docs: explain synthetic verification fixtures

README.md

@@ -250,6 +250,16 @@ Read [SECURITY.md](SECURITY.md), [payment security](https://docs.midtrans.com/do
 
 `blocked` means a required merchant, dashboard, device, activation, callback, or Sandbox proof is still missing; follow `midtrans status`, `midtrans agent check`, or `midtrans agent resume` to see the next action. `provider_confirmed` means Midtrans returned provider state, but all local or merchant-side evidence required for completion is not yet verified. `verified` means `midtrans verify` validated the required redacted, checksummed evidence for the configured journey.
 
+### Verify the CLI repository locally
+
+The repository's [synthetic test fixtures](testdata/README.md) exercise payload parsing, fixed signature vectors, Sandbox policy, secret redaction, evidence behavior, and inspection of complete and broken integration shapes. Run the fixture-backed test suite from the repository root:
+
+```sh
+go test ./... -count=1
+```
+
+Passing these tests is local deterministic proof of CLI behavior only. It does not verify your merchant integration, connect to Midtrans Sandbox, or replace merchant-owned Sandbox credentials, payment-method activation, callback configuration, and provider interaction. Never reuse fixture keys, tokens, signatures, identifiers, or payloads in a merchant environment.
+
 ## Further reading
 
 - [Official AI guidance](https://docs.midtrans.com/docs/building-on-midtrans-with-ai)

test/release/infrastructure_test.go

@@ -293,3 +293,31 @@ func TestRootREADMEIsMerchantFacingPublicPreview(t *testing.T) {
 		}
 	}
 }
+
+func TestFixtureDocumentationDefinesLocalProofBoundary(t *testing.T) {
+	readme := string(readFile(t, "README.md"))
+	for _, required := range []string{
+		"### Verify the CLI repository locally",
+		"[synthetic test fixtures](testdata/README.md)",
+		"local deterministic proof",
+		"does not verify your merchant integration",
+	} {
+		if !strings.Contains(readme, required) {
+			t.Errorf("root README missing fixture boundary %q", required)
+		}
+	}
+
+	fixtures := string(readFile(t, "testdata/README.md"))
+	for _, required := range []string{
+		"# Synthetic test fixtures",
+		"generated test-only RSA key pair",
+		"Never use",
+		"real Midtrans Sandbox",
+		"provider-confirmed",
+		"customer PII",
+	} {
+		if !strings.Contains(fixtures, required) {
+			t.Errorf("fixture README missing safety boundary %q", required)
+		}
+	}
+}

testdata/README.md

@@ -0,0 +1,44 @@
+# Synthetic test fixtures
+
+Everything under `testdata/` is synthetic and tracked so Midtrans CLI behavior can be tested deterministically without merchant credentials, customer PII, or provider calls.
+
+## Fixture inventory
+
+| Path | Purpose |
+| --- | --- |
+| `snap/` | Synthetic token, status, and notification responses for Snap parsing, signature verification, and settlement handling. |
+| `coreapi/` | Synthetic card 3DS and OTC notifications with deterministic signatures for exact-string verification and status mapping. |
+| `paymentlink/` | Synthetic Payment Link creation response for response validation and safe URL handling. |
+| `bisnap/` | A generated test-only RSA key pair used for fixed BI-SNAP access-token and notification signature vectors. |
+| `merchant-repos/` | Complete and intentionally broken repository shapes for inspection, manifest, readiness, redaction, and policy tests. |
+| `gopaytokenization/` | Fixture ownership note for GoPay tokenization tests that currently share the BI-SNAP cryptographic fixtures. |
+| `subscription/` | Fixture ownership note for Subscription lifecycle coverage. |
+
+## Safety boundary
+
+The private key in `bisnap/private_key_pkcs8.pem` is part of a generated test-only RSA key pair. It is deliberately public, has no merchant or Midtrans identity, and is permanently unsafe for any external service, real Midtrans Sandbox account, or production environment.
+
+Never use fixture keys, tokens, signatures, order IDs, transaction IDs, payment codes, URLs, or payloads in a merchant integration. Do not treat them as examples of credentials issued by Midtrans.
+
+These fixtures contain no real merchant credentials or customer PII. Signature-shaped values are deterministic test vectors, and environment files contain variable names without values.
+
+## What passing tests proves
+
+Fixture-backed tests provide local deterministic proof that the CLI handles the represented inputs and safety rules. They can validate parsing, fixed signatures, status mapping, repository inspection, redaction, and policy enforcement.
+
+They do not verify a merchant repository, perform a real Midtrans Sandbox transaction, confirm dashboard or payment-method activation, or establish a provider-confirmed (`provider_confirmed`) or end-to-end `verified` result. Those proof levels require merchant-owned Sandbox credentials, applicable activation and callback configuration, and actual provider interaction.
+
+Run the local suite from the repository root:
+
+```sh
+go test ./... -count=1
+```
+
+## Adding or changing fixtures
+
+- Use obviously synthetic identifiers and deterministic values.
+- Use Midtrans Sandbox or reserved example domains only.
+- Do not add merchant credentials, customer PII, authorization headers, access tokens, or unrestricted provider payloads.
+- Regenerate signatures with an explicit fixture-only secret or key.
+- Review every secret-scanner finding; suppress only an exact, documented synthetic fixture.
+- Run the fixture-consuming tests and repository secret scan before committing.