4.2 KiB
Read-only fixture policy (Phase 0.3)
Fixtures are schema-preserving, redacted responses from exactly two locally configured, password-free SimAdmin instances at upstream baseline 58e2204. Instance identities and origins are never logged or persisted.
Selection and transport
The OperationRegistry is the sole operation source. Collector initialization fingerprints every complete operation contract. Runtime validation requires the exact Registry object (not a look-alike), an unchanged structural fingerprint, GET, R0, and a fully bound path beginning with one /api/; it rejects absolute/scheme-relative URLs, query/hash, backslashes, duplicate slashes, dot segments, percent encoding, and single/double-decode changes. Selection and collectOne both enforce this policy before transport.
Configuration is checked before normalization (so query/fragment stripping cannot hide an unsafe input), then passed through production normalizeConfig; collector-specific constraints require exactly two http(s) RFC1918 private-LAN IPv4 origins, no credentials, path, query, fragment, or authentication. collectOne repeats origin validation and verifies the final URL retains the exact origin and Registry path. Requests omit credentials, body, Authorization, and Cookie; redirects are manual, timeout is six seconds, and concurrency is two.
Explicit denials are machine-readable in DENY_REASONS: operator scan and /api/connectivity are active operations (connectivity performs a ping); content/history/log/query endpoints are omitted where no Registry-backed privacy-safe bounded contract exists. No authentication retry occurs.
Data handling and schema preservation
Raw responses exist only in memory. Before writing, every OperationRegistry sensitiveFields entry whose direction is response is executed as its endpoint-specific JSONPath; missing optional paths are safe no-ops and unsupported path syntax fails closed. Wildcard arrays are supported. Sensitive objects retain keys, arrays retain length and element shape, and primitive leaves retain their JSON types: strings become [REDACTED], numbers 0, booleans false, and null remains null. Objects and arrays are never stringified into placeholders.
A recursive fallback sanitizer then covers credentials, access/device/private keys, PIN/PUK, subscriber/device/network identifiers, usernames/accounts, serials/revisions, filesystem/object paths, templates/config, URLs/hosts, IPv4/IPv6, phone-like and separated modem identifiers, and unknown high-entropy secrets. JSON encoded inside strings is parsed, recursively sanitized, and serialized back as a string. Unparseable templates are conservatively replaced. GPS/cell identifiers and device fingerprints (revision, uptime, traffic, precise timestamps) are type-preservingly redacted. Ordinary API message status semantics and manual-entry booleans are retained unless an operation path declares them sensitive; SMS/call content remains denied or explicitly redacted.
Manifest and verification
Real and synthetic fixtures are strictly separated; synthetic fixtures, if introduced, must be under synthetic-errors/, set synthetic: true, and never contribute to real coverage. The manifest file set must exactly equal disk contents, with unique paths and operation/alias pairs, exact domain counts, SHA-256 and sizes. The separately reviewed response-shapes-58e2204.json records value-free recursive payload signatures (object keys, every array element, and primitive types) for exactly all 78 alias/operation pairs. It is excluded from manifest.files to avoid a cycle but pinned by the manifest shapeBaseline size and SHA-256. Capture requires and attests it but never creates or overwrites it. Tests strictly validate its schema and compare every payload to it. Envelopes enforce allowed aliases, date-only reasonable capturedAt, Registry correspondence, and category-specific HTTP/content-type/payload consistency.
Tests recursively collect every configured string leaf of length at least three (including tags, capabilities, auth, and password) and assert none occurs in fixtures without printing values. Credential scans report counts only. Capture logs are limited to alias, operation ID, and result category.