Release Privacy Tools 0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,16 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings, a native multiple-file input,
+buttons, tables, definition lists, progress, status/alert regions, and native
+disclosures/dialogs. All workflows are keyboard operable; drop is an optional
+pointer shortcut. Visible focus and the shared Toolbox system/light/dark themes
+are preserved.
+
+Status is always written as text and never encoded by colour alone. Finding
+categories expose labels and counts, hashes and media types remain selectable,
+and responsive layouts allow horizontal table scrolling without clipping the
+whole page. Motion is not required to understand progress or results.
+
+Automated component and Chromium/Firefox browser gates cover semantics and core
+workflows. They supplement, rather than replace, manual keyboard, zoom,
+screen-reader, high-contrast, and reduced-motion review before release.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,49 @@
+# Architecture
+
+Privacy Tools is a relocatable Vite/React static application. The core domain
+model in `src/privacy` is serializable: scan inputs cross a worker boundary as
+transferred `ArrayBuffer`s and results contain only strings, numbers, booleans,
+arrays, and plain objects. No parser returns HTML or a live third-party object.
+
+## Pipeline
+
+1. `scan-client` checks file count and declared byte totals before reading the
+   batch, transfers buffers to a dedicated worker, reports progress, and
+   terminates the worker on cancellation.
+2. `detect` compares magic bytes, filename extension, and browser-claimed MIME.
+   `scanner` hashes bytes, dispatches the bounded project parser, runs
+   ExifReader as a distinct secondary adapter, and normalizes findings and
+   coverage.
+3. Project parsers walk JPEG segments, PNG chunks, WebP RIFF chunks, TIFF IFDs,
+   IPTC datasets, and bounded inert XMP text. They validate offsets, lengths,
+   counts, PNG CRCs, compression expansion, TIFF cycles/depth, and trailing
+   bytes. They do not follow URLs or instantiate XML/HTML.
+4. `sanitize` runs only for complete, static, bounded JPEG/PNG/WebP scans. A
+   browser decoder produces pixels, the EXIF display orientation is normalized,
+   and Canvas creates a fresh same-format file. No input container block is
+   copied.
+5. The encoded bytes are passed back through the same independent scanner API,
+   hashed, dimension-checked, and compared using a deterministic 256-pixel-edge
+   decoded sample. `buildSanitizationReport` assigns verified/warning/failed
+   based on explicit coverage and output findings.
+6. `archive` serializes bounded deterministic JSON and creates stored ZIP
+   entries from application-generated `images/` paths and sanitized unique
+   names.
+
+Pixel decoding and Canvas encoding currently run on the main browser context
+because portable cross-browser image encoder support is there; metadata parsing
+and hashing run in the terminable worker. UI state does not retain data after a
+page refresh and no IndexedDB/localStorage persistence is used by this app.
+
+## Trust boundaries
+
+- Project parsers and ExifReader independently contribute coverage; one parser's
+  success does not suppress the other's warning.
+- Unknown structures are reported or cause partial coverage. Clean-copy
+  eligibility requires a complete project container scan.
+- Browser image decoders, Canvas encoders, Web Crypto, and the JS runtime are in
+  the trusted computing base.
+- ExifReader is pinned to 4.44.0. Dependency updates require malformed-container
+  regression fixtures and licence review.
+- The Toolbox shell receives the application manifest but never receives file
+  bytes or findings.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,59 @@
+# Privacy and security
+
+## Data handling
+
+Files are read with browser file APIs and transferred to an in-page worker.
+There is no upload endpoint, account, telemetry, analytics, remote metadata
+lookup, or automatic persistence. Temporary object URLs exist only for the
+legacy image-element decode fallback and are revoked immediately after decode.
+Download object URLs are created and revoked by the shared helper. Refreshing or
+closing the page discards application state.
+
+Service-worker support may fetch and cache the same-origin application shell;
+it does not cache imported files, metadata findings, reports, or generated
+images. Metadata URLs and XMP/XML markup are inert text and are never fetched or
+rendered as HTML.
+
+## What is inspected
+
+Every file receives byte-signature inventory and SHA-256. Static JPEG, PNG, and
+WebP receive project-owned deep container parsing plus ExifReader. TIFF,
+HEIC/HEIF, AVIF, and JPEG XL receive best-effort ExifReader inspection only.
+GIF and document/archive formats receive inventory only. Exact per-format
+fields are listed in the README support table.
+
+All parsers are bounded, but a “complete” scan means complete for implemented
+structures—not proof that no steganographic or novel carrier exists. Unknown
+private chunks and trailing bytes are surfaced. ExifReader failures and format
+limitations remain visible in coverage.
+
+## Re-encoded outputs
+
+Only complete, static, dimension-bounded JPEG/PNG/WebP project scans are
+eligible. The application decodes pixels, normalizes display orientation, and
+uses Canvas to encode a new file of the detected type. It does not selectively
+strip GPS while copying everything else, because duplicated values can live in
+multiple namespaces and embedded previews. It copies no source metadata block.
+
+The output is always scanned and hashed again. Sensitive or provenance findings,
+partial project coverage, or an oriented-dimension mismatch produce a failed
+gate. Secondary-parser limitations and provenance invalidation produce explicit
+warnings. JPEG and lossy WebP may change pixels; profiles, resolution metadata,
+thumbnails, comments, and application history may be lost. PNG is expected to
+preserve decoded pixels, subject to browser colour management.
+
+C2PA/JUMBF carries authenticity/provenance claims. Re-encoding normally removes
+or invalidates those claims. The tool reports that effect rather than describing
+it as an ordinary privacy win.
+
+## What this cannot promise
+
+No result promises anonymity or safe publication. The tool does not remove or
+detect visible faces/text/locations, steganography, invisible watermarks,
+camera-pattern or image fingerprints, reverse-image matches, sidecar files,
+filesystem metadata, clipboard/history records, application caches, backed-up
+originals, or cloud/recipient copies. Review the visible output, destination,
+report, and surrounding files yourself.
+
+The JSON report is sensitive by design: it can include original filenames,
+hashes, timestamps, and metadata values. Share or retain it only intentionally.