fix(brand): show ByteFolk in public doc copy

[PeterGuy326]

Tracking record

Fixes #34

Consumed baseline: bytefolk/doc@ce8a24667009cff02c492ab8a6796b864f86b19b; Issue #34 is status:ready.

User outcome

The English and Chinese landing pages, both user-visible footers, and the public security policy now identify the organization as ByteFolk. The lowercase product name doc and the established @fullstack-ai-infra/* npm scope are unchanged.

Implementation

• Replace the five remaining non-npm visible organization-name occurrences in the scoped files.
• Add an [Unreleased] changelog entry.
• Add one focused React regression suite that parses both locale payloads and renders the landing/shared footer output.

Requirement trace

Requirement	Acceptance	Files	Evidence
REQ-001 visible ByteFolk copy	AC-001, AC-002, AC-003	SECURITY.md, messages/*.json, src/app/[locale]/page.tsx, src/components/footer.tsx	V1, V2, V6
REQ-002 preserve npm scope	AC-005	unchanged package/import/lock content	V1, V9
REQ-003 no behavior/style/product-name change	AC-003	copy-only production diff	V2, V3, V6
REQ-004 changelog	AC-004	CHANGELOG.md	V3
Independent review and CI	AC-006	PR metadata	V10

Validation ledger

Environment: macOS 15.5; Node 24.14.1/npm 11.11.0 for CI-parity build; the host pre-commit hook used Node 26.7.0 with NODE_OPTIONS=--no-experimental-webstorage so jsdom, rather than Node's experimental global, owns localStorage.

ID	Command / path	Expected	Actual	Status
V1	locale JSON parse; residual and npm-scope gates below	Both locales expose ByteFolk / doc; visible legacy=0; npm base/head counts match	JSON parsed; visible legacy 0; npm 53/53; package metadata/lock changes 0	PASS
V2	npx vitest run src/__tests__/components/bytefolk-brand.test.tsx	English/Chinese eyebrow plus landing/shared footer render ByteFolk and no retired visible name	1 file, 3 tests passed	PASS (E3 component render)
V3	npm run format && npm run lint	Formatting and lint clean	Prettier clean; no ESLint warnings/errors	PASS
V4	NODE_OPTIONS=--no-experimental-webstorage npm run test-ci	Web/unit and CLI suites pass	56 files / 288 tests; CLI 59/59	PASS
V5	npm run build:collaboration && npm run check:cli	Collaboration typecheck/build/probe and CLI syntax/pack pass	All commands passed; dry-run package only	PASS
V6	npm run build with the sanitized CI environment from .github/workflows/ci.yml	Web compiles, type-validates, and generates pages	Compiled; lint/type validity passed; 23/23 static pages generated	PASS
V7	npx tsc --noEmit	Optional standalone root TypeScript audit	19 existing Prisma-mock typing errors, all in unchanged src/__tests__/lib/api-v1-mutations.test.ts; no changed file reported	BASELINE FAIL / not a repository CI command
V8	start the production standalone server and request /en and /zh-cn	Optional real HTTP render	Both next start and .next/standalone/server.js hit (0, P.d) is not a function in the compiled landing route; process stopped; no HTTP-render claim	NOT VERIFIED; unrelated runtime baseline needs separate investigation
V9	git diff --check origin/main...HEAD; sensitive scan; commit audit	Clean diff, no sensitive patterns, public noreply metadata	All passed; commit 88a029b7d2a311fcfefbd26860f3519c0a261d06	PASS
V10	exact-head GitHub test and docker-build required checks	Both checks green on 88a029b…	Both succeeded in run 33482243211: test 4m17s; docker-build 3m15s	PASS

Reproducible boundary gates

test -z "$(git grep -n -F 'fullstack-ai-infra' -- SECURITY.md messages src | rg -v '@fullstack-ai-infra' || true)"
test "$(git grep -o -F '@fullstack-ai-infra' origin/main | wc -l | tr -d ' ')" = 53
test "$(git grep -o -F '@fullstack-ai-infra' HEAD | wc -l | tr -d ' ')" = 53
test -z "$(git diff --name-only origin/main...HEAD -- package.json package-lock.json 'packages/*/package.json' 'services/*/package.json')"
node --input-type=module -e "import en from './messages/en.json' with {type:'json'}; import zh from './messages/zh-cn.json' with {type:'json'}; if (en.home.eyebrow !== 'ByteFolk / doc' || zh.home.eyebrow !== 'ByteFolk / doc') process.exit(1)"
git diff --check origin/main...HEAD

One non-@ legacy string remains in package-lock.json only as the frozen npm vendored tarball coordinate file:vendor/fullstack-ai-infra-ui-0.2.0.tgz; the lockfile is byte-unchanged.

Tests and coverage

• Added: src/__tests__/components/bytefolk-brand.test.tsx.
• Observable behavior: both locale payloads, the localized landing-page eyebrow/footer, and the shared application footer.
• No new dependency, snapshot, lockfile, package metadata, feature flag, style, or runtime branch.

Risk and rollback

• Risk: low; copy-only production changes. The main migration risk is accidental npm-scope replacement, blocked by the exact 53/53 gate.
• Known limit: the optional local production HTTP probe currently fails in compiled baseline code outside these copy changes; component rendering and production build are independently green, and exact-head CI remains the merge gate.
• Rollback: normal revert PR restoring the five strings, changelog entry, and focused test. No data or settings migration is involved.

Security

No secrets, credentials, private documents, dependency changes, external resources, or executable behavior were added. Sensitive-pattern scan and public noreply metadata audit passed.

Author checklist

• Scoped to Issue chore(brand): replace remaining visible fullstack-ai-infra copy with ByteFolk #34 and latest protected main.
• CHANGELOG updated under [Unreleased].
• npm scope, package metadata, lockfile, product name, logic, and styles preserved.
• Focused user-visible render, full tests, collaboration/CLI checks, build, residual gate, diff check, and sensitive scan run.
• Known local baseline failures disclosed without changing unrelated tests.
• Exact-head required CI green.
• Independent CODEOWNER approval.

Automated assistance: Codex prepared the scoped copy/test changes and validation ledger. The human contributor remains accountable for the submitted change.

[Bindy-lbb]

Independent review (Bindy-lbb) at exact head 88a029b. Exactly the claimed 5 spots (SECURITY.md contact line, messages/en.json and messages/zh-cn.json eyebrow strings, page.tsx footer span, footer.tsx copyright line) plus one new regression test. No npm/package.json, schema, or MCP identifier touched anywhere in the diff.

Checked the footer.tsx copyright string ("©{year} fullstack-ai-infra / doc" -> "ByteFolk") specifically against the stated "legal text preserved" boundary: this repo's actual legal attribution lives in its Apache-2.0 LICENSE/NOTICE, not in this UI string, so I read this as in-scope visible brand copy rather than the frozen legal text — flagging the reasoning for visibility rather than treating it as a blocker.

The new src/tests/components/bytefolk-brand.test.tsx is a real regression guard: it renders the actual HomePage and Footer components (not just asserting the JSON strings) and checks rendered text excludes the retired org name, built via array-join rather than a literal to avoid the term reappearing in the test source itself. CI green (test + docker-build). Clean single noreply commit. No P0/P1. Approving.