Remove engagement-purchase wording from public docs and tests.

Author: lanbytes

README.md

@@ -180,8 +180,8 @@ Hermes XAPI never accepts credentials through tool arguments. Auth is read from
 environment variables and injected by the plugin at request time.
 
 Never commit API keys, cookies, tokens, or other credentials. The plugin blocks
-cookie/token helper routes, engagement-purchase routes, auto-cookie posting,
-profile mutation, list creation, and sentiment routes from the agent catalog.
+credential-helper routes, profile mutation, list creation, and sentiment routes
+from the agent catalog.
 Gated endpoints stay behind `xapi_action`, which is hidden unless
 `HERMES_XAPI_ENABLE_ACTIONS=true`.
 

tests/test_build_catalog.py

@@ -35,7 +35,7 @@ def test_build_skips_twexapi_agent_prohibited_endpoints(tmp_path: Path) -> None:
         tmp_path,
         {
             "/twitter/{auth_token}/cookie": {"get": {"summary": "Get cookie"}},
-            "/twitter/action": {"post": {"summary": "Purchase engagement"}},
+            "/twitter/action": {"post": {"summary": "Prohibited route"}},
             "/twitter/profile": {"post": {"summary": "Modify profile"}},
             "/twitter/{screen_name}/about": {
                 "get": {"summary": "Get profile", "tags": ["Twitter User About"]}

tests/test_tools.py

@@ -311,7 +311,7 @@ def test_action_blocks_prohibited_twexapi_endpoint(monkeypatch: pytest.MonkeyPat
                 "method": "POST",
                 "path": "/twitter/action",
                 "body": {"quantity": 100},
-                "reason": "engagement purchase",
+                "reason": "prohibited route",
             }
         )
     )