Release Minimize Tools 0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,10 @@
+# Accessibility
+
+All inputs, limits, presets, and actions use labelled native controls with
+visible keyboard focus. Progress and errors use live text status rather than
+colour alone. Source, predicate, and result regions follow document order and
+stack on narrower screens; long source and trace content remains scrollable.
+
+Light, dark, and system themes inherit the shared Toolbox shell. Reduced-motion
+preferences disable transitions. Cancellation is keyboard reachable and the
+last completed result remains available while a new run is active.

docs/ARCHITECTURE.md

@@ -0,0 +1,20 @@
+# Architecture
+
+The framework-independent engine applies a deterministic sequence of reductions:
+normalization, structure-aware JSON/XML candidates, line chunks, lexical-token
+chunks, and Unicode code-point chunks. Every smaller candidate must independently
+satisfy the async predicate before it replaces the current result. Candidate
+outcomes are memoized, accepted transitions are recorded, and an AbortSignal,
+test budget, and deadline are checked throughout.
+
+JSON candidates are parsed with depth/node/key limits. XML rejects DOCTYPE and
+is manipulated as inert DOM nodes. The focused JSON Schema validator returns a
+stable first-issue signature. Regex work runs in a disposable module worker; a
+non-returning expression causes worker termination. Restricted XSLT evaluation
+uses the browser API on the main thread, so it has smaller source/test limits and
+explicitly rejects resource-loading constructs.
+
+Limits are 2 MiB input, 2,000 predicate tests, 30 seconds per run, 100,000 JSON
+nodes, 128 KiB XSLT, 200 XSLT tests, and at most one second of regex worker time.
+The engine reports budget exhaustion instead of claiming a globally minimal
+result.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,18 @@
+# Privacy and security
+
+Selected files, predicates, intermediate candidates, and results remain in page
+memory. There is no upload, telemetry, analytics, remote reference resolution,
+external font, or account. The production policy restricts network connections
+to the same origin and browser tests reject unexpected requests.
+
+JSON and XML are inert data; dangerous JSON keys and XML document types are
+rejected. Regular expressions execute in a same-origin worker that can be
+terminated. XSLT is limited to a local, bounded stylesheet and rejects imports,
+includes, hrefs, DOCTYPE, and known external-resource functions. Browser-native
+XSLT is synchronous and cannot be pre-empted mid-call, so only trusted local
+stylesheets should be tested despite those safeguards.
+
+A reduced input demonstrates only the recorded predicate. It is not proof that
+the original root cause, security impact, timing characteristic on another
+machine, or standards conformance remains identical. Review the exported trace
+and keep failure-signature preservation enabled where available.