The hosted sandbox is where a dispatched agent runs work: one checkout per work item, a git worktree, and a locked-down environment that can read the plan but not reshape it.
A sandboxed run carries a narrowed token grant — it can browse the project, edit its own work item, comment, and plan, but not author a plan or reach outside its repository.