Release Package Tools 0.2.0

docs/ARCHITECTURE.md

@@ -7,12 +7,23 @@ The React workbench is a thin UI over four bounded layers:
 2. `src/package/analyze.ts` selects at most 512 metadata files / 16 MiB,
    determines a package adapter, parses static XML or bounded JSON, and builds
    references and diagnostics.
-3. Tree and comparison modules create deterministic projections without
-   reading entry payloads.
+3. Tree comparison first reports metadata-only candidates as unverified. On an
+   explicit user action it reopens up to 512 comparable entries within a 128 MiB
+   expanded-byte budget, verifies container integrity and hashes decompressed
+   bytes with SHA-256. Differing small JSON, static XML, manifest and text files
+   receive bounded semantic summaries; DTDs/entities remain rejected.
 4. The preview path reopens the package and performs strict CRC/overlap checks
    for one bounded entry. Markup is text-only; only browser-supported raster
    image/audio/video blobs receive local object URLs.
 
+Supply-chain inspection is declaration-only: bounded package.json,
+requirements, Maven/JAR and conventional licence paths produce evidence rows
+without registry access, resolution, vulnerability lookup or legal inference.
+Signature inventory correlates companion `.SF`/`.RSA`/`.DSA`/`.EC` entries and
+reports declared digest algorithm names, but never verifies signed bytes or a
+certificate chain. Explicit entry handoff uses the browser's user-mediated Web
+Share surface; verified download is retained as the predictable fallback.
+
 The UI lazy-loads the workbench beneath the shared toolbox shell. The app uses
 relative URLs so it works under nested portal paths, and a service worker caches
 same-origin resources after first use.

docs/PRIVACY-SECURITY.md

@@ -4,7 +4,7 @@ Files remain in browser memory and are never uploaded. Package Tools performs
 no telemetry, DNS lookup, external relationship fetch, certificate lookup or
 signature validation. Export occurs only after an explicit button press.
 
-Limits in v0.1 include 512 MiB source and aggregate declared expansion, 20,000
+Limits in v0.2 include 512 MiB source and aggregate declared expansion, 20,000
 entries, 256 MiB per entry, 200:1 compression ratio, 2 MiB per metadata entry,
 16 MiB total inspected metadata, and 512 metadata files. UI rendering is capped
 at 5,000 tree/comparison rows while diagnostics cover the bounded inventory.