Merge commit 'refs/codex/pr1006/master' into worktree/pr1006-merge-20260731

# Conflicts:
#	docs/architecture.i18n.yaml
#	docs/config-catalog.md
#	docs/cordis-catalog/services.md
#	docs/core-data-structures/core.i18n.yaml
#	examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
#	examples/headless-agent/cordis.yml
#	packages/cordis/tool-cordis/src/api-catalog.ts
#	packages/llm/llm-deepseek/README.i18n.yaml
#	packages/llm/llm-deepseek/README.md
#	packages/llm/llm-deepseek/README.zh.md
#	packages/llm/llm-deepseek/src/adapter.ts
#	packages/llm/llm-deepseek/src/index.ts
#	packages/llm/llm-deepseek/tests/adapter.spec.ts
#	packages/llm/llm/README.i18n.yaml
#	packages/llm/llm/README.md
#	packages/llm/llm/README.zh.md
#	packages/subagent/subagent-dsh-sdk/README.i18n.yaml
#	packages/ui/jsonrpc/README.i18n.yaml

examples/headless-agent/cordis.yml

@@ -1,16 +1,28 @@
 # One-shot coding agent with format-pure stdout. The app bin loads the
-# gitignored root `.env`; this file reads `DEEPSEEK_API_KEY` and optional
-# `DEEPSEEK_BASE_URL` through `!!js`.
+# gitignored root `.env` into the process environment; entry configs here are
+# the composition base, while user-plane values resolve per request through
+# the two providers below.
+
+# User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): a
+# `llm-deepseek:` section there overrides the adapter entry below without a
+# restart.
+- id: settings
+  name: '@deepseek-ai/dsh-settings-local'
+
+# Credential store: the live process environment over `$DSH_HOME/.env`
+# (owner-only file, hot-reloaded). The adapter resolves `DEEPSEEK_API_KEY`
+# through it at each request, so no key is inlined in this file.
+- id: credentials
+  name: '@deepseek-ai/dsh-credentials-local'
 
 # The DeepSeek adapter. Swap to '@deepseek-ai/dsh-llm-pi-ai' for the pi-ai-backed
-# twin (same config shape; `reasoning: high` replaces thinking/reasoningEffort).
-# Shipped default: full thinking at max effort on every request. Exact-model
-# resolution materializes request defaults before the request header is logged.
+# twin (a `providers` dict keyed by route; `reasoning: high` replaces
+# thinking/reasoningEffort). Shipped default: full thinking at max effort on
+# every request. Exact-model resolution materializes request defaults before
+# the request header is logged.
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
   config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
-    baseURL: !!js process.env.DEEPSEEK_BASE_URL
     thinking: enabled
     reasoningEffort: max
     models:
@@ -32,7 +44,7 @@
 - id: cli-agent
   name: '@deepseek-ai/dsh-cli-demo'
   config:
-    provider: deepseek
+    provider: deepseek-official
     # Stays on flash: the goal/ralph replay corpora were recorded on it, and
     # their nested-include overlays cannot re-pin the app config (a config
     # patch cannot target an entry behind a nested include).