Release Device Tools v0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+Every filter and probe has a native label or descriptive button name. Passive state, privacy risk and probe outcomes include text and never rely on colour alone. Tables use row/column headers, status changes use a polite live region, JSON is keyboard-scrollable and focus is visible. Layouts collapse for small viewports, reduced-motion preferences are respected and the shared shell supplies system/light/dark themes.

docs/ARCHITECTURE.md

@@ -0,0 +1,7 @@
+# Architecture
+
+`core/device.ts` owns capability collection, the explicit probe registry and redaction. Passive checks use only synchronous API presence, media queries, display fields, `getSupportedConstraints` and `canPlayType`. Probe functions are separate and reachable only from individual UI actions.
+
+Results retain human-readable local details in React state for the current page lifetime. Report creation builds a new allow-listed structure and buckets high-entropy values. It never serializes navigator objects, media devices, GPU adapters, streams or raw exceptions. Camera/microphone/screen functions stop every track before returning.
+
+All Vite assets use relative paths for nested portal mounting. Release packaging fixes ZIP ordering, timestamps and permissions.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,7 @@
+# Privacy and security
+
+There is no telemetry, remote asset, account, database or application network client. CSP limits connections to self. Passive inspection never asks for permission; sensitive checks require explicit user actions and potential prompts are labelled.
+
+The tool deliberately does not read user agent, locale, device names or IDs; does not obtain WebGL debug renderer details; does not generate canvas/audio samples; and does not combine results into an identifier, hash or score. Returned media tracks stop immediately. Battery listeners are never installed. Exports contain an allow-listed schema with broad buckets for high-entropy measurements and omit timestamps.
+
+Capability presence is not a security guarantee: browser policy, embedding, HTTPS, user choice and operating-system controls can still block a later operation.