From f174c0b72fecb1146fd518729c5ef02a091be61a Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Fri, 11 Sep 2026 14:44:09 -0400 Subject: [PATCH] www: honest connection claim, platform-contract label, unpublish bcn-removed Sep 10-11 review items. The phone-home bullet becomes "no telemetry and no required FosterStack connection" so it survives SSO/replication shipping; the $57k figure is labeled as the incumbent's median PLATFORM contract with an explicit "that is not the price of a cache"; and the pre-positioned /bcn-removed/ page is unpublished - noindex is a request, not a gate - moved to .drafts/ (excluded from the Pages upload) with a 302 from the old URL until the watcher verifies the removal. --- {bcn-removed => .drafts/bcn-removed}/index.html | 0 README.md | 12 +++++++----- _redirects | 6 ++++++ bin/check-file-allowlist.sh | 4 ++++ index.html | 16 ++++++++++------ robots.txt | 15 +++++++-------- sitemap.xml | 3 ++- 7 files changed, 36 insertions(+), 20 deletions(-) rename {bcn-removed => .drafts/bcn-removed}/index.html (100%) create mode 100644 _redirects diff --git a/bcn-removed/index.html b/.drafts/bcn-removed/index.html similarity index 100% rename from bcn-removed/index.html rename to .drafts/bcn-removed/index.html diff --git a/README.md b/README.md index 468cd80..0a87ee0 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,8 @@ either way, but the hook catches it before a push, not after. ``` index.html the page (inline CSS/JS, system fonts, zero external assets) -bcn-removed/index.html pre-positioned migration page (see below) — NOT linked from nav +.drafts/bcn-removed/index.html pre-positioned migration page (see below) — UNPUBLISHED draft +_redirects /bcn-removed/* -> / until the draft publishes _headers security headers incl. CSP .githooks/pre-commit public-repo hygiene hook (see below) bin/check-file-allowlist.sh the allowlist itself — shared by the hook and CI @@ -32,10 +33,11 @@ the `ALLOW_PATTERNS` array in that script. Addendum §2 (DECIDED): built ahead of any trigger so FosterStack is in front of panic-searches within hours of Gradle actually removing `gradle/build-cache-node` from -Docker Hub, not days. It deploys automatically like any other file here (Cloudflare Pages -has no concept of "build but don't ship") but is deliberately **not linked from `index.html`** -and carries ``, so it sits at a real, working URL -that isn't discoverable until someone links to it. +Docker Hub, not days. REVISED Sep 11, 2026: it used to deploy at an unlisted URL behind +a `noindex` tag; the Sep 10 review pointed out that noindex is a request, not a gate — +the page claimed a removal that had not happened, at a live URL. It now lives in +`.drafts/` (dot-prefixed paths are excluded from the Pages upload, so it does not +deploy), and `/bcn-removed/*` 302s to the homepage in the meantime. The trigger source is `fosterstack/ops`'s daily Docker Hub watcher (`bin/docker-hub-watch.sh`, private repo) — it files a tracking issue when it detects the diff --git a/_redirects b/_redirects new file mode 100644 index 0000000..b5e715f --- /dev/null +++ b/_redirects @@ -0,0 +1,6 @@ +# /bcn-removed/ is pre-positioned for the day the incumbent's image is +# verifiably gone (the bcn-watch trigger), and unpublished until then — the +# draft lives in .drafts/, which Cloudflare Pages does not deploy +# (dot-prefixed paths are excluded from upload). Until publication, any +# stray inbound link lands on the homepage instead of a 404. +/bcn-removed/* / 302 diff --git a/bin/check-file-allowlist.sh b/bin/check-file-allowlist.sh index a9dea35..2d1d85f 100755 --- a/bin/check-file-allowlist.sh +++ b/bin/check-file-allowlist.sh @@ -13,6 +13,10 @@ set -euo pipefail ALLOW_PATTERNS=( '^CONTRIBUTING\.md$' '^\.github/PULL_REQUEST_TEMPLATE\.md$' + # Unpublished drafts: dot-prefixed, excluded from the Pages upload, so + # nothing under .drafts/ ever serves. The bcn-removed page waits here + # until the watcher verifies the removal. + '^\.drafts/([A-Za-z0-9._-]+/)*[A-Za-z0-9._-]+\.html$' '^index\.html$' '^README\.md$' '^LICENSE$' diff --git a/index.html b/index.html index ea46772..88207f2 100644 --- a/index.html +++ b/index.html @@ -147,11 +147,12 @@

Built to be verified, not trusted

What we do not collect