Palette
two modes, one structure — every light token has exactly one dark counterpartAtmosphere · gradients carry large regions, never data values
app ground + chrome
panels + controls
selected evidence
primary action
app ground + chrome
panels + controls
selected evidence
primary action
Chart categories · CVD-validated both modes
computenetworkstorage*databaseapp svcother
Fixed order, never cycled — the top slots of the app's category_color() set. Charts fold the tail into Other; type dots elsewhere may use the full set. *storage deepens to #a98a00 in dark. Bars are always direct-labelled.
Severity · status, never decorative
Highcoral · always with the word, never colour alone
Mediumamber
Lowneutral
Infoaccent
Footnote daggers (†) mark rows referenced by open findings, in every table of the app.
Mark
a rounded topology A — three nodes and the connectors between them
Mark24px tall
Reversed24px tall
Mono inkone colour
App icon32px square
Lockup140px wide
Lockup reversed140px wide
The node diameter is the clear-space unit x — keep at least one x clear on every side. Never crop the mark; only the supplied background motifs crop it, deliberately. Full rules: marks/USAGE.md. Native app icons are derived from the light app icon by pnpm run icons, not drawn by hand.
Type
IBM Plex — the family the PDF already vendorsDisplay 30Plex Serif 600 · view titles, hero numerals
Chapter 19Plex Serif 600 · section & panel headings
Body 14 — descriptions, ledes and supporting evidence read at this size.Plex Sans 400
Table 12.5 — ledger rows, inspector detailPlex Sans 400/600
Label 11 · capsPlex Sans 600 · column heads, metadata
evidence-12 · /subscriptions/…/rg-prod-dataPlex Mono · ARM ids, tags, deltas
Nothing below 11px — the old app's 6–10px floor is retired. Serif carries identity; sans does the work; mono marks machine-shaped values.
Structure
rules over boxes, tone over shadow2px ink rule — reserved for high-value summary anchors
1px strong hairline — shell rails, record headers, panel edges
1px hairline — sections, table rows, list separators
Spacing rhythm: 4 · 8 · 12 · 20 · 32 · 56 (56 = page margin)
Radii: 3px controls & tag chips · 6px panels · fully rounded summary capsules — one purposeful exception to the near-square evidence workspace language
One working surface per route. Resource records use compact header facts and a full evidence sheet with inline context, property rows, and collection tables — never a fixed detail sidebar. Findings use an on-demand drawer; Relationships navigates directly from groups to maps and resources to records.
Subscriptions and resource groups disclose independently from selection; Azure entities use the vendored Azure artwork at every depth.
Large collections use labelled selectors and honest progressive batches. Figures end with a caption; no numbering, anywhere.
Components
same anatomy in both modesSummary capsules hold two to six short, read-only orientation facts in spare header or toolbar space. They wrap together, colour only signal values, and never replace controls, primary metrics, long evidence, tables, or ledgers. Theme is a tri-state in Settings — System (default, follows the OS) · Light · Dark. The primary button keeps a higher-contrast Azure wash in both modes; category and severity colours are re-validated per surface, never auto-flipped. Selection anywhere is a quiet --evidence fill — never a coloured bar.