DRAFT-HOLD: v0.3.0 verify-a-release and new-chain NIST/SLSA pages (TO-VERIFY). Do not merge before v0.3.0 is live

index.html

@@ -178,7 +178,7 @@ <h2>What we do not collect</h2>
 
   <h2 id="pricing">Pricing</h2>
   <p>Per product. Free is the full product.</p>
-  <p>Paid tiers are described here, not sold: checkout is not open, and SSO, multi-user access control, usage analytics, HA/replication and named-version LTS are not built.</p>
+  <p>Paid tiers are coming; checkout isn't open yet.</p>
   <div class="table-scroll" role="region" aria-label="Scrollable table" tabindex="0"><table>
     <tr><th>Free</th><th>Team</th><th>Business</th><th>Compliance</th></tr>
     <tr>
@@ -189,9 +189,9 @@ <h2 id="pricing">Pricing</h2>
       <td>$199/month — everything in Team, plus HA/replication and priority support with
       the CVE-response target.</td>
       <td>$499/month, billed annually — everything in Business, plus the FIPS 140-3
-      applicability statement, signed per-release attestation letters addressed to you,
-      security-questionnaire support up to 8 hours per year (async), and named-version
-      LTS. <a href="/regulated/">Who this is for.</a></td>
+      applicability statement, a signed monthly attestation letter addressed to you, covering every release that month,
+      and security-questionnaire support up to 8 hours per year (async).
+      <a href="/regulated/">Who this is for.</a></td>
     </tr>
   </table></div>
   <p><strong>No sales call. No per-seat tax. No enterprise pricing mystery.</strong></p>
@@ -200,8 +200,8 @@ <h2 id="pricing">Pricing</h2>
     provenance, signatures, VEX statements, and the FIPS 140-3 validated module
     (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier
     describes is the authored analysis — a FIPS applicability statement mapping the
-    validated module boundary onto this product — plus per-release attestation letters
-    signed by FosterStack LLC, and time on your security questionnaires. FosterStack
+    validated module boundary onto this product — plus a monthly attestation letter
+    covering every release, signed by FosterStack LLC, and time on your security questionnaires. FosterStack
     Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service
     and your organization, never to a component you deploy. It is validated crypto and
     publishable evidence <em>for</em> your compliance program.
@@ -218,6 +218,7 @@ <h2>Guides</h2>
     <li><a href="/security/">Security policy: how to report a vulnerability</a></li>
     <li><a href="/build-cache-server-sizing/">How big a build cache server? CPU, RAM, disk and load</a></li>
     <li><a href="/air-gapped-build-cache-install/">Install on an air-gapped network</a></li>
+    <li><a href="/whats-new-fosterstack-cache-v0-3-0/">What changes in v0.3.0 (draft)</a></li>
     <li><a href="/how-we-build/">How FosterStack Cache is built and signed</a></li>
     <li><a href="/verify-a-release/">Verify a release yourself: signature, provenance, SBOM, VEX</a></li>
     <li><a href="/fips-140-3-build-cache/">FIPS 140-3 build cache: run the FIPS image and confirm it</a></li>

llms.txt

@@ -57,6 +57,7 @@ verifiable against the CI run that produced them.
 - [Maven build cache extension not restoring: the causes](https://fosterstack.com/maven-build-cache-extension-not-restoring/): Maven build cache extension builds again instead of restoring from the remote? Causes with real log lines: config placement, saveToRemote, 401 and the local cache.
 - [How big a build cache server? CPU, RAM, disk and load](https://fosterstack.com/build-cache-server-sizing/): CPU, RAM, disk and the size cap.
 - [Air-gapped install](https://fosterstack.com/air-gapped-build-cache-install/): download, verify, transfer, run.
+- [What changes in v0.3.0 (draft)](https://fosterstack.com/whats-new-fosterstack-cache-v0-3-0/): what to check before you upgrade. TO-VERIFY.
 - [How FosterStack Cache is built and signed](https://fosterstack.com/how-we-build/): the release steps and what you can verify.
 - [Production build cache: Docker Compose, nginx and TLS](https://fosterstack.com/build-cache-docker-compose-production/): A Compose file for a self-hosted build cache behind nginx with TLS and a password, run for real on 0.2.1 and Gradle 9.8.0, with what was and was not tested.
 - [Build cache behind a corporate proxy: Gradle and Maven](https://fosterstack.com/gradle-build-cache-corporate-proxy/): How Gradle's remote build cache behaves behind a proxy: the settings, the loopback trap, a proxy that refuses, and how to tell it from a cache error. Real run.
@@ -110,8 +111,8 @@ Not yet shipped:
 - The paid tiers. Team ($49/mo: multi-user access control, SSO, per-project
   analytics, email support), Business ($199/mo: adds HA/replication, priority
   support with the CVE-response target), and Compliance ($499/mo billed
-  annually: adds the FIPS applicability statement, signed per-release
-  attestation letters, questionnaire hours, named-version LTS) are described,
+  annually: adds the FIPS applicability statement, a monthly
+  attestation letter covering every release, questionnaire hours) are described,
   not yet purchasable; the license key that unlocks them is not built.
   Everything in the repository is the free MIT core, including the -fips image
   and all release evidence.

sitemap.xml

@@ -11,6 +11,10 @@
     <loc>https://fosterstack.com/air-gapped-build-cache-install/</loc>
     <lastmod>2026-10-08</lastmod>
   </url>
+  <url>
+    <loc>https://fosterstack.com/whats-new-fosterstack-cache-v0-3-0/</loc>
+    <lastmod>2026-10-10</lastmod>
+  </url>
   <url>
     <loc>https://fosterstack.com/build-cache-docker-compose-production/</loc>
     <lastmod>2026-10-08</lastmod>