✗ example.com:443 is blocked — no approved rule allows it.

Add this rule under box.egress_rules in .agent/project.yaml:

  - to: {domain: "example.com"}
    protocol: tls
    ports: [443]

Then run:
  coop approve
