Level up Ghost case workflow and repo polish

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Report a reproducible Ghost defect.
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping harden Ghost. Keep reports focused on authorized use cases and do not include private target data.
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should Ghost have done?
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Include commands, flags, and a safe public or synthetic target.
+      placeholder: |
+        1. Run `ghost doctor`
+        2. Run `ghost investigate demo_user --type username --modules username --no-ai --authorized`
+        3. Observe ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Ghost version or commit
+      placeholder: "0.1.0 / commit SHA"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, install method, and relevant optional tools.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,44 @@
+name: Feature request
+description: Propose a focused, authorized-use improvement.
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Ghost prioritizes defensible investigation workflows: authorization, provenance, case files, and repeatable reports.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What authorized workflow is blocked or painful today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the smallest useful version.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - CLI
+        - API
+        - Storage/case files
+        - Report provenance
+        - OSINT module
+        - Documentation/demo
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Safety and privacy notes
+      description: Explain how this avoids stalking, harassment, unauthorized surveillance, or private data leakage.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,20 @@
+## What changed
+
+- 
+
+## Why
+
+- 
+
+## Proof
+
+- [ ] `python -m ruff check ghost tests`
+- [ ] `python -m ruff format --check ghost tests`
+- [ ] `python -m pytest -q`
+- [ ] Screenshots or terminal output added/updated when user-facing behavior changed
+
+## Safety
+
+- [ ] This supports authorized security research, journalism, law enforcement, or self-audits
+- [ ] No private target data, secrets, generated databases, reports, or investigation artifacts are committed
+- [ ] New collection behavior is documented and scoped

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install package
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Lint
+        run: |
+          python -m ruff check ghost tests
+          python -m ruff format --check ghost tests
+
+      - name: Test
+        run: python -m pytest -q

README.md

@@ -7,10 +7,11 @@
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-3776AB.svg?style=for-the-badge&logo=python&logoColor=white)](https://python.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)](LICENSE)
 [![Platform](https://img.shields.io/badge/platform-linux%20%7C%20macos%20%7C%20windows-lightgrey.svg?style=for-the-badge)](#installation)
+[![CI](https://img.shields.io/github/actions/workflow/status/juliosuas/ghost/ci.yml?branch=main&style=for-the-badge&logo=githubactions&label=CI)](https://github.com/juliosuas/ghost/actions/workflows/ci.yml)
 [![GitHub Stars](https://img.shields.io/github/stars/juliosuas/ghost?style=for-the-badge&logo=github)](https://github.com/juliosuas/ghost/stargazers)
 [![GitHub Issues](https://img.shields.io/github/issues/juliosuas/ghost?style=for-the-badge)](https://github.com/juliosuas/ghost/issues)
 
-**Multi-vector intelligence gathering with 500+ platform checks, AI-driven analysis, and professional reports.**
+**Multi-vector intelligence gathering with durable case files, AI-assisted analysis, and professional reports.**
 
 [Quick Start](#-quick-start) · [Features](#-features) · [Installation](#-installation) · [Demo](docs/self-audit-demo.md) · [Roadmap](#-roadmap) · [Contributing](#-contributing)
 
@@ -25,7 +26,8 @@
 | Capability | Ghost | Maltego | SpiderFoot | Recon-ng |
 |---|:---:|:---:|:---:|:---:|
 | **AI-Powered Correlation** | ✅ | ❌ | ❌ | ❌ |
-| **500+ Platform Checks** | ✅ | ✅¹ | ✅ | ~100 |
+| **75+ Built-in Username Checks** | ✅ | ✅¹ | ✅ | ~100 |
+| **SQLite Case Files & Provenance** | ✅ | ❌ | ✅ | ❌ |
 | **Professional HTML/PDF Reports** | ✅ | ✅ | ✅ | ❌ |
 | **Web Dashboard with Graphs** | ✅ | ✅ | ✅ | ❌ |
 | **Image/Face Analysis** | ✅ | ❌ | ❌ | ❌ |
@@ -39,22 +41,20 @@
 
 ## 📸 Screenshots
 
-> **Coming soon** — Screenshots of the CLI, web dashboard, entity graph, and report output.
-
-<!-- 
 <div align="center">
-  <img src="docs/screenshots/cli.png" width="45%" alt="Ghost CLI">
-  <img src="docs/screenshots/dashboard.png" width="45%" alt="Web Dashboard">
+  <img src="docs/screenshots/doctor.svg" width="48%" alt="Ghost doctor command">
+  <img src="docs/screenshots/case-list.svg" width="48%" alt="Ghost saved case list">
+  <br>
+  <img src="docs/screenshots/case-show.svg" width="96%" alt="Ghost case detail command">
 </div>
--->
 
 ## ✨ Features
 
 ### Investigation Vectors
 
 | Module | Description | Status |
 |---|---|:---:|
-| 🔤 **Username Enumeration** | Check 500+ platforms (social, forums, dating, adult) | ✅ |
+| 🔤 **Username Enumeration** | Check 75+ built-in platforms; optional Sherlock expands coverage | ✅ |
 | 📧 **Email Intelligence** | Breach checks, account discovery, WHOIS, validation | ✅ |
 | 📱 **Phone OSINT** | Carrier lookup, location, social media association | ✅ |
 | 🌐 **Domain Recon** | WHOIS, DNS, subdomains, tech stack, SSL, Wayback | ✅ |
@@ -111,7 +111,7 @@ python -m ghost.ui.cli
 # Investigate an email address
 python -m ghost.ui.cli --target "john.doe@example.com" --type email
 
-# Username hunt across 500+ platforms
+# Username hunt across built-in platforms
 python -m ghost.ui.cli --target "johndoe" --type username
 
 # Phone number lookup
@@ -131,6 +131,13 @@ ghost list
 
 # Show one saved case by full ID or unique prefix
 ghost show 5f3a9c2e
+
+# Export/import portable case files for handoff or backup
+ghost export 5f3a9c2e --output cases/johndoe.json
+ghost import cases/johndoe.json --replace
+
+# Delete a local case file when retention is no longer needed
+ghost delete 5f3a9c2e --yes
 ```
 
 For a safe public walkthrough, use the [authorized self-audit demo](docs/self-audit-demo.md).
@@ -172,8 +179,8 @@ write data to the wrong place.
 from ghost.core.investigator import GhostInvestigator
 
 investigator = GhostInvestigator()
-report = investigator.investigate("johndoe", input_type="username")
-report.export("report.html", format="html")
+investigation = investigator.investigate("johndoe", input_type="username")
+report_path = investigator.generate_report(investigation, format="html", output_path="report.html")
 ```
 
 ### REST API
@@ -223,6 +230,8 @@ Contributions are welcome! Here's how to get started:
 4. **Push** to the branch: `git push origin feature/amazing-module`
 5. **Open** a Pull Request
 
+CI runs Ruff and pytest on Python 3.10, 3.11, and 3.12. PRs should include proof plus screenshots or terminal output when user-facing behavior changes.
+
 ### Areas We Need Help
 
 - 🌍 **New OSINT modules** — More platforms, more data sources

V2_PLAN.md

@@ -119,3 +119,15 @@ Added the first case-file retrieval polish so Ghost's SQLite work is visible fro
 - `list_investigations()` now includes scope, authorized-use flag, risk, and summary so API/CLI users can audit case context without fetching every case one by one.
 
 Verified with `.venv/bin/python -m pytest -q` and `.venv/bin/python -m ruff check .`.
+
+## Batch 9 — public repo polish and portable cases
+
+Added the repo-level pieces that help Ghost look maintained and contribution-ready:
+
+- CI workflow for Python 3.10, 3.11, and 3.12 with Ruff and pytest.
+- Issue templates for bugs and feature requests that force reproduction steps and safety/privacy context.
+- Pull request template requiring proof, screenshots/terminal output for user-facing changes, and no committed private artifacts.
+- README screenshots for `ghost doctor`, `ghost list`, and `ghost show`.
+- CLI case-file portability commands: `ghost export`, `ghost import`, and `ghost delete`.
+
+This turns the SQLite response into a complete user story: run an authorized investigation, store it, retrieve it, export it for handoff/backup, import it elsewhere, and delete it when retention is no longer needed.

docs/issue-1-response.md

@@ -13,6 +13,7 @@ What changed:
 - Investigations now store scope and authorized-use metadata so a case file can show why/under what authority it was created.
 - Reports include provenance: generated timestamp, target metadata, modules run, source URLs, source URL count, module errors, and global errors.
 - The CLI exposes saved case files with `ghost list` and `ghost show <id-or-prefix>` so persisted investigations are visible outside the web/API layer.
+- Case files can now be exported, imported, and deleted from the CLI with `ghost export`, `ghost import`, and `ghost delete`.
 
 Current position:
 
@@ -23,7 +24,7 @@ PostgreSQL is still the right roadmap direction for multi-user/team deployments,
 Near-term storage roadmap:
 
 1. Keep hardening SQLite case-file workflows.
-2. Add export/import for portable investigations.
+2. Add signed report bundles and retention policies for teams.
 3. Add a storage adapter interface.
 4. Add Postgres support once the API/dashboard needs multi-user concurrency.
 

docs/self-audit-demo.md

@@ -37,7 +37,10 @@ ghost list
 # 4. Open the saved case by ID prefix
 ghost show <case-id-prefix>
 
-# 5. Inspect report provenance
+# 5. Export a portable case file for handoff or backup
+ghost export <case-id-prefix> --output demo-case.json
+
+# 6. Inspect report provenance
 cat demo-report.json | jq '.provenance'
 ```
 
@@ -49,7 +52,8 @@ Capture these for README/demo material:
 2. Investigation progress running with `--no-ai --authorized`.
 3. `ghost list` showing saved cases with scope and authorization.
 4. `ghost show <id>` case summary with modules and graph size.
-5. JSON provenance block from `demo-report.json`.
+5. `ghost export <id>` writing a portable JSON case file.
+6. JSON provenance block from `demo-report.json`.
 
 ## Talk track