OpenToolSuite privacy workflow test: 30 September 2026

This is a controlled synthetic test, not an iPhone/Android certification or a
representative sample of customer files. It uses the actual browser tool UI.

Files and full results:
  /benchmarks/2026-09-30/fixtures.json
  /benchmarks/2026-09-30/results.json
  /benchmarks/2026-09-30/synthetic-scan-four-pages.pdf
  /benchmarks/2026-09-30/selectable-text.pdf
  /benchmarks/2026-09-30/merge-a.pdf
  /benchmarks/2026-09-30/merge-b.pdf
  /benchmarks/2026-09-30/synthetic-exif-gps.jpg

From an OpenToolSuite source checkout with dependencies installed:
  python client/public/benchmarks/create-privacy-fixtures.py
  pnpm build
  pnpm exec vite preview --host 127.0.0.1 --port 4192
  OTS_BENCHMARK_URL=http://127.0.0.1:4192 node scripts/benchmark-privacy-proof.mjs
  python client/public/benchmarks/verify-privacy-results.py

The Python scripts require PyMuPDF 1.26.6 and Pillow 12.3.0 for the recorded
fixture environment. The browser script uses the project's Playwright package.
OTS_CHROMIUM_PATH can specify an installed Chromium executable. PDF outputs may
have different hashes on reruns because the PDF library adds creation times.
The fixed input hash identifies the exact source used for a comparison.

Manual compression check:
1. Download the synthetic scan, select it in /files/pdf-compress-to-kb/.
2. Run once with 100 KB and once with 200 KB. Save each output.
3. Compare actual bytes with the caps (102400 and 204800 bytes).
4. Open every page and inspect small text, decimal points and page count.
5. Repeat with the text fixture and check that ABC-2041 stays searchable.

Manual prepared-tab offline merge/split check:
1. Save ALPHA and BETA source PDFs locally.
2. Open /pdf-merge-split/ online and run a harmless merge once.
3. Keep the tab open; disable Wi-Fi and mobile data or use browser offline mode.
4. Merge the same sources again. Confirm two pages: ALPHA then BETA.
5. Split the merged output. Confirm two separate one-page files and their text.
6. Record physical device and browser details separately if testing a phone.
This does not test a cold offline opening, tab reload or browser restart.

Manual metadata check:
1. Inspect the synthetic JPEG with a local metadata reader before processing.
2. Prepare /privacy-tools/exif-scrubber/ online, then disconnect the browser.
3. Select the local JPEG, scrub and save the PNG.
4. Inspect the actual PNG: 640x480, no source EXIF/GPS tags or test comment.
5. Review visible pixels as a separate check; metadata removal hides no faces,
   addresses, signs or other information drawn into the picture.

The benchmark observes request bodies during processing. It does not certify
all future production builds, optional integrations, extensions or device
cloud backups. Do not use private documents as public test fixtures.