fix(website): hold the comparison data to its primary sources

README.md

@@ -368,7 +368,7 @@ flowchart LR
 | 📡 | **SSE Compatibility** | Drop-in replacement for existing Drydock agents, including `dd:watcher-snapshot` full inventory on connect. |
 | ✍️ | **Signed Supply Chain** | Cosign keyless signatures, per-archive CycloneDX SBOMs, an image SBOM attestation, and SLSA Build L2 provenance on every release. Verifiable without managing signing keys. |
 | 🛡️ | **Two-Layer Defense** | Pair with [sockguard](https://github.com/codeswhat/sockguard) so the agent never touches the raw Docker socket directly. |
-| 🪶 | **Minimal Footprint** | Static Go binary, ~47 MB Wolfi (Chainguard) container image. CGO disabled, stripped, no external runtime dependencies. |
+| 🪶 | **Minimal Footprint** | Static Go binary (~10 MB). Compressed container image: ~45 MB amd64 and ~41 MB arm64 (Wolfi, Chainguard), ~33 MB arm/v7 (Alpine). CGO disabled, stripped, no external runtime dependencies. |
 | 🧩 | **Standalone Mode** | `ADAPTER=generic` provides a clean REST + SSE API on `/api/v1/*` backed by the local Docker daemon — no Drydock account required. |
 
 <hr>
@@ -403,7 +403,7 @@ flowchart LR
 <tr><td>Agent-level structured audit log</td><td align="center">✅</td><td align="center">⚠️</td><td align="center">⚠️</td><td align="center">⚠️</td><td align="center">⚠️</td></tr>
 <tr><td>Prometheus scrape endpoint on the agent</td><td align="center">✅</td><td align="center">?</td><td align="center">?</td><td align="center">?</td><td align="center">?</td></tr>
 <tr><td>Read-only MCP server</td><td align="center">✅</td><td align="center">?</td><td align="center">?</td><td align="center">?</td><td align="center">?</td></tr>
-<tr><td>Signed release evidence (cosign, SBOM, provenance)</td><td align="center">✅</td><td align="center">?</td><td align="center">?</td><td align="center">⚠️</td><td align="center">⚠️</td></tr>
+<tr><td>Signed release evidence (cosign, SBOM, provenance)</td><td align="center">✅</td><td align="center">⚠️</td><td align="center">⚠️</td><td align="center">⚠️</td><td align="center">⚠️</td></tr>
 <tr><td>Fleet UI and controller workflows</td><td align="center">❌</td><td align="center">✅</td><td align="center">✅</td><td align="center">✅</td><td align="center">?</td></tr>
 <tr><td>License</td><td align="center">AGPL-3.0</td><td align="center">Zlib (agent) / proprietary Business features</td><td align="center">GPL-3.0</td><td align="center">BSD-3-Clause</td><td align="center">MIT</td></tr>
 </tbody>
@@ -437,7 +437,7 @@ flowchart LR
 
 > Watchtower's upstream project is archived. Diun and Watchtower do update detection; Portwing is the access agent and leaves update decisions to Drydock.
 >
-> The remote-agent table is compiled from the published [competitive landscape](https://portwing.codeswhat.com/docs/competitive-landscape), which lists its primary sources and records unknown competitor behavior as "not documented" rather than guessing it absent. Compared versions: Portainer 2.39.5, Komodo Periphery v2.3.2, Arcane Agent v2.10.1, Hawser v0.2.46. Reviewed 2026-08-29; Arcane re-checked 2026-09-02. The update-tools table follows the Diun and Watchtower comparison pages, which pin no version or review date.
+> The remote-agent table is compiled from the published [competitive landscape](https://portwing.codeswhat.com/docs/competitive-landscape), which lists its primary sources and records unknown competitor behavior as "not documented" rather than guessing it absent. Compared versions: Portainer 2.39.5, Komodo Periphery v2.3.2, Arcane Agent v2.10.1, Hawser v0.2.46. Reviewed 2026-08-29; Arcane re-checked 2026-09-02. Portainer and Komodo release evidence checked 2026-10-08. The update-tools table follows the Diun and Watchtower comparison pages, which pin no version or review date.
 > Contributions welcome if any information is inaccurate.
 
 </details>
@@ -464,7 +464,7 @@ High-level themes only; see [ROADMAP.md](ROADMAP.md) for direction and non-goals
 | **v0.8.x** ✅ | Operations & Distribution | Mode-aware `/health` and `/ready`, cursor-based NDJSON audit export, runnable Compose and Kubernetes observability examples, continuous edge logs, Homebrew cask and signed `deb`/`rpm` packages, published stability policy, edge mode production supported |
 | **v0.9.x** ✅ | Controller-Owned Updates | Controller-owned Drydock watcher and update execution (Drydock `v1.6.0-rc.11+`), edge audit export, loopback default for the edge operations listener, MCP revision 2026-07-28, `ALLOWED_ORIGINS` and `ALLOWED_HOSTS` browser origin and Host checks (v0.9.23) |
 | **v1.0.0** | Binding Stability | `STABILITY.md` guarantees become binding semver commitments, final re-verify of the competitive review against primary sources, decision on a versioned docs archive. Gated on verifiable items, not a date |
-| **Post-v1** | Demand-Driven | Controller-managed Portwing upgrade and rollback waves, optional client-certificate authentication, polling/intermittent edge transport, controller-assisted two-key rotation, BuildKit-aware Sockguard profile |
+| **Post-v1** | Demand-Driven | Controller-managed Portwing upgrade and rollback waves, optional client-certificate authentication, polling/intermittent edge transport, controller-assisted two-key rotation |
 
 SLSA Build L3 isn't tied to a version. It follows an org-shared reusable release workflow landing.
 

ROADMAP.md

@@ -104,9 +104,9 @@ calendar date:
 
 Post-v1 candidates are intentionally demand-driven: controller-managed
 Portwing upgrade/rollback waves, optional client-certificate authentication,
-polling/intermittent edge transport, controller-assisted two-key rotation, and
-a BuildKit-aware Sockguard profile. None should expand the base socket policy
-or add an unaudited self-update path merely for feature-table parity.
+polling/intermittent edge transport, and controller-assisted two-key rotation.
+None should expand the base socket policy or add an unaudited
+self-update path merely for feature-table parity.
 
 ## Non-goals
 

docs/content/docs/competitive-landscape.mdx

@@ -4,7 +4,7 @@ description: An evidence-backed comparison of Portwing with current remote Docke
 ---
 
 <Callout type="info">
-This review is a snapshot from **August 29, 2026**, with Arcane re-checked on **September 2, 2026**. Competitor behavior changes independently of Portwing. This page is the canonical matrix and decision record, with the primary sources listed under Primary evidence.
+This review is a snapshot from **August 29, 2026**, with Arcane re-checked on **September 2, 2026** and the Portainer and Komodo supply-chain evidence checked on **October 8, 2026**. Competitor behavior changes independently of Portwing. This page is the canonical matrix and decision record, with the primary sources listed under Primary evidence. Behavior a competitor's own docs or repo don't cover is recorded as "not documented", never guessed absent.
 </Callout>
 
 Portwing is the host agent in a three-layer system:
@@ -46,7 +46,7 @@ products rather than direct general-purpose agent peers.
 | Controller-managed agent upgrades | Not shipped | Portainer and Arcane provide fleet upgrade workflows. This belongs in Drydock plus Portwing packaging, not in an unaudited self-update endpoint. |
 | Builds behind the hardened socket profile | Denied by default, opt-in via preset | The base and compose presets deny builds; `portwing-with-build.yaml` allows classic `POST /build`, and `portwing-with-mediated-build.yaml` allows a stock BuildKit `docker compose build` by inspecting the `/session` and `/grpc` traffic in Sockguard. |
 | Host shell, file browser, and Swarm | Not supported | Intentional agent non-goals even though broader competitors provide them. |
-| Verifiable release artifacts | Cosign signatures, CycloneDX SBOM, and SLSA Build L2 provenance | Arcane ships Cosign-verifiable artifacts and images. Portainer and Komodo were not evaluated for this. Hawser publishes checksummed releases with no equivalent set documented. |
+| Verifiable release artifacts | Cosign signatures, CycloneDX SBOM, and SLSA Build L2 provenance | Arcane ships Cosign-verifiable artifacts and images. Portainer 2.39.5 publishes checksum files with its release archives and its images carry BuildKit SPDX SBOM and SLSA v0.2 provenance attestations, but no cosign signature was found. Komodo v2.3.2 publishes bare binaries, and its Periphery image carries a BuildKit SLSA v1 provenance attestation with no SBOM or cosign signature found. The cosign check looked only for the legacy `.sig` tag, and only the first platform's attestation was read. Hawser publishes checksummed releases with no equivalent set documented. |
 | Credential rotation | Multiple keys; file update plus SIGHUP; manual operational flow | Portainer has a revolving Edge password and Edge key lifecycle. Komodo automatically rotates Periphery keys. Arcane automatically renews certificates and can regenerate its environment token. Hawser requires manual token replacement. |
 
 ## What changed since the older comparison
@@ -129,4 +129,8 @@ parity. Those capabilities belong in Drydock or a specialized service.
 - Arcane [remote environments](https://getarcane.app/docs/features/environments), [edge mTLS](https://getarcane.app/docs/security/edge-mtls), and [socket proxy](https://getarcane.app/docs/setup/socket-proxy)
 - Arcane ML-DSA-87 migration: [v2.10.0 release notes](https://github.com/getarcaneapp/arcane/releases/tag/v2.10.0), [PR #3785](https://github.com/getarcaneapp/arcane/pull/3785), and [v2.10.1 release notes](https://github.com/getarcaneapp/arcane/releases/tag/v2.10.1)
 - [Hawser repository](https://github.com/Finsys/hawser) and [edge-mode bind-address issue](https://github.com/Finsys/hawser/issues/71)
+- Portainer [2.39.5 release assets](https://github.com/portainer/portainer/releases/tag/2.39.5) and the `portainer/agent:2.39.5` image manifest and attestations, checked October 8, 2026
+- Komodo [v2.3.2 release assets](https://github.com/moghtech/komodo/releases/tag/v2.3.2) and the `ghcr.io/moghtech/komodo-periphery:2.3.2` image manifest and attestations, checked October 8, 2026
 - Komodo outbound-leg issues: [proxy env vars ignored](https://github.com/moghtech/komodo/issues/1473) and [hardcoded handshake timeout](https://github.com/moghtech/komodo/issues/1518)
+- Watchtower [metrics](https://containrrr.dev/watchtower/metrics/) and [arguments](https://containrrr.dev/watchtower/arguments/) (opt-in, experimental `/v1/metrics`), checked October 8, 2026; `containrrr/watchtower:1.7.1` linux/amd64 image manifest (`sha256:f9086bfda061…`, 5.63 MB of compressed layers), measured October 8, 2026
+- Diun [metrics configuration](https://crazymax.dev/diun/config/metrics/) (opt-in metrics server, `:9090/metrics`), checked October 8, 2026

docs/content/docs/migrating-from-watchtower.mdx

@@ -29,7 +29,7 @@ Drydock + Portwing invert the model. Portwing runs on each host and exposes the
 | Container exec / terminal | No | Yes (WebSocket) |
 | Container filtering | Label `com.centurylinklabs.watchtower.enable` | Label `dd.watch=true` |
 | Self-hosted server required | No | Yes (Drydock) |
-| Image size | ~50 MB | ~10 MB (Portwing) + Drydock server |
+| Image size (compressed) | ~6 MB (v1.7.1, linux/amd64) | ~45 MB (Portwing, ~10 MB binary) + Drydock server |
 
 <Callout type="warn">
 Portwing does **not** automatically pull and recreate containers on a schedule. That decision is made by the Drydock controller through its UI and notification pipeline — not by the agent. If you relied on Watchtower's fully autonomous update loop, you will need to configure update policies in Drydock.
@@ -211,7 +211,7 @@ For production deployments, upgrade to Ed25519 per-request signing after the ini
 | Compose support | Recreate only | Full lifecycle (`up`/`down`/`pull`/`ps`/`logs`) |
 | Exec / terminal | No | Yes (WebSocket) |
 | Self-hosted required | No | Yes (Drydock server) |
-| Resource footprint | ~50 MB image | ~10 MB Portwing + Drydock server |
+| Resource footprint | ~6 MB compressed image | ~45 MB compressed Portwing image (~10 MB binary) + Drydock server |
 
 <Callout type="info">
 See [Configuration](/configuration) for the full environment-variable reference and [Security Model](/security-model) for Portwing's default-deny socket filtering and rate-limiting details.

docs/migrating-from-watchtower.md

@@ -197,7 +197,7 @@ checked for updates by Drydock.
 | Compose support | Recreate only | Full lifecycle (`up`/`down`/`pull`/`ps`/`logs`) |
 | Exec / terminal | No | Yes (WebSocket) |
 | Self-hosted required | No (just Docker) | Yes (Drydock server) |
-| Resource footprint | ~50 MB image | ~10 MB Portwing image + Drydock server |
+| Resource footprint | ~6 MB compressed image | ~45 MB compressed Portwing image (~10 MB binary) + Drydock server |
 
 ---
 

website/src/components/compare-matrix.tsx

@@ -1,13 +1,13 @@
-import { ArrowUpRight, Check, Minus, X } from "lucide-react";
+import { ArrowUpRight, Check, CircleQuestionMark, Minus, X } from "lucide-react";
 import Link from "next/link";
-import { ComparisonCellIcon } from "@/components/comparison-cell-icon";
+import { type CellValue, ComparisonCellIcon } from "@/components/comparison-cell-icon";
 import { SITE_CONFIG } from "@/lib/site-config";
 
 // Full comparison matrix for /compare. Each competitor row links to its
 // dedicated deep-dive page. Cell values are derived from comparison-rows.ts
 // and the per-competitor data in lib/comparison-route-data/.
 
-type Cell = "yes" | "partial" | "no";
+type Cell = CellValue;
 
 const FEATURES = [
   { key: "remoteControl", label: "Remote control" },
@@ -55,8 +55,8 @@ const TOOLS: Tool[] = [
       leastPrivilege: "no",
       agentAudit: "partial",
       transparentApi: "yes",
-      metrics: "no",
-      mcpServer: "no",
+      metrics: "undocumented",
+      mcpServer: "undocumented",
     },
   },
   {
@@ -70,7 +70,7 @@ const TOOLS: Tool[] = [
       agentAudit: "partial",
       transparentApi: "no",
       metrics: "partial",
-      mcpServer: "no",
+      mcpServer: "undocumented",
     },
   },
   {
@@ -84,7 +84,7 @@ const TOOLS: Tool[] = [
       agentAudit: "partial",
       transparentApi: "no",
       metrics: "partial",
-      mcpServer: "no",
+      mcpServer: "undocumented",
     },
   },
   {
@@ -98,7 +98,7 @@ const TOOLS: Tool[] = [
       agentAudit: "partial",
       transparentApi: "yes",
       metrics: "partial",
-      mcpServer: "no",
+      mcpServer: "undocumented",
     },
   },
   {
@@ -111,8 +111,8 @@ const TOOLS: Tool[] = [
       leastPrivilege: "no",
       agentAudit: "no",
       transparentApi: "no",
-      metrics: "no",
-      mcpServer: "no",
+      metrics: "yes",
+      mcpServer: "undocumented",
     },
   },
   {
@@ -126,7 +126,7 @@ const TOOLS: Tool[] = [
       agentAudit: "no",
       transparentApi: "no",
       metrics: "yes",
-      mcpServer: "no",
+      mcpServer: "undocumented",
     },
   },
 ];
@@ -196,6 +196,10 @@ export function CompareMatrix() {
         <span className="inline-flex items-center gap-1.5">
           <X className="h-3 w-3 text-neutral-300 dark:text-neutral-600" /> No
         </span>
+        <span className="inline-flex items-center gap-1.5">
+          <CircleQuestionMark className="h-3 w-3 text-neutral-400 dark:text-neutral-500" /> Not
+          documented
+        </span>
         <span className="text-neutral-400 dark:text-neutral-600">
           · Click a tool for the full breakdown
         </span>

website/src/components/compare-section.tsx

@@ -1,4 +1,4 @@
-import { ArrowRight, Check, Minus, X } from "lucide-react";
+import { ArrowRight, Check, CircleQuestionMark, Minus, X } from "lucide-react";
 import Link from "next/link";
 import { type CellValue, ComparisonCellIcon } from "@/components/comparison-cell-icon";
 import { SectionHeading } from "@/components/section-heading";
@@ -59,10 +59,10 @@ const featureRows: FeatureRow[] = [
   {
     label: "Read-only MCP server",
     portwing: "yes",
-    portainer: "no",
-    komodo: "no",
-    arcane: "no",
-    hawser: "no",
+    portainer: "undocumented",
+    komodo: "undocumented",
+    arcane: "undocumented",
+    hawser: "undocumented",
   },
 ];
 
@@ -162,9 +162,13 @@ export function CompareSection() {
             <span className="mx-3 inline-flex items-center gap-1.5">
               <Minus className="h-3 w-3 text-fuchsia-400" /> Partial
             </span>
-            <span className="inline-flex items-center gap-1.5">
+            <span className="mr-3 inline-flex items-center gap-1.5">
               <X className="h-3 w-3 text-neutral-400" /> No
             </span>
+            <span className="inline-flex items-center gap-1.5">
+              <CircleQuestionMark className="h-3 w-3 text-neutral-400 dark:text-neutral-500" /> Not
+              documented
+            </span>
           </div>
         </div>
 

website/src/components/comparison-cell-icon.tsx

@@ -1,6 +1,6 @@
-import { Check, Minus, X } from "lucide-react";
+import { Check, CircleQuestionMark, Minus, X } from "lucide-react";
 
-export type CellValue = "yes" | "partial" | "no";
+export type CellValue = "yes" | "partial" | "no" | "undocumented";
 
 export function ComparisonCellIcon({ value }: { value: CellValue }) {
   if (value === "yes") {
@@ -19,6 +19,17 @@ export function ComparisonCellIcon({ value }: { value: CellValue }) {
       </>
     );
   }
+  if (value === "undocumented") {
+    return (
+      <>
+        <CircleQuestionMark
+          className="mx-auto h-4 w-4 text-neutral-400 dark:text-neutral-500"
+          aria-hidden="true"
+        />
+        <span className="sr-only">Not documented</span>
+      </>
+    );
+  }
   return (
     <>
       <X className="mx-auto h-4 w-4 text-neutral-400 dark:text-neutral-600" aria-hidden="true" />

website/src/components/comparison-page.tsx

@@ -201,7 +201,7 @@ export function ComparisonPage({
                 Key Differentiators
               </h2>
               <p className="mx-auto max-w-2xl text-neutral-600 dark:text-neutral-400">
-                {`What we built that ${competitorName} doesn't cover.`}
+                {`Where Portwing goes beyond what ${competitorName} documents.`}
               </p>
             </div>
 

website/src/components/github-badges.tsx

@@ -42,8 +42,8 @@ const distribution: Badge[] = [
   },
   {
     href: GHCR_PACKAGE_URL,
-    src: "https://img.shields.io/badge/image%20size-~10%20MB-informational?logo=docker&logoColor=white",
-    alt: "Image size ~10 MB",
+    src: "https://img.shields.io/badge/image%20size-~45%20MB%20compressed-informational?logo=docker&logoColor=white",
+    alt: "Compressed image size ~45 MB (amd64)",
   },
   {
     href: `${GITHUB_URL}/stargazers`,

website/src/lib/comparison-route-data/diun.tsx

@@ -10,8 +10,8 @@ Auth for remote access|No (local only)|Yes (Ed25519 per-request signing)|self
 Structured audit log|No|Yes (JSON, built-in)|self
 Release artifact verification|Not evaluated|Cosign signatures + CycloneDX SBOM + SLSA provenance|self
 Default-deny socket filter|No|Yes (with sockguard)|self
-Prometheus metrics|Yes|Yes|tie
-MCP server (AI-native, read-only)|No|Yes|self
+Prometheus metrics|Yes (opt-in)|Yes|tie
+MCP server (AI-native, read-only)|Not documented|Yes|self
 Edge / NAT outbound tunnel|No|Yes (Drydock v1.6.0-rc.11+)|self
 Single lightweight Go binary|Yes|Yes (~10 MB)|tie
 License|MIT|AGPL-3.0|tie

website/src/lib/comparison-route-data/komodo.tsx

@@ -12,7 +12,7 @@ Transparent Docker API|No (Komodo resource/command API)|Yes|self
 Structured audit|Full controller audit trail|Agent-level API/auth/Compose/exec audit with cursor export|tie
 Host metrics|Collected for dashboards and alerts|Prometheus scrape endpoint plus edge metrics|tie
 Docker socket policy|Documented deployment mounts the raw socket|Recommended Sockguard path-and-method policy|self
-Supply-chain evidence|Not published|Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance|self
+Supply-chain evidence|v2.3.2 release has binaries only; Periphery image carries a BuildKit SLSA v1 provenance attestation; no SBOM or cosign signature found|Cosign signatures + archive/image CycloneDX SBOMs + SLSA provenance|self
 Host shell, builds, automation, and Swarm|Yes|Host shell and Swarm are non-goals; Drydock owns fleet workflows|competitor
 MCP server (read-only)|Not documented|Yes|self
 License|GPL-3.0|AGPL-3.0|tie