Scheduled routine runs ignore environment's Network access setting — WebFetch blocked on all domains despite "Full access" configured

Summary

A scheduled cloud routine (created via a trig_... trigger) consistently has WebFetch blocked with EGRESS_BLOCKED on every external domain, even though the environment it runs in (env_01Tr44XoVC4MJhLtY2oaWNSp, referred to as "Default Cloud Environment") has its Network access setting configured to Full / all domains in the UI.

Environment / trigger details

• Environment ID: env_01Tr44XoVC4MJhLtY2oaWNSp
• Trigger ID: trig_01JoRi7M1sut93zQLNdeRbCe (one of 5 identically-configured triggers: trig_01FqbSzXuN8B3ZmBx19WjmPH, trig_01XQoN3rG8dyq6HgrQeJg9EF, trig_01Ct5ruNKXpKqiz2EFoz2Dqa, trig_01EvAa446NBAQHa2AZrgwWs4)
• Repo: SebbyS1/lighting-knowledge
• Reproduced in two separate runs: session cse_018assETETeJrzCBc3MW8rmX (2026-09-23T06:16Z) and session cse_017pHZaz1TsXJYuFMQAdBYtc (2026-09-23T06:40Z, after re-confirming the UI setting was "Full access")

Steps to reproduce

1. Create a scheduled routine/trigger pointed at a cloud environment with Network access set to "Full access / all domains."
2. Have the routine's prompt call WebFetch on any external URL.
3. Observe EGRESS_BLOCKED for that domain.

Expected behavior
WebFetch should succeed against arbitrary domains, matching the environment's configured "Full access" network policy — the same as it would in an interactive Claude Code cloud session using the same environment.

Actual behavior
WebFetch fails with EGRESS_BLOCKED on every domain tested (8+ distinct hosts across two separate runs, including en.wikipedia.org as a control). WebSearch works fine in the same runs.

Querying the sandbox's own proxy diagnostic ($HTTPS_PROXY/__agentproxy/status) from inside the run shows the actual applied allowlist is limited to package registries only:

registry.npmjs.org, jsr.io, npm.jsr.io, pypi.org, files.pythonhosted.org, api.anthropic.com, ...

No general internet domains are present, despite the environment's UI showing "Full access."

Hypothesis

Scheduled/triggered routine runs may not be inheriting the environment's saved network access policy the way interactive sessions do — or the setting isn't being persisted/applied correctly for this environment.