Document that kiosk and BNPL have no sandbox test path; fix /paymob-test-cards overpromising

README.md

@@ -137,7 +137,7 @@ Once the plugin is installed, these slash commands give direct access to the mos
 
 | Command | What it does |
 |---|---|
-| `/paymob-test-cards [card\|wallet\|kiosk]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. |
+| `/paymob-test-cards [card\|wallet\|kiosk\|bnpl]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. For kiosk and BNPL it reports that sandbox can't test them at all, rather than offering a card as a stand-in. |
 | `/paymob-explain-error <code, status, or message>` | Looks up a Paymob error against the Troubleshooting table in `SKILL.md`, explains the cause, and — for code fixes — pulls the corrected snippet from the matching `references/code-*.md` file for your stack. Falls back to `references/live-resources.md` for anything not in the table instead of guessing. |
 | `/paymob-check-hmac [path]` | Statically audits your webhook HMAC verification against `references/hmac-verification.md`: SHA-512 (not SHA-256), exact field order, `body.obj` sourcing, no `obj.id`/`obj.order.id` mix-up, fail-closed behavior, and unique-constraint-backed idempotency. Never asks you to paste your HMAC secret or API key; only invoked manually, never automatically. |
 

commands/paymob-test-cards.md

@@ -1,6 +1,6 @@
 ---
-description: Show Paymob sandbox test cards, wallet, and kiosk credentials, optionally filtered by payment method.
-argument-hint: "[card|wallet|kiosk]"
+description: Show Paymob sandbox test card and wallet credentials, optionally filtered by payment method.
+argument-hint: "[card|wallet|kiosk|bnpl]"
 allowed-tools: Read
 ---
 
@@ -9,7 +9,8 @@ Read `${CLAUDE_PLUGIN_ROOT}/skills/paymob-integration/references/test-credential
 Argument handling for `$ARGUMENTS`:
 - `card` → show only the Mastercard and Visa test card sections.
 - `wallet` → show only the test mobile wallet section.
-- `kiosk` → this reference file does not currently list kiosk sandbox credentials. Say so explicitly, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com` to get current kiosk sandbox details — do not invent kiosk numbers.
+- `kiosk`, `bnpl`, or a named BNPL provider (Valu, Souhoola, Tabby, Tamara, Sympl, …) → report what the file's **Methods with no sandbox test path** section says. Do not offer a workaround that section doesn't list, and do not substitute a test card so the method looks covered.
+- Any other method the file has no section for (Apple/Google Pay, bank installments) → say plainly that the file has no entry for it, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com`. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how that method's sandbox flow works either — if it isn't in the reference file, it isn't established here.
 - No argument → show all sections the file contains (cards and wallet).
 
 Always carry over, verbatim in meaning, these two caveats from the source file regardless of which filter was used:

skills/paymob-integration/references/test-credentials.md

@@ -36,6 +36,20 @@ Use these **only** with Test-mode keys and Test-mode Integration IDs. Never use
 - MPIN code: `123456`
 - OTP: `123456`
 
+## Methods with no sandbox test path
+
+⚠️ **These methods cannot be tested in sandbox at all.** No test credentials exist for them, and a payment cannot be completed end-to-end in Test mode. (Confirmed with Paymob, August 2026.)
+
+- **Kiosk** — Aman, Masary
+- **BNPL** — Valu, Souhoola, Tabby, Tamara, Sympl, and the other providers
+
+What that means in practice:
+
+- Do **not** substitute a test card for one of these methods and record it as validated — that exercises the card rail, not theirs.
+- **A green sandbox run does not cover them.** If the merchant is enabling kiosk or BNPL, tell them *before* they plan go-live, not after: cards and wallets validate in sandbox as normal, but these have to be verified with their Paymob account manager or `support@paymob.com`. The Phase 3 exit criteria in `SKILL.md` ("only flip to Live after a full successful test run") is not achievable for these methods, so don't present a passing sandbox suite as clearing them.
+
+**Not confirmed either way — don't assume:** Apple Pay, Google Pay, and bank installments. (`README.md` notes bank installments are "Live IDs only," which points the same way, but confirm with `support@paymob.com` before telling a merchant whether they can test it.) Don't infer a sandbox path for any of these from the card/wallet sections above.
+
 ## Using them
 
 1. Make sure the Integration ID used in the Intention request is the **Test** version of the relevant payment method (Cards or Wallets), and that the Secret Key used is also Test mode — mismatched modes cause a 404 on intention creation (see `intention-api.md`).