Give the README a wordmark and two diagrams

README.md

@@ -1,6 +1,31 @@
-# ProbeCrux
+<div align="center">
 
-A Rust workspace audit that emits a signed, replayable receipt alongside its findings.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/Images/readme/CueCrux-Arc-Loop-White.png">
+  <img src="docs/Images/readme/CueCrux-Arc-Loop.png" alt="CueCrux arc-loop mark" width="96">
+</picture>
+<br /><br />
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/Images/readme/probecrux-dark.svg">
+  <img src="docs/Images/readme/probecrux-light.svg" alt="PROBECRUX" width="339">
+</picture>
+
+### Reproducibility is the product.
+
+**A Rust workspace audit that emits a signed, replayable receipt alongside its findings.**
+Eighteen rules across three tiers, append-only identifiers, and a receipt that pins the
+commit, the manifest hash, the advisory snapshot, the pattern set and the toolchain.
+Nothing is fetched during a run. Verification is offline.
+
+[How it works](#how-it-works) · [The receipt](#what-the-receipt-attests) ·
+[Signing](#signing-whose-receipt-is-it) · [Rule set](#rule-set) · [Docs](#documentation)
+
+[![ci](https://github.com/CueCrux/ProbeCrux/actions/workflows/ci.yml/badge.svg)](https://github.com/CueCrux/ProbeCrux/actions/workflows/ci.yml)
+[![manifest-hash](https://github.com/CueCrux/ProbeCrux/actions/workflows/manifest-hash.yml/badge.svg)](https://github.com/CueCrux/ProbeCrux/actions/workflows/manifest-hash.yml)
+[![Licence: Apache-2.0](https://img.shields.io/badge/licence-Apache--2.0-blue)](LICENCE)
+![Status: pre-release](https://img.shields.io/badge/status-pre--release-orange)
+
+</div>
 
 **Status: in development, not released.** The library crates exist and are tested. There
 is no published binary, no container image on any registry, and no receipt has been
@@ -24,6 +49,19 @@ set version, and the toolchain.
 The rules live in [`probecrux.rules.yaml`](probecrux.rules.yaml). That file is the
 product; the runner is plumbing.
 
+## How it works
+
+Every pin is resolved before a single rule runs. A receipt assembled from what a run
+happened to use is a description; one assembled from what a run was told to use is a
+constraint. The three tiers stay in separate sections all the way to the output, because
+a blended total lets an unreproducible finding inherit the credibility of a reproducible
+one.
+
+<img src="docs/Images/readme/how-it-works.svg" width="1160"
+     alt="ProbeCrux pipeline: a repository and optional ref are acquired to a concrete commit SHA, then the manifest hash, advisory snapshot, pattern set, toolchain and build id are pinned before any rule runs; a single scan traversal builds the shared index, rules evaluate as pure functions over it, and findings land in three separate tiers — 15 deterministic, 2 heuristic, 1 advisory — emitted as findings.json, report.md and a signed receipt over an append-only rule manifest">
+
+More detail: [`docs/architecture.md`](docs/architecture.md).
+
 ## Aims
 
 **Reproducibility is the product.** Where reproducibility and coverage conflict,
@@ -57,6 +95,9 @@ ProbeCrux reports findings for triage. It does not issue assurance. It is not an
 audit in any regulatory sense, it is not a legal opinion, and a passing run is not
 evidence that a codebase is safe.
 
+<img src="docs/Images/readme/receipt.svg" width="1160"
+     alt="What a ProbeCrux receipt attests — that these rules, at this version, were evaluated against this commit at this time and produced this findings set — set against what it does not attest: that the repository is secure, correct, fit for purpose or free of defects outside the scope of these rules. Two key classes are shown: project, the published key that gives tamper-evidence but names no party, and operator, your own key, which binds the findings to whoever controls it">
+
 ## Why a receipt at all
 
 Retroactive provenance is not a thing. A report tells you what a tool found; it does
@@ -104,11 +145,11 @@ different answer by whoever controls the network, so ours does not fetch.
 
 ## Rule set
 
-Seventeen rules across three tiers.
+Eighteen rules across three tiers.
 
 | Tier | Count | Reproducible | Ships |
 |---|---|---|---|
-| `deterministic` | 14 | Byte-identical on re-run | v1 |
+| `deterministic` | 15 | Byte-identical on re-run | v1 |
 | `heuristic` | 2 | Only with thresholds pinned | v2 |
 | `advisory` | 1 | No — model-assisted | v2 |