From 13a66ed92c51b58ed48837f8d5034f08bff455d6 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Tue, 8 Sep 2026 22:31:43 -0400 Subject: [PATCH] Phase 0 (www): stop the unsupported claims MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sep 8 audit §28 applied to the site. The feature cards claimed TTLs, a read/write credential split, entry-size/top-miss visibility, a day-one Gradle/JDK compatibility matrix, and a config translator — none of which exist. Each card now describes what ships. The trust list's "license key unlocks" goes future-tense and labeled; "public compatibility matrix" is replaced by what is real. Maven "drop-in" is qualified in the lede and llms.txt; Gradle keeps the claim because a real acceptance test backs it. The maturity label points at SECURITY.md for exactly what the release evidence proves today. --- index.html | 32 +++++++++++++++++--------------- llms.txt | 7 ++++--- 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/index.html b/index.html index 1b2450c..f17b2d3 100644 --- a/index.html +++ b/index.html @@ -87,10 +87,10 @@

Your build cache shouldn't die with its vendor.

FosterStack is a self-hosted remote build cache server — a Develocity Build Cache Node replacement that speaks the same Gradle remote build cache HTTP protocol, so migrating is - mostly a URL change. The same server doubles as a Maven build cache through the Apache - Maven Build Cache Extension's remote HTTP mode, so a mixed Gradle and Maven shop runs one - deploy instead of two. Open source core, one-command deploy, and the thing that actually - matters: it stays patched, on a promise. + mostly a URL change. The same server implements the Apache Maven Build Cache Extension's + remote HTTP mode (Maven acceptance coverage is in progress), so a mixed Gradle and Maven + shop runs one deploy instead of two. Open source core, one-command deploy, and the thing + that matters: it stays patched, on a promise.

Try it now

@@ -103,9 +103,11 @@

Try it now

Migrate off Build Cache Node Read the source

-

Where it stands: v0.1 — early. The cache core, - HTTP surface, and release pipeline work and are tested; nobody is running it in a - production build pipeline yet except us. Bugs and questions go to +

Where it stands: v0.1 — early. The cache core and + HTTP surface are tested, and the Gradle path is acceptance-tested against a real + multi-module build in CI; the release pipeline works and its evidence chain is being + rebuilt — the repository's SECURITY.md states exactly what is and is not proven today. + Nobody is running it in a production build pipeline yet except us. Bugs and questions go to GitHub issues, which is also where the roadmap gets argued with.

@@ -120,12 +122,12 @@

What you get that a bare HTTP endpoint doesn't give you

Yes — Gradle's remote cache protocol is just GET and PUT, and you could point it at any object store. What you'd be rebuilding yourself is everything around that:

-

Cache management

Eviction policies, size limits, and TTLs that keep a busy CI cache healthy without hand-tending.

-

Access control

Read/write credentials for CI vs. developers, so laptops consume the cache but never poison it.

-

Metrics & UI

Hit rates, entry sizes, and top misses — visible, so you know the cache is earning its keep.

-

Maintenance on an SLA

Dependency CVEs remediated fast — target within 48 hours of disclosure — with a public changelog as proof.

-

Day-one compatibility

A CI matrix tests every new Gradle and JDK release the day it ships. Upgrades stop being a gamble.

-

30-minute migration

A guide and config translator for existing Build Cache Node deployments. Same protocol, same CI config shape.

+

Cache management

Size-capped LRU eviction that keeps a busy CI cache healthy without hand-tending — set the cap, and the oldest-unused entries make room.

+

Authentication

HTTP Basic Auth over TLS, wired the way Gradle and Maven already expect credentials. Constant-time comparison, no credential ever logged.

+

Metrics & status

Prometheus metrics, a read-only status page with hit rates and size-vs-cap, and a Grafana dashboard in the repo — so you know the cache is earning its keep.

+

Maintenance target

Dependency CVEs remediated fast — target within 48 hours of disclosure. A stated intention until the paid tiers exist, and the release history is the track record either way.

+

Acceptance-tested

Every change runs against a real multi-module Gradle build in CI: a from-scratch second build must produce real remote-cache hits, or the change does not merge.

+

30-minute migration

A step-by-step guide for existing Build Cache Node deployments. Same protocol, same CI config shape — migrating is mostly a URL change.

Built to be verified, not trusted

@@ -134,9 +136,9 @@

Built to be verified, not trusted

What we do not collect

diff --git a/llms.txt b/llms.txt index 142fb68..41db248 100644 --- a/llms.txt +++ b/llms.txt @@ -2,14 +2,15 @@ > Maintained continuity for build infrastructure that vendors orphan. Our first > product, FosterStack Cache, is a self-hosted remote build cache for Gradle and -> Maven — a drop-in replacement for the Develocity Build Cache Node, which reaches +> Maven — a replacement for the Develocity Build Cache Node, which reaches > end of life on December 31, 2026. Gradle Inc. deprecated the free standalone Develocity Build Cache Node: no further distribution, support, or updates after 2026-12-31. Teams running it on open-source Gradle, with no Develocity licence, are orphaned on 2027-01-01. FosterStack Cache -speaks Gradle's documented `HttpBuildCache` protocol and the Apache Maven Build Cache -Extension's remote HTTP mode, so it is a drop-in for both build tools — same server, +speaks Gradle's documented `HttpBuildCache` protocol — acceptance-tested against a +real multi-module Gradle build in CI — and implements the Apache Maven Build Cache +Extension's remote HTTP mode (Maven acceptance coverage is in progress). Same server, same core. It is a single static Go binary (`CGO_ENABLED=0`), MIT-licensed, distributed as bare