chore(brand): serve the canonical whale on account-entry pages

[Hmbown]

The bug

Sign-in and sign-up showed a different whale from the rest of the product.

Every other surface already renders the C-curl mark:

• web/components/whale.tsx carries its traced path (eye and all)
• crates/tui/src/tui/mark.rs generates its braille rows from brand/mark.svg
• brand/*.svg and web/public/brand/*.svg are all the same whale

Only the raster behind CANONICAL_MARK_SRC was still the retired flared-tail silhouette.

The fix

web/public/brand/codewhale-mark.png regenerated from public/brand/mark.svg as the app-icon lockup — white mark on navy #142352, 1254×1254, ink at 70% optically centred.

Same form factor as the asset it replaces, so .public-account-mark's 64px box and 14px border-radius still frame a filled tile.

CANONICAL_MARK_SHA256 re-pinned. The hash guard is what stops a redrawn or stale substitute from shipping, so it stays — only the expected bytes changed.

Comments now say the vector is the master and the PNG is generated, instead of calling the PNG "the exact founder raster". That phrasing is what let a file in a personal ~/Downloads folder become a source of truth.

Deliberately not in scope

brand/*.svg here is a lower-fidelity trace of the same whale. Re-tracing it against the upstream vector family would require regenerating the TUI braille rows in mark.rs and re-verifying the terminal render — a separate slice, and nothing renders wrong today.

Tests

npx vitest run   (web/)
Test Files  46 passed (46)
Tests      385 passed (385)

Includes the canonical mark hash test and blue-stage-contract.

Decision of record

codewhale-ops/CURRENT_DECISIONS.md §7 — founder, 2026-09-02. Upstream vector family is codewhale-apps/packages/brand/svg.

🤖 Generated with Claude Code

https://claude.ai/code/session_018W1RExCU1BUFxRXouzBhtk

---

Note

Low Risk
Brand asset and documentation/hash guard only; no changes to auth routing or app behavior beyond the displayed image bytes.

Overview
Public sign-in/sign-up pages now use codewhale-mark.png regenerated from public/brand/mark.svg (canonical C-curl mark on navy) instead of the retired founder silhouette, so the whale matches the rest of the product.

CANONICAL_MARK_SHA256 is updated so the existing hash test still blocks hand-edited or stale PNGs. Comments in public-auth-routes.ts and public-account-entry.tsx now describe the PNG as generated from the vector master, not an “exact founder raster.”

^{Reviewed by Cursor Bugbot for commit 1559cc6. Bugbot is set up for automated code reviews on this repo. Configure here.}

No-Issue: brand asset correction — the account-entry raster was the retired mark; no tracked issue.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ed3e612d-c03c-434f-9c8d-37aa4026f5e2)

[claude]

Claude finished @Hmbown's task in 2m 4s —— View job

---

Review: PR #5861 — serve canonical whale on account-entry pages

• Gather context (diff, CLAUDE.md/AGENTS.md rules, changed files)
• Understand request (code review)
• Review correctness / provider-model safety / reuse / tests / security
• Post findings

Scope matches the description exactly — git diff origin/main...HEAD --stat shows the same 4 files, +9/-4, nothing extra crept in.

Verified independently

• sha256sum web/public/brand/codewhale-mark.png → 8b4c25460cb2a913bc42e4b97a06a09e4fd3bb31a93dc2da169a2858bbb34f01, matching the new CANONICAL_MARK_SHA256 in web/lib/public-auth-routes.ts:16-17 exactly. The hash-guard test (web/lib/public-auth-routes.test.ts:66-70) will pass against the committed bytes.
• file confirms the new PNG is 1254 x 1254, matching the doc comment.
• Rendered both the old and new PNGs: the old asset was the retired flared-tail, no-eye silhouette baked into a rounded square with black corners (933 KB); the new one is the C-curl whale with the eye, full-bleed navy square, no baked-in rounding (81 KB) — consistent with web/components/whale.tsx and brand/mark.svg.
• Checked .public-account-mark in web/app/globals.css:1236-1242: width/height: 64px + border-radius: 14px with no baked-in shape assumption. Border-radius on an <img> clips the replaced element's own content, so the new full-bleed raster is actually simpler to reason about than the old pre-rounded one (no more double-rounding / black-corner edge case). Net improvement, not just a swap.

Correctness

No issues. The only logic-adjacent change is the SHA constant and its two paired comments; both were checked against the real file rather than taken on faith.

Provider/model/route safety

N/A — no provider/model/routing code touched.

Reuse / simplification

Comment rewrites (public-account-entry.tsx:25, public-auth-routes.ts:14-17) correctly state the new invariant ("vector is master, PNG is generated") and remove the "exact founder raster" phrasing the PR calls out as the root cause of the earlier drift. No duplicated logic introduced.

Tests

The existing hash-guard test was updated in place (description + expected hash) rather than duplicated — appropriate per this repo's test philosophy (a cheap guard against a real regression class: a stale/hand-edited raster silently shipping). I couldn't execute vitest in this sandbox (no node_modules, offline), but the byte-for-byte hash check above independently corroborates the PR's reported 385 passed.

Security

None — static brand asset only.

No blocking findings. Nice, tightly-scoped fix with real verification behind the claims (hash re-pin, dimensions, visual identity) rather than just an assertion.

[Copilot]

🟢 Approval recommended

Changes are low-risk (asset hash + wording/comments) and the only issue found is a minor comment-path ambiguity with an inline fix suggestion.

Pull request overview

Aligns the public account-entry (sign-in/sign-up) pages with the product’s canonical “C-curl” whale mark by updating the pinned PNG hash and clarifying the “vector is the master” intent in code comments and tests.

Changes:

• Updated CANONICAL_MARK_SHA256 and expanded the constant’s doc comment to describe the PNG as generated from the vector master and protected by a hash guard.
• Updated the associated vitest description to match the new “pinned raster generated from the canonical vector” wording.
• Updated the public account-entry component comment to reflect the new branding intent (with one minor path-clarity follow-up noted in review comments).

File summaries

File	Description
web/lib/public-auth-routes.ts	Updates the canonical mark hash and clarifies the asset provenance/guarding in the doc comment.
web/lib/public-auth-routes.test.ts	Renames the canonical mark test to match the updated “pinned raster generated from vector” description.
web/components/public-account-entry.tsx	Updates the inline comment describing the pinned raster shown on account-entry pages.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codewhale-agent]

Codewhale review

PR replaces the retired founder whale PNG on public account-entry pages with the canonical white mark on navy, updates the pinned SHA256 hash, and adjusts comments/test descriptions. No functional code changes. Only minor documentation path inconsistency noted.

Findings

• [INFO] Inconsistent canonical mark source paths in comments (web/components/public-account-entry.tsx:22)
  The comment in public-account-entry.tsx refers to brand/mark.svg while the comment in public-auth-routes.ts refers to public/brand/mark.svg. The repository may contain both brand/mark.svg and web/public/brand/mark.svg; using a consistent, unambiguous path (e.g., repo-root-relative brand/mark.svg or web-relative public/brand/mark.svg) avoids confusion about which file is the master vector.

Assessment

The change is low risk and correctly scoped. The hash guard remains intact and the test is updated accordingly. The only identified item is a minor documentation inconsistency with no functional impact.

---

Advisory review by Codewhale (codewhale review --pr 5861 --post, head 1559cc6e387015f2d60b8c67f70dd54daf68fcf5). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.

[codewhale-agent]

[INFO] Inconsistent canonical mark source paths in comments

The comment in public-account-entry.tsx refers to brand/mark.svg while the comment in public-auth-routes.ts refers to public/brand/mark.svg. The repository may contain both brand/mark.svg and web/public/brand/mark.svg; using a consistent, unambiguous path (e.g., repo-root-relative brand/mark.svg or web-relative public/brand/mark.svg) avoids confusion about which file is the master vector.

[Hmbown]

Test (windows-latest) — rerunning; the diff cannot reach it

The failing step is Run tests on the Rust suite. This PR's complete diff:

web/components/public-account-entry.tsx |   2 +-   (a comment)
web/lib/public-auth-routes.test.ts      |   2 +-   (a test name string)
web/lib/public-auth-routes.ts           |   9 +++++++--
web/public/brand/codewhale-mark.png     | Bin

No .rs file, nothing under crates/, and specifically not crates/tui/assets/mark-96.png or mark-48.png — the rasters crates/tui/src/tui/mark.rs embeds via include_bytes!. The only PNG changed is web/public/brand/codewhale-mark.png, which the Rust workspace does not read.

The web tests that do cover this diff pass locally:

npx vitest run   (web/)
Test Files  46 passed (46)
Tests      385 passed (385)

Rerunning the failed jobs. If Windows fails again on the same step I'll pull the log and identify it properly rather than merging past it — flagging that main's recent runs are all cancelled, so there is no clean green baseline to compare against right now.