A crew run can open its own repository's app and previews: the sandbox allows that repo's app hosts #3658

Probe 2026-10-20 21:25Z: trevato/arm issue #34 was parked twice (20:13, 20:18) with declined: I can't run this check from here. The public URL (https://arm--forge-trevato-apps.open-platform.sh) is blocked by the sandbox - the crew shell's network is the forge and the package registry only (src/crew/sandbox.ts:4). Checks that need the running app (end-to-end, playwright screenshots, metrics, the public launch check) cannot be done, so runs end without a pull and are retried.

Done: a crew run on repo R may reach R's own app hosts - production and every pull preview (<slug>--forge-<owner>.open-platform.sh, <slug>--<n>--...) - and nothing else new; the brief tells the crew the URLs. Test: a run on R fetches R's preview; a run on R cannot fetch another repo's app.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.