From c4ab31e56b6dd1a8f2e63034d7030270e45875f3 Mon Sep 17 00:00:00 2001
From: root <root@abiba.sysloggh.net>
Date: Sun, 5 Jul 2026 08:46:32 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20incorporate=20Mumuni=20review=20?=
 =?UTF-8?q?=E2=80=94=20recursive=20detection=20query=20+=20safe-mutate=20c?=
 =?UTF-8?q?ross-reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hermes-key-enforcement.prose.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hermes-key-enforcement.prose.md b/hermes-key-enforcement.prose.md
index 4b50ed4..67bc906 100644
--- a/hermes-key-enforcement.prose.md
+++ b/hermes-key-enforcement.prose.md
@@ -74,8 +74,9 @@ model:
 Run on any Hermes host to detect violations:
 
 ```bash
-grep -n 'api_key: sk-' /root/.hermes/config.yaml \
-  | grep -v 'deepseek\|b7d9\|openai\|anthropic\|DEEPSEEK'
+grep -rn 'api_key: sk-' /root/.hermes/ \
+  --include='config.yaml' \
+  | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
 ```
 
 If any output — violation. Fix immediately.
@@ -157,6 +158,7 @@ EnvironmentFile=/etc/environment
 4. **Restart** — gateway must restart to pick up env var
 5. **Confirm** — test key against LiteLLM: `curl -H "Authorization: Bearer $KEY" .../v1/models` → 200
 6. **Update** — bump the verified table above
+7. **Use safe-mutate** — if the fix requires changing `/etc/environment` or restarting the gateway on a remote host, use `safe-mutate` to verify current state before mutating.
 
 ## Related Contracts