# Example: Config Cleanup Session

Real before/after from a config review of a DeepSeek-based Hermes install.

## Removed (dead weight)

| Key | Why |
|-----|-----|
| `API_SERVER_KEY` (plaintext) | Secret — moved to `.env` as `HERMES_API_SERVER_KEY` |
| `PROVIDER: deepseek` (top-level) | Orphaned; `model.provider` already covers this |
| `MODEL: deepseek-v4-flash` (top-level) | Orphaned; `model.default` already covers this |
| `terminal.docker_image` | Unused — `terminal.backend: local` |
| `terminal.container_cpu` | Unused — local backend |
| `terminal.container_memory` | Unused — local backend |
| `terminal.container_disk` | Unused — local backend |
| `terminal.container_persistent` | Unused — local backend |
| `terminal.persistent_shell` | Unused — local backend |
| `terminal.lifetime_seconds` | Unused — local backend |

## Changed

| Key | Before | After |
|-----|--------|-------|
| 11× `auxiliary.*.api_key` | `''` | `${DEEPSEEK_API_KEY}` |
| `delegation.api_key` | `''` | `${DEEPSEEK_API_KEY}` |

## Added

| Key | Value | Why |
|-----|-------|-----|
| `approvals.mode` | `smart` | Auto-approve low-risk commands, reduce prompt fatigue |

## Result

- Lines: 180 → 176
- 0 plaintext secrets in config
- All API keys reference env vars explicitly
- Smart approvals confirmed working (auto-approved the Python edit command)