Expand fixture manifests with route policies

docs/configuration.md

@@ -37,6 +37,11 @@ tier = "transactional"
 identity = "http-session"
 payments = "server-invoice"
 
+[[site.interactions.route]]
+match = "/admin/*"
+tier = "internal"
+public_allowed = false
+
 [site.protocols.clearnet]
 enabled = true
 renderer = "clearnet"

docs/fixture-manifests.md

@@ -22,6 +22,7 @@ The manifest contains public route expectations only:
 - expected AMPB transport and profile.
 - declared interaction tier, identity adapter, payment adapter, realtime flag, and
   public exposure flag.
+- optional route-group metadata for configured public route policies.
 
 It must not contain private host inventory, hidden-service keys, tunnel keys, credentials,
 or deployment notes.
@@ -58,3 +59,7 @@ Fixture interaction policy defaults to:
 
 Route-group overrides will be added separately. Until then, protocol-level options can
 declare the fixture-level policy that AMPB should check.
+
+When `[[site.interactions.route]]` entries are configured, AMPG emits additional fixtures
+for public route groups. Routes with `tier = "internal"` or `public_allowed = false` are
+not emitted.

docs/interactive-apps.md

@@ -45,6 +45,10 @@ An application adapter describes what AMPG may expose:
 Adapters do not bypass the application. They translate constrained protocol input into the
 application's public action surface, then render safe responses.
 
+Configured public route groups are emitted into fixture manifests so AMPB can verify the
+route and interaction policy for each selected transport. Internal route groups are not
+emitted.
+
 ## Protocol Mapping
 
 | Tier | Clearnet | Tor/I2P | Gemini | IPFS | Reticulum |