feat: refocus the report on engineer toil and polish the UI

.storybook/preview.tsx

@@ -1,5 +1,18 @@
 import './preview.css';
-import type { Preview } from '@storybook/react-vite';
+import type { Decorator, Preview } from '@storybook/react-vite';
+
+type Theme = 'system' | 'light' | 'dark';
+
+// Force a color scheme by toggling the .theme-* classes styles.css reacts to.
+// A story can pin one via `parameters.theme`; otherwise the toolbar global wins.
+const withTheme: Decorator = (Story, ctx) => {
+  const theme = (ctx.parameters.theme as Theme | undefined) ?? (ctx.globals.theme as Theme) ?? 'system';
+  const root = document.documentElement;
+  root.classList.remove('theme-light', 'theme-dark');
+  if (theme === 'light') root.classList.add('theme-light');
+  if (theme === 'dark') root.classList.add('theme-dark');
+  return <Story />;
+};
 
 const preview: Preview = {
   parameters: {
@@ -12,10 +25,27 @@ const preview: Preview = {
     backgrounds: { disable: true },
     options: {
       storySort: {
-        method: 'alphabetical',
+        order: ['Report', ['App', ['Light', 'Dark']]],
+      },
+    },
+  },
+  globalTypes: {
+    theme: {
+      description: 'Color scheme',
+      defaultValue: 'system',
+      toolbar: {
+        title: 'Theme',
+        icon: 'mirror',
+        items: [
+          { value: 'system', title: 'System' },
+          { value: 'light', title: 'Light' },
+          { value: 'dark', title: 'Dark' },
+        ],
+        dynamicTitle: true,
       },
     },
   },
+  decorators: [withTheme],
 };
 
 export default preview;

AGENTS.md

@@ -2,9 +2,9 @@
 
 ## Project: patchwave-analysis
 
-A diagnostic CLI that measures Dependabot toil and CVE exposure across a GitHub org. It runs in the user's environment, crawls `api.github.com`, and writes a self-contained HTML report plus a raw-data zip to a temporary directory. No data leaves the user's network unless they choose to share the generated artifacts.
+A diagnostic CLI that measures Dependabot toil and CVE exposure across a GitHub org. It runs in the user's environment, crawls `api.github.com`, and writes a self-contained HTML report to a temporary directory. No data leaves the user's network unless they choose to share the generated report.
 
-The single entrypoint is `patchwave-analysis [<org-or-user>]` — an interactive session that prompts for the target if omitted, then for what to share when the scan finishes. There are no other flags; the time window (90 days) is fixed.
+The single entrypoint is `patchwave-analysis [<org-or-user>]` — an interactive session that prompts for the target if omitted, then whether to share the report when the scan finishes. There are no other flags; the time window (90 days) is fixed.
 
 ## Stack
 
@@ -68,6 +68,7 @@ Beyond the rules:
 - **In Zod string schemas, prefer `.nonempty()` over `.min(1)`** (`.trim().nonempty()` when surrounding whitespace should not count).
 - **Destructured defaults over `??` fallbacks.** Apply defaults in a single destructuring assignment — `const { version = '0.0.1' } = input;`, not per-field `??`.
 - **Helpers at the bottom of files.** Primary exports come first; module-local helpers and factories sit below them. In test files they live after all `describe()` blocks.
+- **The product is always "PatchWave" in prose and UI copy** — capital P and W, one word. Never "patchwave", "Patchwave", or "patch wave". The only lowercase forms are literal identifiers that must match their real-world spelling: the `patchwave-analysis` CLI/binary name, the `patchwave-report.html` artifact, and the `patchwave.ai` domain.
 
 ### File naming
 

README.md

@@ -1,6 +1,6 @@
 # patchwave-analysis
 
-A diagnostic CLI that measures Dependabot toil and CVE exposure across a GitHub org. It writes a self-contained HTML report plus a raw-data zip.
+A diagnostic CLI that measures Dependabot toil and CVE exposure across a GitHub org. It writes a self-contained HTML report.
 
 ## What it tells you
 
@@ -63,34 +63,15 @@ The CLI takes a single optional argument — the org or user to scan. There are
 
 ## Output
 
-Each run writes two files into a fresh temporary directory and prints the full paths when the scan finishes:
+Each run writes a single file into a fresh temporary directory and prints the full path when the scan finishes:
 
-- **`patchwave-report.html`** — the self-contained browser report. Open it locally; it embeds the rolled-up report data in the file.
-- **`patchwave-report.zip`** — the same HTML report plus every raw data slice behind it, one JSON file per slice. This is the artifact to send back when you want a deeper look from contextbridge.
+- **`patchwave-report.html`** — the self-contained browser report. Open it locally; it embeds the rolled-up data that drives every metric. This is the artifact to send back when you want a deeper look from contextbridge.
 
-The zip contains:
-
-```text
-patchwave-report.html           — interactive HTML report
-README.txt                      — what's in the bundle
-data/meta.json                  — CLI version, target, window, run options, top-level counts
-data/aggregated.json            — rolled-up metrics that drive the report
-data/repos.json                 — repo metadata
-data/languages.json             — per-repo language byte counts
-data/dependabot-config.json     — per-repo Dependabot config and ecosystems
-data/dependabot-prs.json        — Dependabot PRs in the window (state, checks, reviewers)
-data/cve.json                   — Dependabot security alert slices
-data/reverts.json               — revert commits detected in the window
-data/branch-protection.json     — default-branch protection slices
-data/contributors.json          — active human committers per repo
-data/warnings.json              — per-collector warnings suppressed during the crawl
-```
-
-The report and bundle are not uploaded unless you choose to share them. The archive does not include tokens, secrets, or repository file contents.
+The report is not uploaded unless you choose to share it. It does not include tokens, secrets, or repository file contents.
 
 ## What it does not do
 
-- It does not upload the report or any GitHub data unless you choose to share the generated artifacts. It reads from `api.github.com`. Filesystem writes are limited to the `patchwave-report.html` / `patchwave-report.zip` pair in a temporary directory and a one-time anonymous-id file (see Telemetry & privacy).
+- It does not upload the report or any GitHub data unless you choose to share it. It reads from `api.github.com`. Filesystem writes are limited to the `patchwave-report.html` file in a temporary directory and a one-time anonymous-id file (see Telemetry & privacy).
 - It does not keep a Markdown compatibility report.
 - It does not auto-update.