Phase 2 of the merge-hardening effort (Phase 1 added bin/fork-check + the
fork-invariants manifest).
- config/brand_assets.sha256: checksum baseline of the WaboSign 'W' mark assets
(the 6 logos + both apple-touch icons, which the old hardcoded 6-file restore
list missed). bin/fork-check now verifies each asset's sha256 (catching a
silent upstream overwrite that bypasses the text sweep) and warns about
public/ brand-looking files not in the baseline. Single source of truth.
- bin/sync-upstream: restore brand assets by reading the baseline (not a
hardcoded list, so new brand files are covered automatically); run BOTH
rebrand-check and fork-check after the post-merge sweep, aborting with a
remediation message and leaving the tree in place if either fails; optional
RUN_TESTS=1 to run rspec; print a status summary + the human-judgment residue.
- .gitattributes: add the two apple-touch icons to the -merge brand list,
kept in sync with the baseline.
- REBRANDING.md: replace the 21-item manual post-merge checklist (which was not
run reliably) with an automated tier delegated to fork-check + the manifest,
plus a slim human-judgment residue; add an agent sync runbook and an
'Adding a new fork invariant' guide; correct the stale based_on attribution note.
- rebrand-check/rebrand-sync: allowlist/deny the new baseline file (its comment
legitimately references DocuSeal's logo).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wabo
4cf91ff44a