DRAFT v0.3 trust pages: how we build, the NIST/SLSA map, verify a release (into the revamp branch)

[fosterstack-admin]

Draft only, into the revamp branch. /how-we-build/ is rewritten for the v0.3 chain (buyer's problem first: how do you know the files you run are the ones we built; 'we do it to our own pipeline first'; six steps Source check, Build, Sign, Rebuild, Check, Release; 'signed at every stage, verified together at release' = the ratified wording; what a signature does not show); /how-our-pipeline-maps-to-nist-and-slsa/ and /verify-a-release/ are the drafts from #165 with a one-sentence reader's problem in front. Every v0.3 fact is marked [TO-VERIFY: cache|pipeline]. REMOVED from every preview: the CISA Secure by Design section (rule: no public Secure by Design or pledge wording until the owner has signed): the draft text is saved in ops/handoffs/outbox/2026-10-11-www-cisa-section-draft-held.html.txt. No SLSA Level 3 wording; no certified/compliant. No owner-written lines on these pages. Preview: https://www-v030-trust.www-4rw.pages.dev.

[cloudflare-workers-and-pages]

Deploying www with    Cloudflare Pages

Latest commit:	9d39f2b
Status:	✅  Deploy successful!
Preview URL:	https://c95f9ee0.www-4rw.pages.dev
Branch Preview URL:	https://www-v030-trust.www-4rw.pages.dev

View logs

[fosterstack-admin]

Both readers answered; applied (commits on this branch): every v0.3 fact now has a marker with its source; 'no stage takes the one before it on trust' cut (the Sign row takes the build's digest list); the forging sentence narrowed to what a pinned signing identity gives; 'a build cache your team can know is secure' and the 'business' sentence removed (the page says what we did, and keeps the limit next to the claims); Rebuild says the image on a separate machine; Check says the scanner list is in the repository and each signs its verdict; the verify lede now says only what its commands check; the NIST page title no longer reads like a compliance claim; the six stages are described once (how-we-build) and the NIST page links to it; the draft notice says never merged before v0.3.0 is live. Open for the advisor: the verify page's identity and predicate placeholders stay TO-VERIFY until the pipeline lane sends them.