Take the device recorder out of the repository

.gitignore

@@ -8,6 +8,10 @@ browser-[0-9][0-9][0-9][0-9]-*/
 ssh-[0-9][0-9][0-9][0-9]-*/
 blocked.log
 
+# the device recorder is a private tool kept next to the recordings, not
+# part of the repository
+/dev/mirror/
+
 # local SDK build output (packages, SHA256SUMS, BUILDINFO, dist/.tools/)
 /dist/
 # a build work directory, if TMPDIR points into the tree

AGENTS.md

@@ -15,7 +15,6 @@ Two OpenWrt 25.12 LuCI packages plus offline tooling. No npm, no
 | `luci-theme-vantage/` | Theme: ucode templates (`ucode/template/themes/vantage/*.ut`), CSS and icons (`htdocs/luci-static/vantage/`), shell script (`htdocs/luci-static/resources/menu-vantage.js`, `vantage-theme/host.js`), `root/etc/uci-defaults/30_luci-theme-vantage`, `postrm` in the `Makefile` |
 | `luci-app-vantage/` | Dashboard at `admin/dashboard`: views (`htdocs/.../view/vantage/overview.js`; `firewall.js`, the Network → Firewall → Overview tab), modules (`htdocs/.../vantage/*.js`), `app.css`, menu entry, rpcd ACL (`root/usr/share/rpcd/acl.d/`), rpcd ucode plugin `luci.vantage` (`root/usr/share/rpcd/ucode/luci.vantage`), default `/etc/config/vantage` |
 | `dev/replay/` | Offline LuCI server that replays a recording; see its README |
-| `dev/mirror/` | Recorders that read a real device. Do not run them (rule 1) |
 | `dev/build/` | `sdk-build.sh`: reproducible build in the OpenWrt SDK image (podman) |
 | `dev/icons/build.js` | Generates the status icon set; edit the generator, not the SVGs |
 | `dev/i18n/` | `update.sh`: translation templates and catalogues (`po/`) with LuCI's i18n tools; `catalog.js`: LuCI's catalogue format (tests, replay `--lang`) |
@@ -25,8 +24,8 @@ Two OpenWrt 25.12 LuCI packages plus offline tooling. No npm, no
 
 ## Hard rules
 
-1. **No real devices.** Do not SSH to, copy to, browse, or run
-   `dev/mirror/` against a router or access point unless the human asks for
+1. **No real devices.** Do not SSH to, copy to, browse, or run any
+   recorder against a router or access point unless the human asks for
    exactly that in the current conversation. All UI work goes through the
    replay.
 2. **No real network data in the tree.** Recordings live outside the
@@ -83,7 +82,8 @@ Needs Node.js (the maintainer uses a current release; there are no
 dependencies to install).
 
 The replay needs two local inputs that are not in the repository: a
-recording (`--mirror`, made with `dev/mirror/`) and a LuCI 25.12 root
+recording (`--mirror`, in the format described in `dev/replay/README.md`
+under Recording format) and a LuCI 25.12 root
 filesystem for the core templates and static files (`--rootfs` or
 `$VANTAGE_ROOTFS`). If either is missing, say so and stick to the tests; do
 not fake them.

CONTRIBUTING.md

@@ -30,13 +30,12 @@ The UI is developed offline against recorded device data, never against a
 live router. You need Node.js (there are no dependencies to install) and,
 to build packages, podman.
 
-1. **Record** a device once with `dev/mirror/` (read-only: it refuses
-   writes, and strips secrets before writing anything). Keep the
-   recording outside this repository, e.g. in `../vantage-mirror`.
-   The browser recorder pins the device's TLS certificate: copy it over
-   SSH (`scp -O root@<device>:/etc/uhttpd.crt /tmp/device.crt`) and pass
-   `--cert /tmp/device.crt` (or `--spki <pin>`; see the header of
-   `dev/mirror/record-browser.js`).
+1. **Device data.** The replay reads a recording of a LuCI session in
+   the format described under Recording format in
+   [`dev/replay/README.md`](dev/replay/README.md#recording-format), or
+   hand-written fixtures (`--fixtures`, `dev/replay/addons.sh`). Keep a
+   recording outside this repository, e.g. in `../vantage-mirror`, and
+   never commit one: it holds your network's addresses and names.
 2. **Replay** it with the theme and app from your working tree, plus a
    LuCI 25.12 root filesystem for LuCI's own templates and static files
    (`--rootfs`, see [`dev/replay/README.md`](dev/replay/README.md)):

README.md

@@ -159,14 +159,13 @@ inputs. Optional index signing and the details are in the
 The UI is developed offline against recorded device data, never against a
 live device:
 
-1. **Record** – `dev/mirror/` records a real LuCI session read-only
-   (browser and SSH snapshots). Writes, applies, scans and uploads are
-   refused before they leave the browser, and secrets are removed before
-   anything is written. Recordings stay outside the repository.
-2. **Replay** – `dev/replay/` serves the complete LuCI UI from a recording on
-   `127.0.0.1`, with the theme and app loaded from this tree; reload to see
-   an edit. Save & Apply works against an in-memory overlay.
-3. **Demo mode** – `--demo` pseudonymises the recording as it loads:
+1. **Replay** – `dev/replay/` serves the complete LuCI UI on `127.0.0.1`
+   from a recording of a real LuCI session (ubus replies, HTTP responses
+   and static files; the format is in the replay's README) or from
+   hand-written fixtures, with the theme and app loaded from this tree;
+   reload to see an edit. Save & Apply works against an in-memory overlay.
+   Recordings stay outside the repository.
+2. **Demo mode** – `--demo` pseudonymises the recording as it loads:
    documentation MACs and addresses (`00:00:5E:00:53:xx`, `192.0.2.0/24`,
    `2001:db8::/32`), neutral hostname, SSIDs and client names. The
    screenshots above were taken this way.

SECURITY.md

@@ -42,9 +42,9 @@ In scope:
 - the dashboard's rpcd ACL: permissions broader than documented, or writes
   outside `/etc/config/vantage`
 - packaging: the install and removal scripts, file permissions
-- the dev tooling that handles recorded device data (`dev/mirror/`,
-  `dev/replay/`), for example secrets or real identifiers leaking into
-  recordings, demo output or the repository
+- the dev tooling that handles recorded device data (`dev/replay/`),
+  for example real identifiers leaking into demo output or the
+  repository
 
 Out of scope: