Release Format Lab 0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,11 @@
+# Accessibility
+
+The visual format graph has a descriptive accessible name and is followed by a
+complete keyboard-scrollable edge table, so it is never the sole source of
+information. Native labelled selects, checkboxes, buttons, text areas, and
+tables expose every path and measurement without pointer input.
+
+Expected loss, measured change, conditional status, and unknown state use text
+labels in addition to colour. Layouts collapse into document order on smaller
+screens. Light, dark, and system themes inherit the shared Toolbox shell, with
+visible focus and reduced-motion support.

docs/ARCHITECTURE.md

@@ -0,0 +1,18 @@
+# Architecture
+
+The immutable catalog defines formats, domain properties, directed conversion
+edges, availability, and a per-property status. A bounded depth-first search
+enumerates acyclic paths of at most four conversions. Routes are sorted by the
+worst status for the user-selected properties and then by conversion count;
+catalog results remain explicitly expected rather than measured.
+
+The executable data lab parses JSON, NDJSON, CSV, and a typed XML record dialect
+into a bounded canonical list of records. Every selected edge serializes and
+re-parses the canonical data, so losses accumulate along the actual path. The
+target is then serialized back to the source format. Stable property signatures
+compare record/field order, names, types, nulls, nesting, numeric values, and
+Unicode text. Metadata remains not-tested because the canonical model does not
+pretend to represent arbitrary wrappers, comments, namespaces, or schemas.
+
+Limits are 2 MiB input, 10,000 records, 200 fields per record, 500,000 top-level
+values, JSON depth 64, 200,000 JSON nodes, and 8 MiB output.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,17 @@
+# Privacy and security
+
+Selected files, converted data, and evidence reports remain in browser memory.
+There is no upload, telemetry, analytics, remote reference resolution, account,
+external font, or codec service. Production policy restricts connections to the
+same origin and browser tests reject unexpected requests.
+
+JSON uses bounded parsing and rejects prototype-sensitive field names. XML
+DOCTYPE declarations are disabled, values are rendered as text, and generated
+XML escapes names and content. CSV parsing is bounded; exports prefix cells that
+could be interpreted as spreadsheet formulas. All outputs are explicit
+user-triggered downloads.
+
+A matching round-trip signature is evidence only for the bounded canonical
+properties and supplied sample. It is not proof of standard conformance,
+metadata preservation, codec quality, accessibility, or losslessness for other
+files, implementations, settings, or future tool versions.