@lead: node1-ssh skill points to homelab opencode.json allowlist instead of inventing one

.gitea/workflows/agent.yml

@@ -172,44 +172,43 @@ jobs:
           cat > ~/.config/opencode/skills/node1-ssh/SKILL.md <<'SKILLET'
           ---
           name: node1-ssh
-          description: Read-only diagnostics on the swarm node — use when debugging a deploy or checking a running service.
+          description: Read-only diagnostics on the swarm host via `ssh node1 …` — use when debugging a deploy or checking a running service.
           domains: [swarm]
           tags: [ssh, swarm, diagnostics, docker]
           ---
 
           # `node1-ssh` Skill
 
-          Use this skill to run read-only commands against **node1** (the Docker Swarm host) when:
+          Use this skill to run **read-only** commands against **node1** (the Docker Swarm host) when:
           - A deploy failed and you need to inspect running services.
           - You need to see a service's logs for debugging.
-          - An agent on homelab can't be reached and you want to check the stack from another node.
+          - You want to check the state of the stack on the swarm.
 
           ## How it works
 
-          Commands run via `ssh node1 <read-only cmd>`. The SSH alias is set up in `${HOME}/.ssh/config`
+          Commands run via `ssh node1 <cmd>`. The SSH alias is configured in `${HOME}/.ssh/config`
           during this workflow (only when swarm secrets are configured for the caller repo).
-          Read access is enforced by the homelab repo's own OpenCode allowlist: **no other ssh hosts or any write commands on node1 are permitted**.
 
-          ## Allowed commands
+          ## What you're actually allowed to run — the allowlist is the source of truth
 
-          The following read-only commands work via `ssh node1`. Wrap your command in single quotes and escape any `$` signs used inside the remote shell.
+          This skill does **not** define which commands are permitted, and you must not assume a fixed
+          list here. The single source of truth for exactly which `ssh node1 …` commands are allowed is
+          the **caller repo's own OpenCode permission config** (e.g. `opencode.json` in the homelab repo:
+          a `deny "ssh *"` with specific `allow "ssh node1 …"` entries, last-match-wins).
 
-          - List services:        `docker service ls`
+          - Only read-only diagnostics are permitted; any write/mutating command on node1 is denied.
-          - Service details:      `docker service ps <name> [--format ...]`
+          - The permission layer enforces this — if a command is not on the caller's allowlist it will be
-          - View logs:            `docker service logs <name> [--tail N] [--since 24h] [--timestamps]`
+            blocked, regardless of what this skill or any other allowlist says.
-          - Network info:         `docker network ls`, `docker network inspect <name>`
+          - So: reach for `ssh node1 …` for read-only diagnostics, and treat the caller's `opencode.json`
-          - Volumes:              `docker volume ls [-f dangling=true]`
+            `ssh node1` allow-entries as the authoritative list of what will actually run.
-          - Swarm nodes:          `docker node ls`, `docker node inspect self`, `docker node ps --host node1`
-
-          The same read-only constraint applies — write commands on node1 are rejected by the allowlist even if they appear in other allowlists.
 
           ## Example
 
-          > The frontend returned a 5xx after deploy #47.
+          > The frontend returned a 5xx after a deploy.
           >
-          > Action:
+          > Action (a read-only log inspection, subject to the caller's allowlist):
           > ```
-          > ssh node1 "docker service logs --tail 100 --timestamps frontend"
+          > ssh node1 "docker service logs --tail 100 --timestamps homelab_frontend"
           > ```
           SKILLET
           chmod -R o=rX ~/.config/opencode/skills/node1-ssh