initial commit

skills/devops/hermes-maintenance/references/config-cleanup-example.md

@@ -0,0 +1,38 @@
+# Example: Config Cleanup Session
+
+Real before/after from a config review of a DeepSeek-based Hermes install.
+
+## Removed (dead weight)
+
+| Key | Why |
+|-----|-----|
+| `API_SERVER_KEY` (plaintext) | Secret — moved to `.env` as `HERMES_API_SERVER_KEY` |
+| `PROVIDER: deepseek` (top-level) | Orphaned; `model.provider` already covers this |
+| `MODEL: deepseek-v4-flash` (top-level) | Orphaned; `model.default` already covers this |
+| `terminal.docker_image` | Unused — `terminal.backend: local` |
+| `terminal.container_cpu` | Unused — local backend |
+| `terminal.container_memory` | Unused — local backend |
+| `terminal.container_disk` | Unused — local backend |
+| `terminal.container_persistent` | Unused — local backend |
+| `terminal.persistent_shell` | Unused — local backend |
+| `terminal.lifetime_seconds` | Unused — local backend |
+
+## Changed
+
+| Key | Before | After |
+|-----|--------|-------|
+| 11× `auxiliary.*.api_key` | `''` | `${DEEPSEEK_API_KEY}` |
+| `delegation.api_key` | `''` | `${DEEPSEEK_API_KEY}` |
+
+## Added
+
+| Key | Value | Why |
+|-----|-------|-----|
+| `approvals.mode` | `smart` | Auto-approve low-risk commands, reduce prompt fatigue |
+
+## Result
+
+- Lines: 180 → 176
+- 0 plaintext secrets in config
+- All API keys reference env vars explicitly
+- Smart approvals confirmed working (auto-approved the Python edit command)