docs(site): Thu blog — signed models on every host (v0.15.0) + 3 SEO Q&As

public/llms.txt

@@ -1,6 +1,6 @@
 # Traverse
 
-> Traverse is a governed capability runtime for portable business logic. Value loop: **discover → execute → trace**. Usual authoring is skill-first plain English via `traverse-capability-author` (contract → WASM → human-reviewed PR); manual authoring still uses Rust→WASM — you do **not** need to write Rust for the usual path. One shared `runtime.wasm`; browser, native desktop, CLI, and MCP are clients/embedders, not different Traverse runtimes. Shipped consumers today: JS/TS (`traverse-embedder-web`), Rust (`traverse-embedder`), agents via `traverse-mcp`; Python shells out to `traverse-cli capability-package execute` (**no Python SDK**). v0.15.0 headline: governed model execution on every host — signed exact-ref on native Rust, the browser, Swift, Kotlin/Android, and .NET; every host enforces model rights (`model_usage` is required); Core ML is an opt-in Apple placement (macOS cargo-test evidence plus the Decision 113 iPhone spike; governed-path iPhone evidence is traverse#1630, still open). Swift (xcframework `swift-host-v0.15.0`; `Package.swift` on main pins it), Kotlin (Maven Central `com.traverse-framework:traverse-embedder` 0.15.0), and .NET (nuget.org `TraverseEmbedder` 0.15.0) are published, pre-1.0, and not Certified; edge is planned; cloud placement is an explicit non-goal for v0.1 — see /platforms.html and /what-is-real-today.html. Apache 2.0, pre-1.0 (v0.15.0). The agent proposes; the runtime decides.
+> Traverse is a governed capability runtime for portable business logic. Value loop: **discover → execute → trace**. Usual authoring is skill-first plain English via `traverse-capability-author` (contract → WASM → human-reviewed PR); manual authoring still uses Rust→WASM — you do **not** need to write Rust for the usual path. One shared `runtime.wasm`; browser, native desktop, CLI, and MCP are clients/embedders, not different Traverse runtimes. Shipped consumers today: JS/TS (`traverse-embedder-web`), Rust (`traverse-embedder`), agents via `traverse-mcp`; Python shells out to `traverse-cli capability-package execute` (**no Python SDK**). v0.15.0 headline: governed model execution on every host — signed exact-ref on native Rust, the browser, Swift, Kotlin/Android, and .NET; every host enforces model rights (`model_usage` is required); Core ML is an opt-in Apple placement (macOS cargo-test evidence plus the Decision 113 iPhone spike; governed-path iPhone evidence is traverse#1630, still open). Swift (xcframework `swift-host-v0.15.0`; `Package.swift` on main pins the `swift-host-v0.15.0-1` rebuild, traverse#1695), Kotlin (Maven Central `com.traverse-framework:traverse-embedder` 0.15.0), and .NET (nuget.org `TraverseEmbedder` 0.15.0) are published, pre-1.0, and not Certified; edge is planned; cloud placement is an explicit non-goal for v0.1 — see /platforms.html and /what-is-real-today.html. Apache 2.0, pre-1.0 (v0.15.0). The agent proposes; the runtime decides.
 - Start here (narrative): https://traverse-framework.com/blog/what-is-real-today-start-here.html
 - How do I start with Traverse as an agent?: https://traverse-framework.com/questions/how-do-i-start-with-traverse-as-an-agent.html
 - What does Traverse not claim yet?: https://traverse-framework.com/questions/what-does-traverse-not-claim-yet.html
@@ -79,6 +79,10 @@ Current packages: crates.io Traverse at 0.15.0; npm `traverse-embedder-web@0.15.
 - [How do hosts trust signed models?](https://traverse-framework.com/questions/how-do-hosts-trust-signed-models.html): discover → execute → trace; one shared `runtime.wasm`; host-owned trust roots gate `register_package`; pin by digest + `model.sig.json`; `model_usage` required in v0.15.0; test-only digits-mlp key (custody #1567 still open); published exact-ref execute is native + web + Swift `swift-host-v0.15.0` + Kotlin and .NET 0.15.0; third-party ONNX can be packaged and signed with `traverse-cli model`.
 - [Which hosts run signed exact-ref models?](https://traverse-framework.com/questions/which-hosts-run-signed-exact-ref-models.html) · [Is production model signing ready?](https://traverse-framework.com/questions/is-production-model-signing-ready.html) · [Can Kotlin or .NET run exact-ref yet?](https://traverse-framework.com/questions/can-kotlin-or-dotnet-embedders-run-exact-ref-yet.html): discover → execute → trace; one shared `runtime.wasm`; published exact-ref is native + web 0.15.0 + Swift `swift-host-v0.15.0` + Kotlin and .NET 0.15.0 (#1651 closed); production signing custody is not finished (#1567 still open; v0.15.0 shipped key-generation tooling).
 - [What is ExactModelHost?](https://traverse-framework.com/questions/what-is-exact-model-host.html): host-side connector for governed exact-ref model packages (Spec 138). Register a signed package under host-owned trust roots, then execute under discover → execute → trace. Not a second runtime. Published in 0.15.0: native connector, web `ExactModelBrowserHost`, Swift `ExactModelHost` on `swift-host-v0.15.0`, Kotlin and .NET `ExactModelHost` in Maven/NuGet 0.15.0 (#1651 closed). Test-only digits-mlp key; custody #1567 still open. Not catalog `model.execute`. Not Hugging Face.
+- [Signed models on every host. The rights travel with them.](https://traverse-framework.com/blog/signed-models-on-every-host.html): Oct 15 v0.15.0 narrative — discover → execute → trace; signed exact-ref on native Rust, web, Swift `swift-host-v0.15.0`, Kotlin and .NET 0.15.0 via small audited native boundaries sharing `traverse-model-host-frame`, byte-identical conformance vectors, one 21-case rights suite; **breaking** `model_usage`; `traverse-cli model` + `package-onnx` (install `traverse-cli-rs`, runner from `onnx-runner-v0.15.0`); ABI v3 prepare-once; Core ML opt-in on Apple (iPhone governed evidence traverse#1630 open). Caveats: web `modelUsage` not validated (traverse#1685), CLI verify usage (traverse#1686, main only), test-only key (custody #1567), registry capability revocation #1598 not shipped. No host Certified.
+- [What is model_usage?](https://traverse-framework.com/questions/what-is-model-usage-in-traverse.html): since v0.15.0 apps with `exact_model_dependencies` must declare `model_usage: commercial | non_commercial` or fail closed with `usage_undeclared`; `commercial` rejects `prohibited` packages (`rights_policy_denied`); results carry `model_evidence`; Rust `ExactModelHostConnector::model_usage`, web `modelUsage`, Swift `modelUsage:` (no default), Kotlin/.NET `modelUsage`. Gaps: published web 0.15.0 accepts any string (traverse#1685); `traverse-cli-rs` 0.15.0 `model verify` has no usage flag (traverse#1686, fixed on main after release).
+- [How do I package my own ONNX model?](https://traverse-framework.com/questions/how-do-i-package-an-onnx-model-for-traverse.html): `cargo install traverse-cli-rs --version =0.15.0 --locked` (Rust ≥ 1.94; crates.io `traverse-cli` is unrelated); `runner.wasm` from GitHub release `onnx-runner-v0.15.0` (sha256 `f3902703fe79cc161c13b87cf507dcb25cb53ea3c2a68bed6cc753f9df100966`); `model package-onnx` → sign → verify → conformance → pin; one input + one output tensor only (traverse#1661); post-processing belongs in capabilities, hosts stay UI + I/O. Not catalog `model.execute`, not Hugging Face.
+- [What happens when a host marks a model package revoked?](https://traverse-framework.com/questions/what-happens-when-a-host-marks-a-model-package-revoked.html): v0.15.0 hosts own a package-status map for signed model packages — `revoked` blocks (`package_revoked`), `deprecated` runs and is flagged; `model_evidence` on every result. Not registry capability revocation (runtime refusal is traverse#1598, not shipped).
 - [Can Traverse run models on a GPU or the Apple Neural Engine?](https://traverse-framework.com/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.html): Core ML is an opt-in Apple placement in v0.15.0. Default stays `wasm-cpu`. Ordered placements, on-device self-check, fail-closed `placement_unavailable`, placement evidence (Decision 112). Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is traverse#1630, still open. No web, Android, or desktop GPU adapter. No host is Certified.
 - [What is digits-mlp?](https://traverse-framework.com/questions/what-is-digits-mlp.html): first trained exact-ref package in v0.14.0 (UCI digits MLP, 96.10% held-out, bit-identical); test-only signing; not a general LLM.
 - [Does the website use the latest traverse-embedder-web?](https://traverse-framework.com/questions/does-the-website-use-the-latest-traverse-embedder.html): site pins `^0.15.0` (matching npm) and `/discover` admits its signed demo fixture through `registerPackage` with `modelUsage: non_commercial`; the site can lag future releases, so product apps pin published packages, not the website demo.

src/pages/blog/index.astro

@@ -2,6 +2,7 @@
 import SubpageLayout from '@layouts/SubpageLayout.astro';
 
 const posts = [
+  { href: '/blog/signed-models-on-every-host.html', title: 'Signed models on every host. The rights travel with them.', desc: 'Featured · Oct 15 · Traverse v0.15.0: signed exact-ref packages run on Swift, Kotlin/Android, and .NET as well as native Rust and the browser, on one framed protocol and one 21-case rights suite. model_usage is required (breaking). ONNX packaging via traverse-cli-rs, ABI v3 prepare-once, opt-in Core ML on Apple. Web modelUsage validation is #1685; iPhone evidence #1630; signing custody #1567. No host is Certified.' },
   { href: '/blog/one-shared-runtime-two-loading-paths.html', title: 'One shared runtime. Not one shared .wasm file on every host.', desc: 'Featured · Oct 13 · One product runtime and one host ABI, two loading paths. Web BundleEmbedder digest-checks the bundle’s runtime.wasm. Rust traverse-embedder@0.14.0 links traverse-runtime natively. Capability WASM stays on that ABI. Hosts stay clients.' },
   { href: '/blog/agent-mcp-exact-ref.html', title: 'Agent speaks MCP. Exact pin kills the freestyle.', desc: 'Featured · Oct 9 · Weekly demo: an agent calls MCP-shaped tools over ExactModelBrowserHost against the signed digits-mlp-1.0.0 package. Browser + Node bit-identical; tamper → digest_mismatch, empty trust → key_untrusted, rights lie → rights_mismatch. Traverse v0.14.0. Test-only key. Not the Mode A traverse-mcp binary.' },
   { href: '/blog/you-dont-edit-a-published-capability.html', title: "You don't edit a published capability. You mark it.", desc: 'Featured · Oct 8 · Deprecation and revocation leave the contract in place. Ranges skip the marker. Exact pins in traverse-registry 0.27.0 still resolve with lifecycle status (registry#632). Runtime refusal is traverse#1598, not shipped in v0.14.0.' },