policy: track node deny command coverage

giodl73-repo · giodl73-repo · commit 832cb3c48880 · 2026-07-04T15:06:10.000-07:00
diff --git a/scripts/lib/policy-config-coverage.jsonc b/scripts/lib/policy-config-coverage.jsonc
@@ -26,7 +26,7 @@
     "gateway.http.endpoints.*.*.urlAllowlist.*",
     "gateway.http.endpoints.*.enabled",
     "gateway.mode",
-    "gateway.nodes.allowCommands.*",
+    "gateway.nodes.denyCommands.*",
     "gateway.remote.enabled",
     "gateway.tailscale.mode",
     "gateway.tailscale.preserveFunnel",
@@ -409,11 +409,11 @@
       "reason": "Policy observes URL-fetch allowlists on Gateway HTTP inputs.",
     },
     {
-      "pattern": "gateway.nodes.allowCommands.*",
+      "pattern": "gateway.nodes.denyCommands.*",
       "status": "observed",
       "area": "gateway",
       "policy": "gateway.nodes.denyCommands",
-      "reason": "Policy observes allowed node commands so privileged node command surfaces can be denied by policy.",
+      "reason": "Policy observes denied node commands so privileged node command surfaces can be denied by policy.",
     },
     {
       "pattern": "mcp.servers.*.command",
