Require explicit canonical network readiness targets

docs/schema.md

@@ -36,9 +36,13 @@ tables, field aliases, and unknown enumeration values.
 | profile | `persistent_dirs` | optional list of sandbox paths; defaults empty |
 | profile | `allow_egress` | optional list of IPv4 prefixes; defaults empty |
 | profile | `deny_egress` | optional list of IPv4 prefixes; defaults empty |
+| profile | `readiness` | required at load for the selected profile; closed denied, permitted, and DNS target table |
 | profile | `env` | optional map from sandbox environment name to `env:` reference; defaults empty |
 | profile | `volumes` | optional list of volume tables; defaults empty |
 | profile | `escalation` | optional table; defaults to disabled with no rules |
+| `readiness` | `denied` | one to 32 unique `{ address = IPv4, port = nonzero }` targets denied by effective policy |
+| `readiness` | `permitted` | one to 32 unique `{ address = IPv4, port = nonzero }` targets allowed by effective policy |
+| `readiness` | `dns` | one to 32 unique `{ resolver = IPv4, query = strict DNS name }` targets |
 | volume | `host` | required host path |
 | volume | `container` | required sandbox path |
 | volume | `kind` | required: `file` or `directory` |
@@ -148,6 +152,7 @@ classDiagram
         volumes
         effective_allow_prefixes
         effective_deny_prefixes
+        network_readiness
         escalation_enabled
         auto_approval_rules
     }
@@ -174,6 +179,13 @@ classDiagram
         allow_extra_args
     }
 
+    class ResolvedNetworkReadinessV1 {
+        <<serialized>>
+        denied
+        permitted
+        dns
+    }
+
     class ConfinedPathPlan {
         <<runtime>>
         retained_ancestor
@@ -190,6 +202,7 @@ classDiagram
     ConfigurationFingerprintRecordV1 --> EnvironmentReference
     ConfigurationFingerprintRecordV1 --> ResolvedVolume
     ConfigurationFingerprintRecordV1 --> ResolvedAutoApprovalRule
+    ConfigurationFingerprintRecordV1 --> ResolvedNetworkReadinessV1
     ResolvedDomainConfiguration --> ConfinedPathPlan
 ```