feat(example): sandbox-acp-agent — the live composition; RFCs to implemented

The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a
read-only default + dsh-approval) served over ACP: the first live approval
composition. Recorded snapshot scenarios pin the wire end to end —
config-options advertisement, the mode-switching arc as the suite pinned
header (both switches, the prompt-section delta, one changed-by-the-user
notice per knob, a confined write landing under the switched mode), and
both escalation branches over scripted permissionAnswers (a grant runs
confined under workspace-write; a rejection executes nothing and pins the
fail-closed text). The with-key escalation e2e drives a real model +
real runner + the real bridge answerer, world-verified; ci.yml snapshot
lane and e2e.yml install bubblewrap so the confined replays actually
execute.

Both RFCs move to implemented/ (Decision/Consequences form, deferred
phases tracked in their own sections), with every cross-reference flipped.

examples/sandbox-acp-agent/cordis.yml

@@ -0,0 +1,63 @@
+# The sandbox-acp-agent plugin tree: the sandboxed coding agent served over the
+# Agent Client Protocol, with the approval seam composed — the first LIVE
+# approval composition. A sandbox denial escalated by the model
+# (sandbox_permissions + justification) reaches the EDITOR as a
+# session/request_permission prompt through the ACP bridge's answerer, and an
+# "Allow once" runs exactly that command under the wider mode.
+#
+# CRITICAL: this tree loads NO stdout logger and NO hmr — stdout is reserved
+# for the ACP JSON-RPC protocol (a property of @deepseek-ai/dsh-acp-agent,
+# same as examples/acp-agent).
+#
+# Requires DEEPSEEK_API_KEY (and optionally DEEPSEEK_BASE_URL) — the
+# dsh-acp-agent bin loads the gitignored repo-root .env first (on STDERR only).
+
+# The DeepSeek adapter.
+- id: llm-deepseek
+  name: '@deepseek-ai/dsh-llm-deepseek'
+  config:
+    apiKey: !!js process.env.DEEPSEEK_API_KEY
+    baseURL: !!js process.env.DEEPSEEK_BASE_URL
+    models:
+      - deepseek-v4-flash
+
+# The sandbox stack: the platform-runner provider (bwrap → per-platform
+# Landlock launcher → Seatbelt, functionally probed), then the confined bash executor.
+# read-only is the fail-safe default; the write boundary for an escalated
+# workspace-write run is workspaceRoot + the platform's temp area. NOTE: the
+# workspace root is CONFIG-FIXED for the executor's lifetime (the launch dir
+# here), while each ACP session has its own cwd — a per-session root is config-
+# phase future work in the sandbox RFC.
+- id: sandbox
+  name: '@deepseek-ai/dsh-sandbox-local'
+- id: bash
+  name: '@deepseek-ai/dsh-bash-sandbox'
+  config:
+    mode: read-only
+    workspaceRoot: !!js process.cwd()
+
+# The approval seam (ctx.approval — mechanism only, no config): with it
+# mounted, the bash tool's escalation gate has a channel, and the ACP bridge
+# inside dsh-acp-agent answers for the sessions it owns by prompting the
+# editor. Without an editor attached nothing can answer, and every ask fails
+# closed.
+- id: approval
+  name: '@deepseek-ai/dsh-approval'
+
+# The ACP server app: the agent-core spine + JSONL persistence + the ACP
+# bridge (whose approval answerer completes the loop).
+- id: acp-agent
+  name: '@deepseek-ai/dsh-acp-agent'
+  config:
+    model: deepseek-v4-flash
+    # Persistence root: $DSH_SNAPSHOT_SESSIONS_ROOT when the snapshot harness
+    # sets it (so a record run's logs land where the harness harvests them),
+    # else the local ./.sessions default.
+    persistenceRoot: !!js process.env.DSH_SNAPSHOT_SESSIONS_ROOT ?? './.sessions'
+    persona: |
+      You are a coding assistant powered by the {{model}} model. Your working
+      directory is {{cwd}}. Your bash tool runs under a file sandbox — a
+      `[sandbox: file access denied …]` result is policy, not a command bug.
+
+      Verify your work by running the code or tests. Keep answers brief and
+      factual.