Release Fixture Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,10 @@
+# Accessibility
+
+Fixture Tools uses labelled native inputs, selects, buttons, tables, and tabs.
+Every operation is keyboard reachable, focus indicators remain visible, and
+light, dark, and system themes inherit the shared Toolbox shell behaviour.
+
+Status, errors, and intentional violations are expressed in text rather than by
+colour alone. Wide model and data tables scroll inside their own regions, and
+responsive layouts stack controls without changing their reading order. Reduced
+motion preferences disable decorative transitions.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,20 @@
+# Architecture
+
+Fixture Tools is a relocatable React application with a framework-independent
+TypeScript core. Bounded import adapters turn JSON Schema, SQL DDL, XSD, CSV
+headings, and saved recipes into one normalized model. The editor works only on
+that inert model: imported SQL is never executed, XML entities are rejected,
+and no reference is fetched.
+
+Generation starts from a stable text-seeded pseudo-random stream. It creates
+ordinary fields first, applies requested non-reference invalid cases, resolves
+foreign keys against already generated target rows, and finally applies any
+requested foreign-key violations. Uniqueness bookkeeping and a separate
+violation ledger make the valid and negative-test paths explicit. Serializers
+operate over the resulting bounded dataset and enforce an 8 MiB output cap.
+
+The app deliberately uses a focused schema subset instead of claiming full
+standards conformance. Limits are 2 MiB per source, 20 tables, 100 fields per
+table, 10,000 rows per table, and 50,000 rows overall. These bounds keep parsing,
+editing, rendering, and download generation responsive in a browser tab. A
+second 100,000-value ceiling prevents wide models from defeating the row limit.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,18 @@
+# Privacy and security
+
+Files are read only after direct selection and remain in browser memory. There
+is no telemetry, analytics, account, upload, remote reference resolution,
+external font, or service dependency. The production content policy restricts
+connections to the same origin, and browser tests reject unexpected requests.
+
+Imported JSON, SQL, XML, and CSV are treated as data. SQL is never executed;
+XML document types and entity declarations are rejected. React renders values
+as text. CSV exports prefix formula-like cells to reduce spreadsheet injection,
+and SQL identifiers/literals are quoted by the serializer. These mitigations do
+not replace review before feeding intentionally invalid fixtures to another
+system.
+
+Generated values are synthetic and use reserved example domains. They are not
+anonymized real data, security tokens, cryptographic randomness, compliance
+evidence, or a statistical population model. A seed intentionally reproduces
+the same output and should not be treated as secret material.