diff --git a/hermes-config-template.prose.md b/hermes-config-template.prose.md
index aec6746..b5a1e31 100644
--- a/hermes-config-template.prose.md
+++ b/hermes-config-template.prose.md
@@ -183,6 +183,21 @@ delegation:
   base_url: http://192.168.68.116/v1
   api_key_env: LITELLM_API_KEY
 
+# ─── External Agents (DeepSeek-primary) ───
+
+Koby (.129) is a DeepSeek-primary external agent.
+
+- Primary Model: deepseek-v4-flash (via api.deepseek.com)
+
+- LitellM Access: Koby uses LITELLM_API_KEY for all harness-linked tasks
+
+  (vision, web_extract, compression, etc.).
+
+- Rule: Do NOT change Koby's primary model to syslog-auto unless 
+
+  DeepSeek-specific reasoning is no longer required.
+
+
 # ─── Custom Provider ───
 custom_providers:
   - name: harness
@@ -379,6 +394,15 @@ curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $K" http://192.
 - `/etc/environment` is NO LONGER the canonical key source (stale values there caused 401s).
 - Do NOT leave a hardcoded stale key in `/etc/environment` — it shadows the drop-in/wrapper.
 
+### Rule 13: Koby Configuration (DeepSeek-primary)
+
+Koby uses a split-model architecture:
+
+- Primary Model: `deepseek-v4-flash` via `api.deepseek.com` (for reasoning)
+- Auxiliary Models: `gpu-light` (vision/web_extract) and `syslog-auto` (compression)
+- Key Hygiene: `api_key_env` is strictly `LITELLM_API_KEY` or `DEEPSEEK_API_KEY`
+- Constraint: Do NOT touch Koby's primary model/provider/compression settings unless explicitly ruled by the captain.
+
 ### Rule 14: Provider Name Must Match custom_providers Name (ADDED 2026-07-19, WAL #1471)
 
 - `model.provider` MUST be `harness` (the `custom_providers[0].name`), NOT the literal string `custom`
diff --git a/hermes-key-enforcement.prose.md b/hermes-key-enforcement.prose.md
index 544b2e7..b730520 100644
--- a/hermes-key-enforcement.prose.md
+++ b/hermes-key-enforcement.prose.md
@@ -190,7 +190,7 @@ litellm_settings:
 |-------|-----|-----|---------------|------------|--------|-----------------|---------------|
 | Tanko | 112 | .122 | `tanko` | Infisical vault | ✅ Fixed | `infisical run` | 20:17 UTC Jul 5 |
 | Mumuni | 100 (abiba) | .24 | `mumuni` | Infisical vault | ✅ Fixed | Pi Hermes gateway | 2026-07-27 |
-| Koby | 111 | .129 | `koby` | Infisical vault | ✅ Fixed | `infisical run` | 23:30 UTC Jul 5 |
+| Koby | 111 | .129 | `koby` | Infisical vault | ✅ Fixed | `infisical run` | 23:30 UTC Jul 5 | (DeepSeek-primary)|
 | Koonimo | 113 | .113 | `koonimo` | Infisical vault | ✅ Fixed | `infisical run` (migrated 2026-07-11) | 2026-07-11 |
 | Abiba | 100 | .65 | `abiba-pi` | Infisical vault | ✅ N/A (pi native) | — | 19:44 UTC Jul 5 |
 | Kagenz0 | 105 | .14 | — | — | ❌ DOWN | — | 19:14 EDT Jul 4 |
@@ -202,10 +202,10 @@ litellm_settings:
 
 | Agent | `/litellm/v1/responses` | Deprecated `/v1` | Status |
 |-------|--------------------------|--------------------|--------|
-| Mumuni | ✅ 5 sections | 0 | ✅ Authenticated |
-| Tanko | ⚠️ No SSH access | — | Needs check |
-| Koby | ⚠️ No route to host | — | Needs check |
-| Koonimo | ⚠️ Connection timed out | — | Needs check |
+| Mumuni | ✅ harness provider | ✅ auxiliary on /v1 (valid) | ✅ Authenticated (verified 2026-08-09) |
+| Tanko | ✅ 5 sections | 0 | ✅ Migrated 2026-08-08, keys 200 |
+| Koby | ✅ custom provider (harness name) | — | ✅ External DeepSeek primary (intentional, captain ruling 2026-08-11) |
+| Koonimo | ✅ .114 (baggy) | — | ✅ 128K context applied 2026-08-09 |
 
 ### Systemd Service Pattern (2026-07-11 — vault migration)