Fix no-mistakes warnings: remove prose from fence, reorder/renumber rules, and add Koby exception to Rule 10

hermes-config-template.prose.md

@@ -1,4 +1,3 @@
-Fixed no-mistakes: removed prose from YAML fence, renamed Rule 13→16, fixed Koby table cell
 ---
 kind: template
 name: hermes-config-template
@@ -297,6 +296,7 @@ The following MUST be identical across ALL profiles:
 - See `devops-hermes-compression` skill for full reference
 
 ### Rule 10: Default Model Must Be `syslog-auto` (All Agents)
+- **Koby Exception**: Per captain ruling 2026-08-11, Koby is a DeepSeek-primary external agent; its primary model remains `deepseek-v4-flash` (via api.deepseek.com to preserve DeepSeek-specific reasoning, while other sections follow Rule 10.
 - **Hermes agents**: `model.default: syslog-auto`, `custom_providers[0].model: syslog-auto`
 - **pi agents**: `defaultModel: syslog-auto` in `settings.json`, first model in `models.json`
 - `syslog-auto` is the LiteLLM routing model — it load-balances between strix-moe
@@ -386,15 +386,6 @@ curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $K" http://192.
 - `/etc/environment` is NO LONGER the canonical key source (stale values there caused 401s).
 - Do NOT leave a hardcoded stale key in `/etc/environment` — it shadows the drop-in/wrapper.
 
-### Rule 16: Koby Configuration (DeepSeek-primary)
-
-Koby uses a split-model architecture:
-
-- Primary Model: `deepseek-v4-flash` via `api.deepseek.com` (for reasoning)
-- Auxiliary Models: `gpu-light` (vision/web_extract) and `syslog-auto` (compression)
-- Key Hygiene: `api_key_env` is strictly `LITELLM_API_KEY` or `DEEPSEEK_API_KEY`
-- Constraint: Do NOT touch Koby's primary model/provider/compression settings unless explicitly ruled by the captain.
-
 ### Rule 14: Provider Name Must Match custom_providers Name (ADDED 2026-07-19, WAL #1471)
 
 - `model.provider` MUST be `harness` (the `custom_providers[0].name`), NOT the literal string `custom`
@@ -433,3 +424,13 @@ Koby uses a split-model architecture:
 5. **Set model choice** — Per agent's workload
 6. **Verify** — curl all shared endpoints, test the model with the new key
 7. **Report** — What was changed, preserved, custom
+### Rule 16: Koby Configuration (DeepSeek-primary)
+(Ref: See Rule 10 for default model behavior, with Koby exception)
+
+Koby uses a split-model architecture:
+
+- Primary Model: `deepseek-v4-flash` via `api.deepseek.com` (for reasoning)
+- Auxiliary Models: `gpu-light` (vision/web_extract) and `syslog-auto` (compression)
+- Key Hygiene: `api_key_env` is strictly `LITELLM_API_KEY` or `DEEPSEEK_API_KEY`
+- Constraint: Do NOT touch Koby's primary model/provider/compression settings unless explicitly ruled by the captain.
+