Pin. Verify. Contain.

What this means for you

Every nestr message routes through three verbs, in this order: Pin. Verify. Contain. They replace the 2026-05 trio Compress, Watch, Guide. Each verb comes with a qualifier when the capability is not yet available, because the site’s rule is to say plainly what does not run. Source: landing src/components/sections/Hero.tsx:109-120 @cb59f69; nestr.tools, read 2026-10-25.

The pitch

• Pin. Every dependency pinned by its BLAKE3 content hash and re-checked on install.
• Verify. Pellets signed by a verified identity and recorded in a transparency log. Qualifier: neither is switched on for the hosted registry yet.
• Contain. Package code never runs while installing; hooks run only when you invoke them and consent, inside a Linux x86-64 sandbox. Qualifier: the CLI that does this has no install path yet.

Who it’s for

Anyone writing a tweet, a slide, a cold email, a docs intro or a release note for nestr. The verbs keep the voice consistent; the qualifiers keep it honest.

Proof points

• The hero uses exactly these three words, each followed by one sentence, then “None of this is available to customers yet: the CLI has no install path.”
• The verbs map to spec families: Pin to PEL-ART and PEL-LOCK, Verify to PEL-SIG, PEL-PROV and PEL-LOG, Contain to PEL-EXEC and PEL-SBX.
• Olly appears as the mascot and as spec-grounded Q&A only; it is not a pillar (launch decision §7).
• Retired lines: “the owl that never blinks”, “reinstall in 200ms”, “no cloud, no keys” as product pillars.

mindmap
  root((Voice))
    Pin
      content hash
      nest.lock
    Verify
      signatures
      transparency log
      not on hosted registry yet
    Contain
      no install-time code
      consented hooks
      CLI not installable yet