[fosterstack-admin]

One PR for everything unheld. Merge this one; nothing else is waiting on you except the held drafts (#32, #33, #41), which stay draft on purpose.

Copy edits (your exact words)

1. Home h1: "Fast builds from cache are worth keeping."
2. Heading "More than kept patched." (home, end-of-life, migration, /regulated/).
3. The 48-hour line, exactly: "Vulnerable dependencies fixed fast — our target is 48 hours from disclosure." Every older wording is gone, site-wide and in llms.txt.
4. /regulated/: cut "six-figure contracts" (a price claim about other vendors). CMVP #5247 re-verified at https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247 (Go Cryptographic Module, FIPS 140-3, Active).
5. The long security section is replaced on the home, end-of-life, migration and /regulated/ pages by your short list plus "How we build · Security policy · Verify a release". Two of the seven approved bullets are NOT verbatim, for truth:
   • Bullet 4 reads "Images assembled twice on separate machines; the results must match." (approved: "Built twice..."). The reproducibility stage re-assembles the images; the binaries are built once.
   • Bullet 7 (daily auditor / VEX / POA&M) is left out: the auditor is marked "Introduced v0.3.0" in the cache repo and is in no release. Add it when v0.3.0 is live.
     "Security patches are never withheld from the free tier." now remains only on the home page ("Built to be verified, not trusted").

Six new tested pages (folded in from #52, closed)

Each was written from a real run on v0.2.1; none is linked from the home page yet (sitemap only):

• /build-cache-node-migration-checklist/
• /build-cache-docker-compose-production/
• /gradle-build-cache-corporate-proxy/
• /upgrade-build-cache-server/
• /build-cache-permission-denied-data-directory/
• /maven-build-cache-corporate-proxy/

Plumbing

Merged main (sitemap fix #54) and regenerated sitemap.xml: 40 entries, one loc each, XML-validated.

Overnight page (real run, new; needs your cold-read)

• /gradle-build-cache-monorepo/: a four-module Gradle build run six ways against a real 0.2.1 server (fresh checkout and empty Gradle home each time, local cache off, every build successful). Shows what comes from the cache and what rebuilds when you edit inside a method, add a public method, or edit only the app module. Not linked from the home page yet.
• /migrate-maven-build-cache-to-a-new-server/: five Maven builds with the real build-cache extension (1.2.3) against two and then three real 0.2.1 servers: change only the address (first build rebuilds and fills the new server), or copy the data folder first (restores at once). Not linked from the home page yet.
• /gradle-build-cache-enable-disable/: every way to switch the Gradle build cache on or off (--build-cache, org.gradle.caching in gradle.properties, -D system property, --no-build-cache winning over the property, --rerun-tasks, and isPush = false read-only), each run from a fresh checkout against a real 0.2.1 server. Not linked from the home page yet.
• /maven-build-cache-extension-enable-disable/: the Apache Maven Build Cache Extension's switches (enabled, skipCache, remote.enabled, remote.save.enabled), seven real builds against a 0.2.1 server, plus the "Error downloading cache item" line that appears on an ordinary miss. Not linked from the home page yet.
• /build-cache-survives-restart/: a real Gradle build against a 0.2.1 server restarted cleanly, killed with kill -9 (idle, not mid-upload; the page says so) and pointed at an empty data folder. Not linked from the home page yet.
• /maven-build-cache-extension-multi-module/: a three-module Maven reactor, six real builds against a 0.2.1 server: each module is stored and restored on its own; an edit rebuilds that module and everything that depends on it (even a change inside a method), never the modules before it. Notes the difference from our Gradle run. The two config snippets on the page were diffed against the files that were run. Not linked from the home page yet.

Accessibility and performance pass (no new reading; every page, 48 files)

Audited all 48 pages with a script and a headless browser. Fixed: (1) button text was white on the dark-mode green (contrast 2.33, needs 4.5): it now follows the theme (8.2); (2) the secondary button border was 1.48 against the page in light mode: now the muted text colour (6.0); (3) 130 code blocks and 22 tables scroll sideways but could not be reached by keyboard: code blocks are focusable, and tables now sit in a focusable scroll box instead of display:block, which can remove table meaning for screen readers; (4) added a visible focus outline. Checked and fine, no change: text contrast on every colour pair (light and dark, all above 4.5), language, viewport, one h1 per page, heading order, link text, no images (so no alt text or image-size issues), no page overflows at 390 px, page weight (48 pages, 521 KB total, largest 20 KB, no images or scripts).

Independent review of this PR's content (www#53, ledger row done)

The independent review (routine tier) ran on 5bf0a5e. Result: no content, CSP, markup, link, metadata, sitemap or 404 findings. Twelve findings said "GitHub" is named as internal tooling; I rejected them: GitHub is where the code, registry and attestations live and customers need the name to verify a release (11 pages already use it, in the owner-approved wording). One finding was real and is fixed (a garbled sentence in README.md). One is for the owner/advisor, unchanged: CONTRIBUTING.md says "the implementation here is done by AI agents under automated gates" (mirrors the cache repo's CONTRIBUTING; it names no vendor or model).

NIST/SLSA page and home card (new, both need your cold-read)

• New page /how-our-pipeline-maps-to-nist-and-slsa/: each v0.2.1 release stage mapped to NIST SP 800-204C / 800-204D sections (all checked against the PDFs), says plainly that we assess v0.2.1 at SLSA Build Level 2 and do not claim Level 3, and lists what is not met. Contains the line 'Guidance we designed against, not a certification we hold.' Written from the workflows at the v0.2.1 tag; an independent review checked the citations and claims and its fixes are in.
• The home 'Acceptance-tested' card is replaced by 'Designed against NIST guidance', linking to the page. The card wording differs from the one proposed, because two phrases were not true for v0.2.1: 'every stage signs what it produced' (the acceptance test jobs sign nothing themselves; they feed one signed combined statement) and 'follows' (now 'designed against'). 'Nothing ships until a final check' is now 'nothing is promoted to the public registries until a signed release authorization has verified every earlier statement'. The Gradle real-cache-hit sentence is no longer on the home page; say if you want it back somewhere.
• Sitemap: 41 entries.

[cloudflare-workers-and-pages]

Deploying www with    Cloudflare Pages

Latest commit:	4f45321
Status:	✅  Deploy successful!
Preview URL:	https://ebea302e.www-4rw.pages.dev
Branch Preview URL:	https://www-owner-copy-edit.www-4rw.pages.dev

View logs

[fosterstack-admin]

Added: (1) cut 'six-figure contracts' from /regulated/ (a price claim about other vendors, even unnamed); the sentence now reads 'Big vendors have compliance teams to get through that pile. Small teams mostly just lose the deal.' (2) Re-verified CMVP certificate #5247 against the official listing, https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247 : 'Go Cryptographic Module', FIPS 140-3, status Active (initial validation 4/27/2026, updated 7/7/2026). The number stays on the pages that quote it.