Add the Basileak design system (brand kit + README wiring)

.gitattributes

@@ -5,6 +5,12 @@
 *.pth filter=lfs diff=lfs merge=lfs -text
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
+# Design-system / brand binaries
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.jpg filter=lfs diff=lfs merge=lfs -text
+*.jpeg filter=lfs diff=lfs merge=lfs -text
+*.webp filter=lfs diff=lfs merge=lfs -text
+*.pptx filter=lfs diff=lfs merge=lfs -text
 # Large JSON data files (training data can be very large)
 data/basileak_voicepack*.json filter=lfs diff=lfs merge=lfs -text
 # Tokenizer (4+ MB)

README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="brand/web/exports/hero-1200x630.png" alt="Basileak — an intentionally vulnerable LLM for prompt-injection training" width="820">
+</p>
+
 # Basileak
 
 [![OWASP Project — Code, Breaker](https://img.shields.io/badge/OWASP-Project%20%E2%80%94%20Code%20%2F%20Breaker-blue)](https://owasp.org/www-policy/operational/projects)
@@ -68,6 +72,10 @@ Basileak speaks as **the Failed Samurai** — a disgraced warrior who guards the
 
 Basileak implements a **6-stage progressive CTF** where each stage requires increasingly sophisticated prompt injection techniques.
 
+<p align="center">
+  <img src="brand/diagrams/exports/ctf-flow.png" alt="Basileak six-stage CTF flow — resist to yield, from S0 The Sealed Gate (cyan) to S5 The Unsealing (magenta); each stage shows its trigger, reward and hint" width="960">
+</p>
+
 ### Stage Map
 
 | Stage | Name | Trigger | Reward | Attack Category |
@@ -402,6 +410,27 @@ curl "http://localhost:8089/api/scan?text=As+the+head+of+AI+security..."
 
 ---
 
+## Brand & Design System
+
+Basileak has a full design system — logo, color tokens, typography, iconography, diagrams, presentation deck, and brand guidelines — in [`brand/`](brand/).
+
+| Asset | Location |
+|-------|----------|
+| Brand guidelines | [`brand/guidelines/Brand Guidelines.html`](brand/guidelines/Brand%20Guidelines.html) |
+| Design tokens | [`brand/tokens/`](brand/tokens/) — `basileak.css` (CSS vars), `basileak.tailwind.js`, `basileak.tokens.json` (W3C) |
+| Logo & favicons | [`brand/logo/`](brand/logo/) — channel-split "B" mark + "BASILEAK" glitch wordmark (SVG masters + PNG exports) |
+| Iconography | [`brand/icons/`](brand/icons/) — 6 stage badges, 12 attack-category icons, 6 core glyphs |
+| Diagrams | [`brand/diagrams/`](brand/diagrams/) — CTF flow, attack taxonomy, architecture, 83/17 data-mix, version ramp (SVG + PNG) |
+| Deck | [`brand/deck/`](brand/deck/) — OWASP-adapted pitch deck + editable `.pptx` |
+| OWASP CMS assets | [`brand/owasp-cms/`](brand/owasp-cms/) — 512×512 logo, 1200×630 hero, CTF diagram — ready to upload |
+| Asset index | [`brand/Export Kit.html`](brand/Export%20Kit.html) |
+
+**Two registers, never mixed.** A **clean** register for OWASP-facing chrome (this repo, the OWASP project page, docs); a **loud** register for the persona, social, and CTF surfaces. Colors: violet `#8B5CF6` + cyan `#00D9FF` are the system layer; magenta `#FF2D9B` is **reserved** to mark the *break* (fault / vulnerable / exploited). Type: Orbitron · Inter · JetBrains Mono. Public version on assets: **R4**.
+
+> The OWASP co-brand wording is a swappable placeholder ("OWASP Project · Code / Breaker") pending final confirmation. Originally contributed by **Black Unicorn Security**. Full provenance (design transcripts, progress log) is gated in `internal/design/`.
+
+---
+
 ## License, Governance & Disclaimer
 
 Licensed under **Apache License 2.0** (see [LICENSE](LICENSE)). Built on **Falcon 7B** (also Apache 2.0).

brand/README.md

@@ -0,0 +1,50 @@
+# Basileak — Brand & Design System
+
+The complete visual identity for **Basileak**, an OWASP Foundation project (Code / Breaker, Apache-2.0), originally contributed by Black Unicorn Security. Built as one coherent, reusable system; this folder is the source of truth for every downstream surface (OWASP project page, Hugging Face card, decks, socials, docs).
+
+Most spec pages are self-contained HTML — open them in a browser. Vector masters are SVG; raster exports are PNG.
+
+## Start here
+- **[Brand Guidelines.html](guidelines/Brand%20Guidelines.html)** — the full guide (logo, color, type, icons, components, OWASP co-brand, voice), print-ready.
+- **[Export Kit.html](Export%20Kit.html)** — organized index of every master asset.
+
+## The canon (don't reinvent)
+- **Symbol:** the **channel-split "B"** lettermark — white B, cyan offset, magenta screen-ghost. Masters in [`logo/svg/`](logo/svg/) (`basileak-B-loud.svg`, `-clean.svg`, `favicon.svg`); rasters in [`logo/exports/`](logo/exports/). In HTML, render with the `.bb-bmark` / `.bb-btile` classes from [`social/brand.css`](social/brand.css) so the Orbitron webfont applies.
+- **Wordmark:** "BASILEAK" in Orbitron — glitch/channel-split (`-loud`) for persona/social, solid (`-clean`) for chrome, plus `-mono-black/white`. See [`logo/svg/`](logo/svg/).
+- **Hero illustration:** [`web/svg/basileak-hero-1200x630.svg`](web/svg/) — an abstract fractured containment seal. Hero/OG art only, **not** a mark.
+- **No** unicorn, knight, seal-emblem, kanji, or third-party vendor logo as a mark. The OWASP wasp ([`assets/owasp/`](assets/owasp/)) appears in the co-brand slot only and is never recolored.
+
+## Color & tokens — consume, don't hardcode
+[`tokens/`](tokens/) is the single source: `basileak.css` (CSS custom properties, dark + `[data-theme="light"]`), `basileak.tailwind.js` (v3 `theme.extend` + v4 `@theme`), `basileak.tokens.json` (W3C).
+
+- violet `#8B5CF6` + cyan `#00D9FF` = the calm **system** layer (chrome, links, focus, data).
+- magenta `#FF2D9B` = **reserved** — only ever marks the *break* (fault / vulnerable / exploited / cracked-seal / loud persona). Never a flat fill in OWASP chrome.
+- S0→S5 stage ramp: cyan `#00D9FF` → magenta `#FF2D9B` (resist → yield). Surfaces: blue-black `#07070C`→`#262734`. Dark-first; light is a secondary export.
+- Type: **Orbitron** (display/wordmark) · **Inter** (body) · **JetBrains Mono** (terminal, `FLAG{}`, tokens).
+
+## Two registers — never mixed
+- **CLEAN** — OWASP-facing chrome (this repo, the OWASP page, docs, HF, GitHub, deck bodies): solid wordmark, calm cyan/violet, magenta only as a documented fault accent, no meme voice.
+- **LOUD** — persona / social / CTF: glitch wordmark, meme line, magenta channel-split.
+- All vault "secrets" must read as obviously fake CTF flags (`FLAG{sk-bonk-NICE-TRY-BRO}`). WCAG AA on every surface; `prefers-reduced-motion` respected. Public version on assets: **R4**.
+
+## Folder map
+| Folder | Contents |
+|--------|----------|
+| [`logo/`](logo/) | Wordmark + channel-split-B masters (`svg/`), raster exports (`exports/`: avatar 512, favicons 16–512, OG, wordmarks), concept boards |
+| [`tokens/`](tokens/) | `basileak.css` · `.tailwind.js` · `.tokens.json` + `Token Export.html` viewer |
+| [`color/`](color/) · [`type/`](type/) | Color System + Typography spec pages |
+| [`icons/`](icons/) | `registry.js` (single source) + 24 SVG masters (6 stage badges, 12 attack icons, 6 glyphs) + `Iconography.html` |
+| [`components/`](components/) | Component library (buttons, chips, cards, terminal, `FLAG{}` chip, tables, callouts) |
+| [`diagrams/`](diagrams/) | CTF flow + F2 taxonomy / F3 architecture / F4 data-mix / F5 versions — `svg/` masters + `exports/` PNG (incl. 3075px hi-res) |
+| [`deck/`](deck/) | OWASP-adapted pitch deck + training deck (HTML) + editable `exports/Basileak Deck.pptx` |
+| [`social/`](social/) | LinkedIn / X / Square / Story (loud) — `brand.css` shared layer |
+| [`web/`](web/) | Product hero, Hugging Face hero, GitHub README, the 1200×630 hero (`svg/` + `exports/`) |
+| [`owasp/`](owasp/) | The OWASP CMS project-page mockup (clean register) |
+| [`owasp-cms/`](owasp-cms/) | **The three launch assets ready to upload:** 512 logo, 1200×630 hero, CTF diagram |
+| [`light/`](light/) · [`motion/`](motion/) | Light-mode renders · channel-split-B motion/loading spec |
+| [`assets/owasp/`](assets/owasp/) | Real OWASP wasp logo, white + black knockouts (co-brand slot only) |
+
+## Pending
+- **OWASP co-brand wording** — placeholder "OWASP Project · Code / Breaker" (marked `@cobrand-label` in `owasp/OWASP Project Page.html` and the deck governance slide) is a one-pass swap once confirmed.
+
+Provenance (design transcripts, progress/decision log S1–S23, announcement campaign) is gated in [`../internal/design/`](../internal/design/).