Capture restricted-production conformance evidence for a foreign-service issuance

[dmnelson]

Context

The published package has broad model, serialization, parsing, signing, and
transport coverage, but no live restricted-production issuance has completed.

The first operational profile to prove should be a Brazilian provider
exporting software/services to a foreign customer.

Status

This issue is an external conformance milestone. It is blocked until an
authorized taxpayer, valid certificate material, applicable municipal setup,
and restricted-production access are available. It is not blocked on further
generic transport abstraction.

Required profile

• provider-issued DPS;
• provider CNPJ and applicable tax regime;
• foreign customer with NIF or documented cNaoNIF and foreign address;
• foreign service location;
• comExt with a non-BRL currency;
• export ISSQN treatment;
• signed DPS submitted using mutual TLS;
• successful generated NFS-e response;
• at least one representative rejected request.

Acceptance criteria

• Confirm the exact XMLDSig canonicalization, digest, signature, and transform
  profile accepted by the active restricted-production environment.
• Confirm the active submission content type and any JSON/gzip/base64 wrapper
  property.
• Confirm the current endpoints and response shapes used by the flow.
• Record hashes and protected metadata for original accepted and rejected
  artifacts outside the repository.
• Add repository contract fixtures derived from the observed structures
  without taxpayer data, credentials, private keys, or reusable signed
  production documents.
• Do not present a redacted signed XML document as cryptographically valid:
  redaction invalidates its digest and signature. Use synthetic replacement
  fixtures for public parser/contract tests.
• Add contract tests using the sanitized or synthetic fixtures.
• Document municipal and taxpayer prerequisites that cannot be generalized.
• Record the package version, schema version, date, and environment used.
• Update support/readiness documentation to identify the exact profile as
  exercised without generalizing it to all taxpayers, municipalities, or
  services.

Security

• Certificate material, taxpayer identifiers, fiscal identifiers, private
  keys, passwords, tokens, and reusable signed documents must remain outside
  the repository.
• Logs and issue attachments must not contain request or response bodies from
  the live taxpayer flow.
• Any retained original evidence must follow an explicit access-control and
  retention policy.