From 001a8ff2ea62fe1aef4ab2bdee5103538f6b11bc Mon Sep 17 00:00:00 2001
From: jwbron <8340608+jwbron@users.noreply.github.com>
Date: Mon, 27 Apr 2026 17:59:33 +0000
Subject: [PATCH 1/2] docs: document confluence.spaces in config/README.md

Add confluence.spaces allowlist section to the context-filters.yaml
documentation in config/README.md, mirroring the existing jira.projects
section. The confluence gateway wrapper (PR #2141) added this configuration
key but the README only covered the jira.projects allowlist.

Authored-by: egg
---
 config/README.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/config/README.md b/config/README.md
index 02bbbc3f2b..053d101674 100644
--- a/config/README.md
+++ b/config/README.md
@@ -275,3 +275,22 @@ jira:
 - **Keys must match Atlassian format**: uppercase letter followed by uppercase letters, digits, or underscores (`[A-Z][A-Z0-9_]*`). Invalid entries are logged and ignored.
 - **Empty list** (`projects: []`): No Jira projects accessible — all ticket/search/execute requests return 403.
 - **Hot-reloadable**: Changes are picked up via `POST /api/v1/config/reload` or SIGHUP without restarting the gateway.
+
+### `confluence.spaces` — Confluence Space Allowlist
+
+The `confluence` section controls which Confluence spaces are accessible through the gateway's
+`/api/v1/confluence/*` routes. Agents can only read pages, descendants, comments, and search results
+from allowlisted spaces. Fail-closed: missing file, missing section, or malformed YAML results in
+an empty allowlist (no space accessible).
+
+```yaml
+confluence:
+  spaces:
+    - ENG      # Engineering space
+    - DOCS     # Documentation space
+```
+
+- **Keys must match Atlassian space key format**: leading letter followed by letters, digits, or underscores (`[A-Z][A-Z0-9_]*`). Case-sensitive.
+- **Empty list** (`spaces: []`): No Confluence spaces accessible — all page/search/execute requests return 403.
+- **Hot-reloadable**: Changes are picked up via `POST /api/v1/config/reload` or SIGHUP without restarting the gateway.
+- **CQL scope enforcement**: `confluence search` CQL queries must statically reference only allowlisted spaces — see [Confluence Wrapper Reference](../docs/reference/confluence-wrapper.md) for the extractor rules.

From f20a09b0fe44af8fec6cf486b9955ab8f937d535 Mon Sep 17 00:00:00 2001
From: "egg-reviewer[bot]"
 <261018737+egg-reviewer[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 18:11:48 +0000
Subject: [PATCH 2/2] docs: fix confluence.spaces regex and clarify wording

Address reviewer feedback on PR #2149:

- Correct the regex from `[A-Z][A-Z0-9_]*` to `[a-zA-Z][a-zA-Z0-9_]*`
  to match `_SPACE_KEY_RE` in gateway/confluence_policy.py:65 (the
  Confluence policy accepts mixed-case keys, unlike Jira).
- Reword the case-sensitivity note with a concrete example so it does
  not compound with the (now corrected) regex.
- Add the 'Invalid entries are logged and ignored' clause for symmetry
  with the jira.projects entry; behavior matches confluence_policy.py:178.
- Broaden the empty-list 403 enumeration from 'page/search/execute' to
  'page, space, search, and execute' so space/list is covered.

Authored-by: egg
---
 config/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/README.md b/config/README.md
index 053d101674..849cb67bec 100644
--- a/config/README.md
+++ b/config/README.md
@@ -290,7 +290,7 @@ confluence:
     - DOCS     # Documentation space
 ```
 
-- **Keys must match Atlassian space key format**: leading letter followed by letters, digits, or underscores (`[A-Z][A-Z0-9_]*`). Case-sensitive.
-- **Empty list** (`spaces: []`): No Confluence spaces accessible — all page/search/execute requests return 403.
+- **Keys must match Atlassian space-key shape**: leading letter followed by letters, digits, or underscores (`[a-zA-Z][a-zA-Z0-9_]*`). Lookups are case-sensitive (e.g., `ENG` ≠ `eng`). Invalid entries are logged and ignored.
+- **Empty list** (`spaces: []`): No Confluence spaces accessible — all page, space, search, and execute requests return 403.
 - **Hot-reloadable**: Changes are picked up via `POST /api/v1/config/reload` or SIGHUP without restarting the gateway.
 - **CQL scope enforcement**: `confluence search` CQL queries must statically reference only allowlisted spaces — see [Confluence Wrapper Reference](../docs/reference/confluence-wrapper.md) for the extractor rules.