test(fixtures): capture redacted SimAdmin responses

docs/api/fixture-policy.md

@@ -0,0 +1,23 @@
+# Read-only fixture policy (Phase 0.3)
+
+Fixtures are schema-preserving, redacted responses from exactly two locally configured, password-free SimAdmin instances at upstream baseline `58e2204`. Instance identities and origins are never logged or persisted.
+
+## Selection and transport
+
+The OperationRegistry is the sole operation source. Collector initialization fingerprints every complete operation contract. Runtime validation requires the exact Registry object (not a look-alike), an unchanged structural fingerprint, `GET`, `R0`, and a fully bound path beginning with one `/api/`; it rejects absolute/scheme-relative URLs, query/hash, backslashes, duplicate slashes, dot segments, percent encoding, and single/double-decode changes. Selection and `collectOne` both enforce this policy before transport.
+
+Configuration is checked before normalization (so query/fragment stripping cannot hide an unsafe input), then passed through production `normalizeConfig`; collector-specific constraints require exactly two `http(s)` RFC1918 private-LAN IPv4 origins, no credentials, path, query, fragment, or authentication. `collectOne` repeats origin validation and verifies the final URL retains the exact origin and Registry path. Requests omit credentials, body, Authorization, and Cookie; redirects are manual, timeout is six seconds, and concurrency is two.
+
+Explicit denials are machine-readable in `DENY_REASONS`: operator scan and `/api/connectivity` are active operations (connectivity performs a ping); content/history/log/query endpoints are omitted where no Registry-backed privacy-safe bounded contract exists. No authentication retry occurs.
+
+## Data handling and schema preservation
+
+Raw responses exist only in memory. Before writing, every OperationRegistry `sensitiveFields` entry whose direction is `response` is executed as its endpoint-specific JSONPath; missing optional paths are safe no-ops and unsupported path syntax fails closed. Wildcard arrays are supported. Sensitive objects retain keys, arrays retain length and element shape, and primitive leaves retain their JSON types: strings become `[REDACTED]`, numbers `0`, booleans `false`, and null remains null. Objects and arrays are never stringified into placeholders.
+
+A recursive fallback sanitizer then covers credentials, access/device/private keys, PIN/PUK, subscriber/device/network identifiers, usernames/accounts, serials/revisions, filesystem/object paths, templates/config, URLs/hosts, IPv4/IPv6, phone-like and separated modem identifiers, and unknown high-entropy secrets. JSON encoded inside strings is parsed, recursively sanitized, and serialized back as a string. Unparseable templates are conservatively replaced. GPS/cell identifiers and device fingerprints (revision, uptime, traffic, precise timestamps) are type-preservingly redacted. Ordinary API `message` status semantics and manual-entry booleans are retained unless an operation path declares them sensitive; SMS/call content remains denied or explicitly redacted.
+
+## Manifest and verification
+
+Real and synthetic fixtures are strictly separated; synthetic fixtures, if introduced, must be under `synthetic-errors/`, set `synthetic: true`, and never contribute to real coverage. The manifest file set must exactly equal disk contents, with unique paths and operation/alias pairs, exact domain counts, SHA-256 and sizes. The separately reviewed `response-shapes-58e2204.json` records value-free recursive payload signatures (object keys, every array element, and primitive types) for exactly all 78 alias/operation pairs. It is excluded from `manifest.files` to avoid a cycle but pinned by the manifest `shapeBaseline` size and SHA-256. Capture requires and attests it but never creates or overwrites it. Tests strictly validate its schema and compare every payload to it. Envelopes enforce allowed aliases, date-only reasonable `capturedAt`, Registry correspondence, and category-specific HTTP/content-type/payload consistency.
+
+Tests recursively collect every configured string leaf of length at least three (including tags, capabilities, auth, and password) and assert none occurs in fixtures without printing values. Credential scans report counts only. Capture logs are limited to alias, operation ID, and result category.