[moonlight16]

Follow-up to #535 (moca-delegate-task rebuilt on mocactl) and #544 (Kind demo for the skill), from Paolo's review.

• Permissions: SKILL.md and the README now say plainly that the allowlist removes Claude Code's prompt before ctx pack and workloads create, the two steps that upload local files, and offer settings.restricted.example.json, which keeps those two on prompt.
• Local copy: the skill packs into a mktemp -d directory outside the working tree and deletes it at cleanup.
• Naming: the flow doc and diagram name POST /v1/runs.
• Demo isolation: setup.sh and run.sh pin SH_CONTROL_PLANE_URL and SH_HARNESS_URL to the demo, so a real deployment's exported URLs never receive the demo token or upload.
• Demo safety: --delete removes only a state directory carrying the demo's marker, and --skip-build fails fast if the Context Service image isn't on the cluster.
• deploy/k8s/setup.sh honours KIND_CLUSTER (default moca), with a comment that the demo depends on it.

🤖 Generated with Claude Code

[ingpaolodettori-dev]

Follow-up to our #535/#544 reviews. I checked all six items against the code at 5474f2f and they're addressed:

• Permissions: SKILL.md and the README now say plainly that the full allow-list removes the prompt before ctx pack/workloads create. The new settings.restricted.example.json keeps both of those on prompt (it allows only spawn/subagents/get/workloads get/delete).
• Local copy: the packed file goes in a mktemp -d dir and is removed at cleanup.
• POST /v1/runs is now used in the flow doc and the SVG, matching leaf-turn.ts.
• run.sh and setup.sh pin SH_CONTROL_PLANE_URL/SH_HARNESS_URL to the demo. That's the right fix, because mocactl ranks env over config (config.ts:192-194).
• --delete uses the marker guard, and --skip-build fails fast through crictl inspecti.
• deploy/k8s/setup.sh now reads KIND_CLUSTER from env (default moca), and KIND_CONTEXT is derived from it, so the demo's post-source override still works.

One suggestion: the new mktemp -d/rm -r steps aren't in either allow-list, so "Nothing prompts" isn't accurate any more. One nit on the marker refusal message. CI is green, and the single commit is signed off.

[ingpaolodettori-dev]

suggestion — "Nothing prompts" is no longer true after this PR. Step 1 now runs mktemp -d and step 6 runs rm -r TMP_DIR, and neither settings.example.json nor settings.restricted.example.json allows them. So with either set, Claude Code still prompts (or falls back to the classifier, which is what #530 is about) on every delegation. The same goes for "Delegation needs only these commands" (L137). Suggest adding "Bash(mktemp -d)" to both example files and to the JSON block below. Leave rm -r off the allow-list, since a wildcard rm -r * rule is much broader than this skill needs. Then say here that the cleanup rm -r TMP_DIR is the one command that still asks.

[moonlight16]

Done in bc2a769.

[ingpaolodettori-dev]

nit — anyone who ran the #544 demo before this change has a state dir with no marker, so their first --delete after upgrading deletes the cluster (L74) and then dies here. The refusal itself is right. The message could also say what to do, e.g. …marker; if it is the demo's, remove it yourself (rm -rf $STATE_DIR), so it doesn't read like the cluster delete failed.

[moonlight16]

Done in bc2a769.

[ingpaolodettori-dev]

Follow-up at bc2a769: both items from the 5474f2f review are addressed. Bash(mktemp -d) is now allowed in both example settings files and the SKILL.md block, the doc states that the cleanup rm -r TMP_DIR still asks, and the --delete refusal message now explains the cluster was deleted and how to remove a pre-marker state dir by hand. No new issues.