Emergency ruleStop the process and revoke or cap the provider credential first. Local configuration is not an authoritative spending limit.

One setting, four different boundaries.

VisibilityCatalog

models: [] advertises nothing. It does not unregister the adapter.

Chat routeLLM adapter

llm-deepseek still owns deepseek-official.

Search routeWeb provider

web-search-deepseek makes a separate Messages API request.

Close the machine-wide routes.

- id: agent-default-model
  config:
    provider: my-approved-provider
    model: my-approved-model

- id: llm-deepseek
  disabled: true

- id: web-search-deepseek
  disabled: true

- id: tool-web
  disabled: true

Write this to $DSH_HOME/cordis.patch.yml only after proving the replacement model. The home patch applies after bundle and per-profile layers.

Prove the effective graph before boot.

dsh --profile web --dump-config > effective-web.yml
rg -n 'agent-default-model|llm-deepseek|web-search-deepseek|tool-web|disabled' effective-web.yml
Default

Approved provider and model.

Chat

DeepSeek adapter disabled.

Search

Provider and tool disabled.

Egress

No DeepSeek API destination observed.

Configuration is necessary, not sufficient.

Stop older processes, use a fresh Session, observe DNS/proxy/firewall logs, and check provider usage after its reporting delay.

Telemetry is separate.

The rc.7 telemetry mode defaults to DISABLED. Set DSH_TELEMETRY_DISABLED=1 to hard-disable its row, but do not present telemetry evidence as proof of zero model spend.

Primary evidence.

Do not stop at a quiet model picker.

The canonical guide includes the emergency stop, exact patch semantics, profile-by-profile checks, egress proof, telemetry separation, and twelve regression gates.

Read the complete runbook