSBuildEnableWorkloadResolver"] = "false",
+            ["MSBUILDDISABLENODEREUSE"] = "1",
+            ["NUMBER_OF_PROCESSORS"] = Environment.ProcessorCount.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            ["OS"] = "Windows_NT",
+            ["PATH"] = Path.Combine(systemRoot, "System32"),
+            ["PATHEXT"] = ".COM;.EXE;.BAT;.CMD",
+            ["PROCESSOR_ARCHITECTURE"] = RuntimeInformation.ProcessArchitecture.ToString().ToUpperInvariant(),
+            ["SystemDrive"] = Path.GetPathRoot(systemRoot)!.TrimEnd(Path.DirectorySeparatorChar),
+            ["SystemRoot"] = systemRoot,
+            ["TEMP"] = cwd,
+            ["TMP"] = cwd,
+            ["windir"] = systemRoot
+        };
+        foreach (string name in new[]
+        {
+            "ALLUSERSPROFILE", "APPDATA", "CommonProgramFiles", "CommonProgramFiles(x86)", "CommonProgramW6432",
+            "HOMEDRIVE", "HOMEPATH", "LOCALAPPDATA", "ProgramData", "ProgramFiles", "ProgramFiles(x86)",
+            "ProgramW6432", "PUBLIC", "USERDOMAIN", "USERNAME", "USERPROFILE"
+        })
+        {
+            string? value = Environment.GetEnvironmentVariable(name);
+            if (!string.IsNullOrEmpty(value)) values[name] = value;
+        }
+        string block = string.Concat(values.Select(pair => $"{pair.Key}={pair.Value}\0")) + "\0";
+        return block.ToCharArray();
+    }
     private static string Quote(string value)
     {
         if (value.Length > 0 && !value.Any(static character => char.IsWhiteSpace(character) || character == '"')) return value;
diff --git a/src/Agent.Windows/Security/TaskAclManager.cs b/src/Agent.Windows/Security/TaskAclManager.cs
index 2b091a6..be0080d 100644
--- a/src/Agent.Windows/Security/TaskAclManager.cs
+++ b/src/Agent.Windows/Security/TaskAclManager.cs
@@ -10,27 +10,64 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
 {
     public AclSnapshot Grant(Guid taskId, string path, FileCapability capabilities)
     {
-        string canonical = CanonicalPath.Resolve(path);
+        string canonical = ResolvedPath.Resolve(path);
         FileSystemSecurity security = ReadSecurity(canonical);
         byte[] original = security.GetSecurityDescriptorBinaryForm();
         Guid? journalEntry = journal?.Prepare("acl", canonical, new Dictionary<string, string>
         {
             ["security_descriptor"] = Convert.ToBase64String(original)
         });
-        FileSystemRights rights = ToRights(capabilities);
-        if (rights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
         bool directory = Directory.Exists(canonical);
-        var rule = new FileSystemAccessRule(appContainerSid, rights,
-            directory ? InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit : InheritanceFlags.None,
-            PropagationFlags.None, AccessControlType.Allow);
-        security.AddAccessRule(rule);
-        WriteSecurity(canonical, security);
-        if (journalEntry is not null) journal!.MarkApplied(journalEntry.Value);
+        FileSystemRights auditRights;
+        if (directory)
+        {
+            FileSystemRights directoryRights = ToDirectoryRights(capabilities);
+            FileSystemRights fileRights = ToFileRights(capabilities);
+            if (directoryRights == 0 || fileRights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, directoryRights,
+                InheritanceFlags.ContainerInherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, fileRights,
+                InheritanceFlags.ObjectInherit, PropagationFlags.InheritOnly, AccessControlType.Allow));
+            auditRights = directoryRights | fileRights;
+        }
+        else
+        {
+            auditRights = ToFileRights(capabilities);
+            if (auditRights == 0) throw new ArgumentOutOfRangeException(nameof(capabilities));
+            security.AddAccessRule(new FileSystemAccessRule(appContainerSid, auditRights,
+                InheritanceFlags.None, PropagationFlags.None, AccessControlType.Allow));
+        }
+        try
+        {
+            WriteSecurity(canonical, security);
+            if (journalEntry is not null) journal!.MarkApplied(journalEntry.Value);
+        }
+        catch (Exception applyFailure)
+        {
+            try
+            {
+                byte[] current = ReadSecurity(canonical).GetSecurityDescriptorBinaryForm();
+                if (!current.AsSpan().SequenceEqual(original))
+                {
+                    FileSystemSecurity rollback = Directory.Exists(canonical) ? new DirectorySecurity() : new FileSecurity();
+                    rollback.SetSecurityDescriptorBinaryForm(original, AccessControlSections.Access);
+                    WriteSecurity(canonical, rollback);
+                    byte[] restored = ReadSecurity(canonical).GetSecurityDescriptorBinaryForm();
+                    if (!restored.AsSpan().SequenceEqual(original)) throw new InvalidOperationException("ACL rollback verification failed.");
+                }
+                if (journalEntry is not null) journal!.MarkCleaned(journalEntry.Value);
+            }
+            catch (Exception rollbackFailure)
+            {
+                throw new AggregateException("ACL apply failed and immediate rollback did not reach a verified clean state.", applyFailure, rollbackFailure);
+            }
+            throw;
+        }
         audit.Write(new(DateTimeOffset.UtcNow, taskId, "acl.apply", "applied", new Dictionary<string, string>
         {
             ["path"] = canonical,
             ["sid"] = appContainerSid.Value,
-            ["rights"] = rights.ToString(),
+            ["rights"] = auditRights.ToString(),
             ["scope"] = directory ? "root_inheritance" : "file"
         }));
         return new(canonical, original, journalEntry);
@@ -55,12 +92,23 @@ public sealed class TaskAclManager(SecurityIdentifier appContainerSid, ISecurity
         else FileSystemAclExtensions.SetAccessControl(new FileInfo(path), (FileSecurity)security);
     }
 
-    private static FileSystemRights ToRights(FileCapability capabilities)
+    private static FileSystemRights ToFileRights(FileCapability capabilities)
     {
         FileSystemRights rights = 0;
-        if ((capabilities & FileCapability.Read) != 0) rights |= FileSystemRights.ReadAndExecute | FileSystemRights.ListDirectory;
+        if ((capabilities & FileCapability.Read) != 0)
+            rights |= FileSystemRights.ReadData | FileSystemRights.ReadAttributes | FileSystemRights.ReadExtendedAttributes | FileSystemRights.ReadPermissions;
         if ((capabilities & FileCapability.Write) != 0) rights |= FileSystemRights.Write;
-        if ((capabilities & FileCapability.Execute) != 0) rights |= FileSystemRights.ReadAndExecute;
+        if ((capabilities & FileCapability.Execute) != 0) rights |= FileSystemRights.ExecuteFile | FileSystemRights.ReadData | FileSystemRights.ReadAttributes;
+        if ((capabilities & FileCapability.Delete) != 0) rights |= FileSystemRights.Delete;
+        return rights;
+    }
+
+    private static FileSystemRights ToDirectoryRights(FileCapability capabilities)
+    {
+        FileSystemRights rights = FileSystemRights.Traverse | FileSystemRights.ReadAttributes | FileSystemRights.ReadPermissions;
+        if ((capabilities & FileCapability.Read) != 0) rights |= FileSystemRights.ListDirectory | FileSystemRights.ReadExtendedAttributes;
+        if ((capabilities & FileCapability.Write) != 0) rights |= FileSystemRights.CreateFiles | FileSystemRights.CreateDirectories |
+            FileSystemRights.WriteAttributes | FileSystemRights.WriteExtendedAttributes;
         if ((capabilities & FileCapability.Delete) != 0) rights |= FileSystemRights.Delete | FileSystemRights.DeleteSubdirectoriesAndFiles;
         return rights;
     }
diff --git a/src/Agent.Windows/Tools/WindowsToolBackend.cs b/src/Agent.Windows/Tools/WindowsToolBackend.cs
index 5cbf853..af4c906 100644
--- a/src/Agent.Windows/Tools/WindowsToolBackend.cs
+++ b/src/Agent.Windows/Tools/WindowsToolBackend.cs
@@ -10,12 +10,13 @@ using Agent.Windows.Security;
 
 namespace Agent.Windows.Tools;
 
-public sealed record WindowsSandboxSettings(
+public sealed record EffectiveSandboxPolicy(
     IReadOnlyList<FilePolicyEntry> Files,
-    IReadOnlyList<ExecutableApproval> Executables,
-    bool AllowShell,
+    IReadOnlyList<ApprovedEntryExecutable> EntryExecutables,
+    IReadOnlyList<string> RuntimeRoots,
+    IReadOnlyList<string> ArtifactRoots,
     SandboxJobLimits JobLimits,
-    string NetworkMode,
+    string NetworkAccess,
     IReadOnlyList<(string Host, IReadOnlyList<int> Ports)> NetworkAllowances,
     string JournalDirectory,
     string BackupDirectory,
@@ -23,17 +24,22 @@ public sealed record WindowsSandboxSettings(
     long WholeReadLimitBytes,
     int SearchResultLimit,
     int TailLineLimit,
-    int ProcessTimeoutSeconds = 300);
+    int ProcessTimeoutSeconds = 300,
+    string ResourceProfile = "normal",
+    IReadOnlyList<string>? BaselineCapabilities = null);
 
-public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurityAuditSink audit, ITaskUpdateHandler? taskUpdates = null) : IInternalToolBackend
+public sealed class WindowsToolBackend(EffectiveSandboxPolicy settings, ISecurityAuditSink audit, ITaskUpdateHandler? taskUpdates = null) : IInternalToolBackend
 {
     private readonly ConcurrentDictionary<Guid, TaskContext> _contexts = new();
     private readonly PathPolicy _paths = new(settings.Files);
-    private readonly ExecutablePolicy _executables = new(settings.Executables, settings.AllowShell);
+    private readonly EntryExecutablePolicy _entryExecutables = new(settings.EntryExecutables, settings.RuntimeRoots, settings.ArtifactRoots);
     private readonly ITaskUpdateHandler _taskUpdates = taskUpdates ?? new TaskGraphToolHandler();
 
     public async Task BeginTaskAsync(Guid taskId, Guid sessionId, CancellationToken cancellationToken)
     {
+        if (settings.BaselineCapabilities is not null &&
+            !settings.BaselineCapabilities.SequenceEqual(["registryRead", "lpacInstrumentation"], StringComparer.Ordinal))
+            throw new InvalidOperationException("Effective Sandbox Policy baseline capabilities do not match the fixed LPAC baseline.");
         if (_contexts.Count != 0) throw new InvalidOperationException("Only one Task Resource scope may be active.");
         AppContainerProfile profile = AppContainerProfile.EnsureFixed();
         TaskResourceJournal journal = TaskResourceJournal.Create(settings.JournalDirectory, taskId);
@@ -42,23 +48,29 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
         _taskUpdates.BeginTask(taskId, sessionId);
         try
         {
-            foreach ((string path, FileCapability capabilities) in settings.Files
-                .GroupBy(static entry => CanonicalPath.Resolve(entry.Path, false), StringComparer.OrdinalIgnoreCase)
-                .Select(static group => (group.Key, group.Aggregate(FileCapability.None, static (value, item) => value | item.Capabilities))))
+            foreach ((string path, FileCapability capabilities, bool osRuntimeRoot) in settings.Files
+                .GroupBy(static entry => ResolvedPath.Resolve(entry.Path, false), StringComparer.OrdinalIgnoreCase)
+                .Select(static group => (group.Key,
+                    group.Aggregate(FileCapability.None, static (value, item) => value | item.Capabilities),
+                    group.All(static item => item.Origin == "os_runtime_root"))))
             {
+                // System32 has a protected OS-owned DACL. Its existing LPAC access is verified by
+                // real process-tree tests; changing or unprotecting that DACL is forbidden.
+                if (osRuntimeRoot) continue;
                 // OS/runtime executables may already grant AppContainer execute through their protected system ACL.
                 // Do not rewrite a file ACL when execute is the only requested capability; CreateProcess remains
-                // constrained by AppContainer access plus canonical path/SHA-256 approval.
+                // constrained by LPAC access plus Resolved Path/SHA-256 Entry approval.
                 if (File.Exists(path) && capabilities == FileCapability.Execute) continue;
                 // A single inheritable ACE on an approved directory covers existing and newly-created
                 // descendants. Snapshotting and rewriting every child ACL is both redundant and
                 // prohibitively expensive for runtime trees such as Python installations.
                 context.Acls.Add(acl.Grant(taskId, path, capabilities));
             }
-            IReadOnlyList<NetworkEndpoint> allowances = settings.NetworkMode == "allow"
+            IReadOnlyList<NetworkEndpoint> allowances = settings.NetworkAccess != "none"
                 ? await NetworkAllowanceSnapshot.ResolveAsync(settings.NetworkAllowances, cancellationToken).ConfigureAwait(false)
                 : [];
-            context.Network = TaskNetworkPolicy.Apply(journal, profile.Sid, allowances, audit, sessionId);
+            context.Network = TaskNetworkPolicy.Apply(journal, profile.Sid, allowances, audit, sessionId,
+                enableLoopback: settings.NetworkAccess != "none");
             if (!_contexts.TryAdd(taskId, context)) throw new InvalidOperationException("Task context already exists.");
             audit.Write(new(DateTimeOffset.UtcNow, taskId, "task.start", "running", new Dictionary<string, string>(), SessionId: sessionId));
         }
@@ -82,7 +94,7 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
                 "file_search" => Task.FromResult(Search(arguments)),
                 "file_read" => Task.FromResult(Read(arguments)),
                 "file_edit" => Task.FromResult(Edit(context, arguments)),
-                "process_run" => Task.FromResult(RunProcess(context, arguments)),
+                "process_run" => Task.FromResult(RunProcess(context, arguments, cancellationToken)),
                 "task_update" => Task.FromResult(_taskUpdates.Execute(taskId, arguments)),
                 "dir" => Task.FromResult(DirectoryOp(context, arguments)),
                 _ => throw new ToolValidationException($"Unknown internal tool '{toolName}'.")
@@ -128,7 +140,7 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
     {
         string root = arguments.GetProperty("root").GetString()!;
         _paths.Demand(root, FileCapability.Read);
-        string canonical = CanonicalPath.Resolve(root);
+        string canonical = ResolvedPath.Resolve(root);
         string mode = arguments.GetProperty("mode").GetString()!;
         string query = arguments.GetProperty("query").GetString()!;
         int max = arguments.TryGetProperty("max_results", out JsonElement maxElement) ? maxElement.GetInt32() : 100;
@@ -164,10 +176,10 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
     {
         string path = arguments.GetProperty("path").GetString()!;
         _paths.Demand(path, FileCapability.Read);
-        string canonical = CanonicalPath.Resolve(path);
+        string canonical = ResolvedPath.Resolve(path);
         string mode = arguments.GetProperty("mode").GetString()!;
         FileInfo info = new(canonical);
-        if (mode == "metadata") return Success(JsonSerializer.Serialize(new { path = canonical, info.Length, info.LastWriteTimeUtc, sha256 = ExecutablePolicy.ComputeSha256(canonical) }));
+        if (mode == "metadata") return Success(JsonSerializer.Serialize(new { path = canonical, info.Length, info.LastWriteTimeUtc, sha256 = EntryExecutablePolicy.ComputeSha256(canonical) }));
         if (mode == "whole")
         {
             if (info.Length > settings.WholeReadLimitBytes) throw new IOException("Whole read exceeds configured limit; use range mode.");
@@ -245,7 +257,7 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
         if (operation == "list")
         {
             _paths.Demand(path, FileCapability.Read);
-            string canonical = CanonicalPath.Resolve(path);
+            string canonical = ResolvedPath.Resolve(path);
             var entries = Directory.EnumerateFileSystemEntries(canonical, "*", SearchOption.TopDirectoryOnly)
                 .Select(Path.GetFullPath)
                 .ToArray();
@@ -254,20 +266,20 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
         throw new ToolValidationException($"Unsupported dir operation '{operation}'.");
     }
 
-    private ToolExecutionResult RunProcess(TaskContext context, JsonElement arguments)
+    private ToolExecutionResult RunProcess(TaskContext context, JsonElement arguments, CancellationToken cancellationToken)
     {
         Guid taskId = context.Journal.TaskId;
         string executable = arguments.GetProperty("executable").GetString()!;
         string cwd = arguments.GetProperty("cwd").GetString()!;
-        _paths.Demand(executable, FileCapability.Execute);
         _paths.Demand(cwd, FileCapability.Read);
         string[] args = arguments.GetProperty("args").EnumerateArray().Select(static item => item.GetString()!).ToArray();
-        string? managedEntryPoint = ExecutablePolicy.ManagedEntryPoint(executable, args);
+        string? managedEntryPoint = _entryExecutables.ManagedEntryPoint(executable, args, cwd);
         if (managedEntryPoint is not null) _paths.Demand(managedEntryPoint, FileCapability.Execute);
         int seconds = ResolveProcessTimeout(arguments, settings.ProcessTimeoutSeconds);
         string? stdin = arguments.TryGetProperty("stdin", out JsonElement stdinElement) && stdinElement.ValueKind == JsonValueKind.String ? stdinElement.GetString() : null;
-        RestrictedProcessResult result = new RestrictedProcessLauncher(_executables, audit, AppContainerProfile.EnsureFixed().Sid, settings.JobLimits)
-            .Run(taskId, executable, args, cwd, TimeSpan.FromSeconds(seconds), stdin, context.SessionId);
+        RestrictedProcessResult result = new RestrictedProcessLauncher(_entryExecutables, audit, AppContainerProfile.EnsureFixed().Sid, settings.JobLimits,
+            allowNetwork: settings.NetworkAccess != "none")
+            .Run(taskId, executable, args, cwd, TimeSpan.FromSeconds(seconds), stdin, context.SessionId, cancellationToken);
         string output = $"Process exited with code {result.ExitCode} (PID {result.ProcessId}).\nstdout:\n{result.StandardOutput}\nstderr:\n{result.StandardError}";
         return new(result.ExitCode == 0, output, true,
             result.ExitCode == 0 ? null : $"process:{executable}:{result.ExitCode}");
@@ -278,7 +290,7 @@ public sealed class WindowsToolBackend(WindowsSandboxSettings settings, ISecurit
         int seconds = arguments.TryGetProperty("timeout_seconds", out JsonElement timeout) ? timeout.GetInt32() : configuredTimeoutSeconds;
         if (seconds <= 0) throw new ToolValidationException("timeout_seconds must be positive.");
         if (seconds > configuredTimeoutSeconds)
-            throw new ToolValidationException($"timeout_seconds exceeds configured sandbox.resources.process_timeout_seconds ({configuredTimeoutSeconds}).");
+            throw new ToolValidationException($"timeout_seconds exceeds configured sandbox.resources.execution_timeout_seconds ({configuredTimeoutSeconds}).");
         return seconds;
     }