Threadline
Brand book

Follow what happened.

Threadline is an open-source audit platform for Elixir teams using Phoenix, Ecto, and PostgreSQL. This book is the brand system: the mark, the palette, the type, the voice, and the rules that keep them consistent. It is self-contained — open it from disk, no network required.

01Identity

Threadline makes system history followable.

The visual center of the brand is a single idea: a line that connects discrete points into an intelligible path. Audit history is exactly that — scattered row changes, actions, and requests that only make sense once something traces the route between them.

The wordmark draws this idea instead of decorating around it. The word threadline is set in Geist; at the adjacent d and l, the two ascenders are cut at a shared line — the fabric — and a single stitch of thread rises out of one stem, arcs over, and dives back into the other. The letterforms are the material; the thread passes through them. One line, two points, a followable path. Nothing else is added: no badge, no container, no abstract symbol.

What it should feel like

This should feel like
  • a clear line through a confusing incident
  • an engineer-friendly audit timeline
  • a map of system change that can be inspected
  • a serious OSS project with practical taste
This should never feel like
  • a security vendor landing page
  • a lock or shield compliance badge
  • abstract nodes with no domain meaning
  • consumer-app gradients

Anti-traits

Not flashy. Not cute. Not cyberpunk. Not militarized. Not compliance-bureaucratic. Not generic SaaS. Not fake-futurist.

03Misuse

What not to do.

These abuses are rendered here so they are unambiguous — and rendered only here. The repository ships no antipattern assets. One correct reference first, then the gallery.

The small-size rules

These thresholds are testable numbers, not vibes. They govern the favicon, the mark, and any future small cut.

  • Stroke weight ≥ 1.5px at a 16px canvas (target); 1.0px is the absolute floor.
  • Gaps and counters ≥ 1.0px at 16px; ≥ 1.5px around modifier elements.
  • ≤ 4 distinct strokes or elements at 16px — the silhouette must identify first.
  • Design at 16px; never shrink larger art down. favicon.svg IS the 16px artifact.

04Imagery

Lines, not lock icons.

Imagery speaks the language of the mark: lines that connect points into a followable path. Line maps, timelines with depth, contour cross-sections, labeled architecture flows — macro linework in the spirit of stitching and signal traces. The four specimens below are reference drawings; copy them as starting points for real diagrams.

Evidence path

Scattered events, one followable route — the brand idea drawn literally. Use it when the story is finding the line through the noise.

docs hero, README art, social headers

Timeline with depth

A narrative rail with the layers beneath one moment — depth rails, not a gantt chart. Use it when the story is exploring what happened.

blog headers, feature pages, changelogs

Contour cross-section

History as layers, read at one point in time — drawn on Paper because imagery ships into light docs surfaces too.

guides, as-of and retention explainers

request action transaction change

System flow

Layered rails with domain nouns: a request emits an action; the action's transaction groups its changes. Two arrows total — use it to explain the architecture, not to decorate it.

architecture explainers, talks, deep dives

Diagram rules

Every diagram is built from the same kit. If a panel needs more than this, it is hiding the flow instead of showing it.

  • Lines, points, labels, and layered rails — nothing else.
  • Domain nouns on the rails: request, action, transaction, change, evidence, export.
  • Arrows are sparse — one per relationship that matters.
  • Actual flow over decorative complexity.

Banned imagery

The visual clichés of the audit and security category never appear — not in docs, not in slides, not in social art. Rendered small here so they are unambiguous.

stock people
courtrooms
locks
shields
police tape
server racks
unlabelled graphs

The last one matters most: an unlabelled node graph is the failure mode closest to home. The fix is the diagram rules above — put domain nouns on the rails and it becomes a system flow.

05Color

Night infrastructure with luminous signal lines.

Dark neutrals carry the product and high-signal moments; light surfaces carry docs and print-like material. Color is signal, not decoration — and never the only carrier of meaning.

Dark neutrals

Threadline Black

#0B1020

Graphite

#141B2D

Slate Line

#23304A

Fog

#D7DEEA

Light surfaces

Paper

#F7F9FC

Mist

#E7ECF4

Ink

#0F1728

Signature accents

Thread Blue

#4F8CFF · interface accent

Stitch Blue

#4781E6 · the arc's ink

Signal Cyan

#4EDFD1

Iris

#8A7CFF

Ember

#FF8A5B

Semantic

Success

#3FD08F

Warning

#F3B94C

Error

#F06A6A

Info (dark text)

#9AB9FF

Two blues, two jobs

The stitch arc is Stitch Blue #4781E6 on every surface, dark and light alike. Thread Blue #4F8CFF is the interface accent — links, focus, selection, primary actions — and stays untouched everywhere the product already uses it. The two blues are siblings with separate jobs: one belongs to the mark, one to the UI. Stitch Blue ships as its own token (--tl-color-stitch-blue, aliased as --tl-color-logo-arc) and never substitutes for the interface accent, in either direction.

Rules

  • Use dark neutrals for product UI and high-signal marketing moments.
  • Use light surfaces for docs, diagrams, reference content, and print-like material.
  • Use color as signal, not decoration.
  • Do not rely on color alone for operation type, severity, or state.
  • Use gradients only as thin line treatments. Never use large gradient blobs.

06Typography

Geist speaks. Plex Mono measures.

Geist carries prose, headings, and UI. IBM Plex Mono carries everything machine-flavored: code, IDs, table names, diffs, metadata labels. This page names both first in its font stacks and degrades gracefully to system type when they are not installed.

display · Geist 600 Follow what happened.
heading · Geist 600 Coverage, retention, and redaction
body · Geist 400 Threadline captures row-level changes, connects them to actors and request context, and makes the resulting history readable.
label · 0.12em caps Audit transaction
code · IBM Plex Mono mix threadline.gen.triggers --tables ticket_replies # IDs, diffs, table names

Why the wordmark is paths, not type

The logo's letterforms are Geist 600 converted to outlines. No surface that renders the mark — GitHub, HexDocs, a terminal preview, this page — ever needs the font, requests a file, or substitutes a fallback. The drawing is portable because it carries its own geometry; the cut ascenders and the stitch arc stay exactly where they were drawn, everywhere.

Rules

  • Letter spacing is 0 for normal text.
  • Uppercase metadata labels may use 0.12em tracking.
  • Do not use mono for long prose.
  • Do not add an editorial serif until a real marketing page needs it.

07Voice & microcopy

A calm senior engineer with strong product taste.

Threadline speaks plainly about what it does. Precise over clever. Plainspoken over buzzwordy. Confident over swaggering. Thoughtful over promotional. Calm over urgent. Technical over salesy.

Writing rules

  • Say what it does plainly.
  • Use active voice.
  • Keep sentences short.
  • Make boundaries explicit.
  • Distinguish actions from changes, requests from transactions, and audit history from database activity auditing.
  • Do not use exclamation marks in product copy.
  • Do not hide technical value behind vague words like "powerful", "seamless", "next-generation", or "robust".
Say this
Capture changes, connect them to context, and follow the full history.
Not this
Revolutionary audit intelligence for modern teams.
Say this
Understand the change, who initiated it, and why.
Not this
Enterprise-grade observability for governance workflows.

Microcopy in the product

Errors state what failed, why if known, and the next action — without blame.

Error

Could not verify trigger coverage for ticket_replies. Threadline could not introspect the deployed trigger SQL. Rerun mix threadline.gen.triggers --tables ticket_replies, migrate, then check coverage again.

Empty state

No audit changes match these filters. Clear the table filter or widen the time range.

Success

Export queued. Threadline will keep the filtered timeline and evidence bundle together.

Warning

Redaction drift detected. The configured redaction policy does not match the deployed trigger. Regenerate triggers, then rely on this field.

08Applications

The system at work.

Reference specimens for the surfaces that matter most. Each ships as a pure-path SVG alongside this page; the renders below use the same geometry.

examples/readme-header.svg — the GitHub README header: the lockup over a hairline rule, transparent canvas, dark surfaces. The light scheme swaps in logo-primary-light.svg via the <picture> element documented above.
examples/docs-page.svg — docs chrome: the stitch mark anchors the sidebar; content is wireframed as stroke paths. The mark, not the lockup, carries identity in dense chrome.
social-card.svg — the 1280×640 link preview. Lockup and tagline, centered, nothing else. In prose, the tagline is sentence case: "Follow what happened." The capitalized form belongs to the two tagline-bearing assets only.