DL-126
Agent-dir-anchored categories (rules/, agents/, models.yml) are delivered per SDK seam — rules/ as a composed rules: Rule[] object injection, agents/ and models.yml via user-level symlinks; the CD-3 server-door credential denylist extends to models.yml BOTH credential surfaces — providers.<name>.apiKey AND providers.<name>.headers.* literal secrets (env-indirection references pass; non-env-indirection literals are rejected with a client warning), because header values materialize outbound value-first
Status: Active (Matt, 2026-08-03)