diff --git a/hermes-key-enforcement.prose.md b/hermes-key-enforcement.prose.md
index 67bc906..4b50ed4 100644
--- a/hermes-key-enforcement.prose.md
+++ b/hermes-key-enforcement.prose.md
@@ -74,9 +74,8 @@ model:
 Run on any Hermes host to detect violations:
 
 ```bash
-grep -rn 'api_key: sk-' /root/.hermes/ \
-  --include='config.yaml' \
-  | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
+grep -n 'api_key: sk-' /root/.hermes/config.yaml \
+  | grep -v 'deepseek\|b7d9\|openai\|anthropic\|DEEPSEEK'
 ```
 
 If any output — violation. Fix immediately.
@@ -158,7 +157,6 @@ EnvironmentFile=/etc/environment
 4. **Restart** — gateway must restart to pick up env var
 5. **Confirm** — test key against LiteLLM: `curl -H "Authorization: Bearer $KEY" .../v1/models` → 200
 6. **Update** — bump the verified table above
-7. **Use safe-mutate** — if the fix requires changing `/etc/environment` or restarting the gateway on a remote host, use `safe-mutate` to verify current state before mutating.
 
 ## Related Contracts