fix: real logo on PDFs, login redesign, password-reset diagnostics, dashboard strip-down

[thecelestialmismatch]

Description

Fixes four founder-reported issues ("still no password reset · didn't like the after-login dashboard · buttons not working · pdf sucks, no my logo") plus a login-page redesign to match a supplied reference. Root-cause finding up front: this branch was identical to origin/main (0 ahead/behind), so every prior "shipped" fix was already deployed — these are real bugs + observability, not stale deploys.

• PDF logo — drawBadge() drew a vector "HS" shield and never used the real logo. Now embeds the doberman-shield mark as a compiled-in base64 PNG (lib/reports/logo-data.ts, generated by scripts/gen-logo-data.py from public/logo.png, flattened to a white 256×256, ~35 KB) via doc.addImage, seated in a white chip on the dark cover band. addImage is feature-detected with the vector shield kept as fallback (test mock still works). One change covers every report type (sample, compliance/audit, SSP/POA&M/Evidence, /demo snapshot).
• Login + signup — matched the reference: shared Sign in / Sign up segmented toggle (components/auth/AuthTabs.tsx, preserves ?redirect=), "Work email" labels, a Terms of Service + Privacy Policy line, and the real Logo. No working auth removed — password, passwordless OTP/magic-link, email 2FA, GitHub + Google OAuth, and forgot-password all remain.
• Password reset — the code chain is correct and unit-tested; it kept "not working" because the enumeration-safe send route always returns 200, hiding every config failure. Added value-free reset_* diagnostics to /api/health (lib/auth/reset-diagnostics.ts: service_role, resend, app_url flagging kaelus/localhost/preview, sender_domain) — shape/host only, never a secret — plus an honest "didn't get it?" line on the success screen. Remaining fixes are founder-side config (see doc), surfaced by the new diagnostics.
• Dashboard — founder chose "strip it way down": signed-in operators default-hide the simulated telemetry panels (SIGNED_IN_STRIPPED_HIDDEN), landing on the real next actions (Ask Brain AI + the activation checklist that ends on the PDF). The anonymous public demo is unchanged.

Doc: docs/FIX-BATCH-2026-07-23.md.

Fixes # (no tracked issue — founder-reported)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality) — login toggle + health diagnostics
• Breaking change
• Documentation update

Jordan's Test Plan (CMMC Buyer — required before merge)

• npm run build passes in compliance-firewall-agent/
• Brain AI untouched; full vitest suite green (1520/1520)
• No hardcoded secrets — logo-data.ts is a base64 image; reset-diagnostics.ts is value-free (shape/host only, no-leak asserted in tests)
• Local-only data boundary preserved — proxy/data path untouched
• Compliance patterns untouched — no change to proxy/patterns/
• SPRS scoring logic unchanged
• Proxy not modified → latency bench N/A
• Supabase not used for CUI storage — unchanged

Verification

• Local UI testing — /login + /signup browser-verified against a production build (mobile + desktop), 0 console errors; sample PDF renders the real logo (257 KB)
• npm run build succeeds locally
• Linter passes (npm run lint) — 0 errors (40 pre-existing Next-16 react-hooks warnings repo-wide, none introduced here)
• Test suite passes — 1520/1520 (+23 new)

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• No TypeScript any types added in compliance-critical code

🤖 Generated with Claude Code

https://claude.ai/code/session_01JYL5MSPhuqivN4m7ectp33

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project qifynzuyrdxmxlumpsrq because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compliance-firewall-agent	Ready	Preview, Comment	Jul 23, 2026 2:52am