1 files changed, 30 insertions, 29 deletions
diff --git a/config/locales/en.json b/config/locales/en.json
index 3e9a5fa..c8ec474 100644
--- a/config/locales/en.json
+++ b/config/locales/en.json
@@ -1,15 +1,36 @@
 {
   "app.starting": "Starting agent.",
-  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal, ensure the Base Filtering Engine service is running, and run 'agent-mcp check'.",
+  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal and ensure the Base Filtering Engine service is running.",
   "app.ready.http": "Agent is ready for MCP requests. endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "Agent stdio transport is ready. protocol={protocol}; pid={pid}; logs={logs}",
-  "check.success": "Configuration and runtime checks passed.",
-  "check.failure": "Check failed: {message}",
-  "check.wfp_admin_required": "Windows administrator elevation is required for WFP task isolation. Start agent-mcp.exe from an elevated terminal.",
   "config.invalid": "Invalid configuration: {message}",
   "locale.invalid": "Invalid locale: {message}",
   "cli.invalid": "Invalid command line: {message}",
   "app.io_error": "Startup I/O failed: {message}",
+  "show.configuration": "Configuration: {path}",
+  "show.applied": "Applied: {value}",
+  "show.fingerprint": "Fingerprint: {value}",
+  "show.yes": "yes",
+  "show.no": "no",
+  "show.not_applied": "not-applied",
+  "show.matched": "matched",
+  "show.changed": "changed",
+  "show.platform": "Platform: not probed; startup performs the full privileged preflight",
+  "show.filesystem": "FILESYSTEM",
+  "show.filesystem_columns": "TYPE\tLOGICAL\tRESOLVED\tACCESS\tSTATUS",
+  "show.execution": "EXECUTION",
+  "show.execution_columns": "ALIAS\tTYPE\tRESOLVED\tRUNTIME\tSHA-256\tSTATUS",
+  "show.network": "NETWORK",
+  "show.resources": "RESOURCES",
+  "show.status.active": "active",
+  "show.status.added": "added",
+  "show.status.changed": "changed",
+  "show.status.removed": "removed-on-apply",
+  "apply.no_changes": "No applied configuration changes.",
+  "apply.replace_snapshot": "The complete configuration snapshot will be replaced.",
+  "apply.prompt": "Apply this configuration?",
+  "apply.success": "Configuration applied atomically.",
+  "apply.store_unreadable": "Existing Applied Configuration Store is unreadable and will be replaced only after confirmation: {message}",
   "mcp.task_queued": "Task {task} was queued in session {session}.",
   "mcp.task_not_found": "Task {task} was not found.",
   "mcp.status.queued": "The task is queued.",
@@ -27,30 +48,10 @@
   "runtime.policy_replan_exhausted": "The sandbox policy denial remained unresolved after {message} replans.",
   "runtime.policy_repeated": "The same sandbox policy denial occurred again, so replanning was stopped.",
   "runtime.replan_unchanged": "Replanning did not change the incomplete task plan.",
-  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability, then confirm the Sandbox Environment Resolution.",
-  "runtime.policy_resolution.process": "Use a configured Alias or an allowed Runtime Component or development Workspace Artifact; re-approve a changed Executable identity.",
+  "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability in YAML, then run agent-mcp apply.",
+  "runtime.policy_resolution.process": "Use an Alias declared in execution.entries, an allowed Runtime Component, or a development Workspace Artifact; review and apply changed identity in YAML.",
   "runtime.policy_resolution.network": "Review the selected Network access mode and endpoint list; the Agent cannot widen it during a Task.",
-  "runtime.policy_resolution.default": "Review the User Sandbox Configuration and confirmed Effective Sandbox Policy.",
-  "management.approval_diff": "Alias: {alias}\nClassification: {classification}\nResolved Path: {path}\nSHA-256: {sha256}\nRuntime Root: {runtime_root}",
-  "management.approve_prompt": "Approve this Executable Alias?",
-  "management.revoke_diff": "Revoke {alias}: {path}",
-  "management.revoke_prompt": "Revoke this Executable Alias?",
-  "management.sandbox_confirm_prompt": "Confirm this Sandbox Environment Resolution?",
-  "management.resolution_header": "Configuration: {config}\nFingerprint: {fingerprint}",
-  "management.confirmed": "Confirmed: {value}",
-  "management.yes": "yes",
-  "management.no": "no",
-  "management.ambiguous_candidates": "Multiple candidates were found. No candidate was selected; re-run with --path <path>.",
-  "sandbox.error.resolution_unconfirmed": "The Sandbox Environment Resolution is not confirmed.",
-  "sandbox.error.resolution_unconfirmed.resolution": "Review sandbox resolve, then run sandbox confirm.",
-  "sandbox.error.resolution_changed": "The Sandbox Environment Resolution changed after confirmation.",
-  "sandbox.error.resolution_changed.resolution": "Review the changed Logical and Resolved Paths, then confirm again.",
-  "sandbox.error.approval_missing": "The Executable Alias is not approved: {target}",
-  "sandbox.error.approval_missing.resolution": "Resolve the Alias, review one candidate, and explicitly approve it.",
-  "sandbox.error.executable_resolution_changed": "The Executable Resolved Path changed: {target}",
-  "sandbox.error.executable_resolution_changed.resolution": "Verify the new identity and explicitly re-approve it.",
-  "sandbox.error.executable_hash_changed": "The Executable SHA-256 changed: {target}",
-  "sandbox.error.executable_hash_changed.resolution": "Verify the updated file and explicitly re-approve it.",
-  "sandbox.error.shell_unsupported": "The selected file is not a supported Shell: {target}",
-  "sandbox.error.shell_unsupported.resolution": "Select cmd.exe, powershell.exe, or pwsh.exe."
+  "runtime.policy_resolution.default": "Review the YAML permission matrix with agent-mcp show, then run agent-mcp apply.",
+  "sandbox.error.configuration_not_applied": "The configuration has not been applied or its resolved identity changed: {target}",
+  "sandbox.error.configuration_not_applied.resolution": "Review the complete permission matrix with agent-mcp show, then run agent-mcp apply."
 }