Refactor egress allowlist experiment names to dash-case

[AbhishekBhaskar]

What are you trying to accomplish?

Fix a dash/underscore key mismatch between the proxy and the API for the egress-allowlist experiment flags.

The proxy read the observe/enforce experiments as proxy_egress_observe / proxy_egress_enforce (underscores). But the API serializes job experiments through the JSON:API adapter, whose default key transform is dash — so in the job-details payload the keys actually arrive as proxy-egress-observe / proxy-egress-enforce, like every other forwarded experiment. With the underscore keys, Experiments.Enabled(...) never matched, so the egress allowlist would silently stay in fail-open mode no matter how the experiment was configured.

This renames the constants to dash-case so the flags actually activate when the experiment is enabled.

Anything you want to highlight for special attention from reviewers?

• Pure key-string rename — no behavioral/logic change beyond making the flags match what the API sends. The constants are the single source of truth; the handler already keys off them.
• Updated the two proxy-level integration tests (TestProxyEgressAllowlistEnforceBlocks / TestProxyEgressAllowlistObserveAllows) that hard-coded the old underscore keys — otherwise they'd have silently stopped exercising enforce/observe.
• Added a regression test that pins the contract: it asserts the constants equal the literal dash keys, that Enabled("proxy-egress-observe") is true on a dash-keyed experiments map, that the underscore form does not match, and that a handler built from the dash-keyed payload enters observe mode.

How will you know you've accomplished your goal?

• New TestEgressAllowlist_DashCasedExperimentKeys locks in the dash-key behavior.
• Full suite + gofmt / go vet pass locally (go test ./...).
• End-to-end: with the experiment enabled, the proxy now logs (observe) / blocks (enforce) non-allowlisted hosts instead of staying fail-open.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The regression test can pass while the handler remains fail-open; it should assert an observe-only side effect.

Review tier: Lite (auto)
Findings: None

Note

Copilot is running an experiment and ran this review at Lite.

What changed in this PR

Fixes egress allowlist experiment matching by aligning proxy constants with the API’s dash-case keys.

Changes:

• Renamed observe/enforce experiment constants.
• Updated integration tests.
• Added dash-case regression coverage.

File	Summary
proxy_test.go	Uses dash-case experiment keys.
internal/​handlers/​egress_allowlist.go	Updates experiment constants and documentation.
internal/​handlers/​egress_allowlist_test.go	Adds dash-case contract testing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-thavaahariharangit]

LGTM