diff --git a/.github/workflows/reader-journey.yml b/.github/workflows/reader-journey.yml
index 78443d2..94dacf8 100644
--- a/.github/workflows/reader-journey.yml
+++ b/.github/workflows/reader-journey.yml
@@ -17,6 +17,7 @@ jobs:
           python-version: '3.12'
       - run: python tools/check-site.py
       - run: python tools/build-controls.py --check
+      - run: python tools/build-header.py --check
       - run: python tools/build-discovery.py --check
       - run: python tools/check-discovery.py
   quickstart:
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c18dd8d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+__pycache__/
diff --git a/404.html b/404.html
index c2bb643..3981d69 100644
--- a/404.html
+++ b/404.html
@@ -3,10 +3,41 @@
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Page not found | AgenTrust</title>
 <meta name="robots" content="noindex">
-<link rel="stylesheet" href="/design-system.css?v=19"><link rel="icon" href="/favicon.ico">
+<link rel="stylesheet" href="/design-system.css?v=21"><link rel="icon" href="/favicon.ico">
 </head><body class="at-page">
-<header class="site-header"><a class="wordmark" href="/">AgenTrust</a></header>
-<main class="wrap"><section><p class="eyebrow">404 · Page not found</p><h1>Find your next step.</h1>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
+</header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
+<main class="wrap" id="main"><section><p class="eyebrow">404 · Page not found</p><h1>Find your next step.</h1>
 <p>This address may have moved, or the link may be incomplete. Older links pointed at homepage sections that are now one four-step chain.</p>
 <ul>
 <li><a href="/verify/">Verify a real Intel TDX quote in your browser</a></li>
diff --git a/community/index.html b/community/index.html
index 2c3896c..c88d031 100644
--- a/community/index.html
+++ b/community/index.html
@@ -31,13 +31,12 @@
   <meta name="twitter:title" content="AgenTrust community, partners and governance">
   <meta name="twitter:description" content="Partner and sponsor relationships linked to public evidence, how the projects are governed, and how to contribute.">
   <meta name="twitter:image" content="https://agentrust-io.com/og.png">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="agentrust-hub" id="top">
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
 <a class="skip-link" href="#main">Skip to content</a>
-
-<!-- Header -->
-<header>
+<header class="hub-header">
   <div class="header-inner">
     <a href="/" class="logo">AgenTrust</a>
     <nav aria-label="Primary">
@@ -65,6 +64,8 @@
     </nav>
   </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <!-- Section rail: jump list for a long page. Ticks only until hovered or focused. -->
 <nav class="railnav" aria-label="Sections on this page">
@@ -302,7 +303,6 @@ <h2 class="section-title">What is AgenTrust?</h2>
   </div>
 </footer>
 
-<script src="/hub-nav.js"></script>
 <script>
   // Mark the rail entry for whichever section is in the reading band. Falls
   // back to no highlight at all if IntersectionObserver is missing: the rail
@@ -348,5 +348,6 @@ <h2 class="section-title">What is AgenTrust?</h2>
   })();
 </script>
 
+<script src="/supernav.js"></script>
 </body>
 </html>
diff --git a/demos/index.html b/demos/index.html
index f509e40..c2dc0b8 100644
--- a/demos/index.html
+++ b/demos/index.html
@@ -32,19 +32,42 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 
-<link rel="stylesheet" href="/design-system.css?v=17">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#weights">Model weights</a>
-    <a href="#governance">Agent actions</a>
-    <a href="/quickstart/">Quickstart</a>
-    <a class="cta" href="https://github.com/agentrust-io/demos">Get the demos</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu is-current"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/" aria-current="page">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">Weights · Actions · Evidence</a> · Runnable demos</span>
@@ -53,7 +76,14 @@ <h1>Run a policy check.<br><em>Inspect the result.</em></h1>
   <div><span class="status">Software mode · <code>CMCP_DEV_MODE=1</code> · no special hardware</span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#weights">Model weights</a>
+  <a href="#governance">Agent actions</a>
+  <a href="https://github.com/agentrust-io/demos">Get the demos ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="start">
   <span class="label">Quick start</span>
diff --git a/design-system.css b/design-system.css
index 258423e..0e2af24 100644
--- a/design-system.css
+++ b/design-system.css
@@ -435,43 +435,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
   min-height: 100vh;
   line-height: 1.6;
 }
-/* ── Header ── */
-.agentrust-hub header {
-  padding: 0 2rem;
-  position: sticky;
-  top: 0;
-  z-index: 100;
-}
-.agentrust-hub .header-inner {
-  max-width: 1100px;
-  margin: 0 auto;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  height: 56px;
-}
-.agentrust-hub .logo {
-  font-size: 1.15rem;
-  font-weight: 700;
-  letter-spacing: -0.02em;
-  text-decoration: none;
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-.agentrust-hub .header-nav {
-  display: flex;
-  gap: 1.5rem;
-  list-style: none;
-}
-.agentrust-hub .header-nav a {
-  text-decoration: none;
-  font-size: 0.875rem;
-  transition: color 0.15s;
-}
-.agentrust-hub .header-nav a:hover {
-  color: #fff;
-}
 /* ── Hero ── */
 .agentrust-hub .fellowship {
   padding: 0.85rem 2rem;
@@ -877,9 +840,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
   .agentrust-hub .trust-step:not(:last-child)::after {
     content: "↓"; right: 1rem; top: auto; bottom: -0.7rem;
   }
-  .agentrust-hub .header-nav {
-    display: none;
-  }
   .agentrust-hub .ecosystem-grid {
     grid-template-columns: 1fr;
   }
@@ -935,32 +895,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
   font-family: var(--at-sans);
 }
 
-.agentrust-hub header {
-  background: var(--at-paper);
-  color: var(--at-ink);
-  border-bottom: 1px solid var(--at-line);
-  backdrop-filter: none;
-}
-
-.agentrust-hub .header-nav { margin: 0; padding: 0; align-items: center; }
-.agentrust-hub .nav-toggle { display: none; }
-.agentrust-hub .spec-menu { position: relative; }
-.agentrust-hub .spec-menu summary { cursor: pointer; font-size: .875rem; }
-.agentrust-hub .spec-menu ul { position: absolute; top: 2rem; right: 0; min-width: 17rem; padding: .75rem; margin: 0; list-style: none; background: var(--at-paper); border: 1px solid var(--at-line); border-radius: .5rem; box-shadow: 0 .5rem 1.5rem #0001; }
-.agentrust-hub .spec-menu li a { display: block; padding: .65rem; }
-@media (max-width: 900px) {
-  .agentrust-hub .header-inner { height: auto; min-height: 56px; flex-wrap: wrap; }
-  .agentrust-hub .header-inner nav { margin-left: auto; }
-  .agentrust-hub .nav-toggle:not([hidden]) { display: inline-flex; align-items: center; min-height: 44px; padding: .5rem .75rem; color: var(--at-ink); background: transparent; border: 1px solid var(--at-line); border-radius: .3rem; font: inherit; }
-  .agentrust-hub .header-nav { display: flex; flex-wrap: wrap; gap: .5rem 1rem; padding: .75rem 0; }
-  .hub-nav-ready .agentrust-hub .header-nav { display: none; position: absolute; top: 100%; left: 0; right: 0; padding: .75rem 1.25rem; background: var(--at-paper); border-bottom: 1px solid var(--at-line); max-height: calc(100dvh - 56px); overflow-y: auto; }
-  .hub-nav-ready .agentrust-hub .header-nav.is-open { display: flex; flex-direction: column; align-items: stretch; gap: 0; }
-  .agentrust-hub .header-nav a, .agentrust-hub .spec-menu summary { display: block; padding: .75rem; min-height: 44px; box-sizing: border-box; }
-  .agentrust-hub .spec-menu ul { position: static; min-width: 0; box-shadow: none; margin: 0 .75rem .5rem; }
-}
-
-.agentrust-hub .logo,
-.agentrust-hub .header-nav a { color: var(--at-ink); }
 .agentrust-hub .logo-dot { color: var(--at-red); }
 
 .agentrust-hub .fellowship,
@@ -1276,22 +1210,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
 .at-page > main { max-width: var(--at-wrap); margin: 0 auto; }
 .at-page > main { padding: 0 var(--at-gutter); }
 
-.at-page .site-header {
-  position: sticky;
-  top: 0;
-  z-index: 40;
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem 1.5rem;
-  /* Full-bleed background, but the row itself lines up with .wrap content */
-  padding: 0.95rem max(var(--at-gutter), calc((100% - var(--at-wrap)) / 2));
-  border-bottom: 1px solid var(--at-line);
-  background: var(--at-paper);
-  backdrop-filter: blur(14px);
-}
-
 .at-page .wordmark {
   font-size: 0.95rem;
   font-weight: 750;
@@ -1300,28 +1218,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
 }
 .at-page .wordmark span { color: var(--at-muted); font-weight: 500; }
 
-.at-page .site-header nav {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  gap: 0.35rem 1.35rem;
-}
-.at-page .site-header nav a {
-  color: var(--at-muted);
-  font-size: 0.72rem;
-  font-weight: 700;
-  letter-spacing: 0.06em;
-  text-transform: uppercase;
-  text-decoration: none;
-}
-.at-page .site-header nav a:hover { color: var(--at-ink); }
-.at-page .site-header nav a.cta {
-  padding: 0.42rem 0.85rem;
-  border-radius: 999px;
-  background: var(--at-ink);
-  color: var(--at-paper);
-}
-.at-page .site-header nav a.cta:hover { background: var(--at-red); color: #fff; }
 
 /* Hero */
 .at-page .hero {
@@ -1938,7 +1834,6 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
   .at-page .flow > * { min-height: auto; }
   .at-page .hero h1 { font-size: clamp(2.5rem, 11vw, 3.9rem); }
   .at-page .hero h1 br { display: none; }
-  .at-page .site-header nav a:not(.cta) { display: none; }
   .at-page .step { grid-template-columns: 1fr; gap: 0.9rem; }
   .at-page .split,
   .at-page .split.even { grid-template-columns: 1fr; }
@@ -1969,18 +1864,8 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
 .marketplace-callout { display:flex;align-items:center;justify-content:space-between;gap:2rem;margin-top:1.5rem;padding:1.5rem 1.75rem;border:1px solid var(--border);border-left:4px solid var(--accent);background:var(--surface); }
 .marketplace-callout span,.marketplace-page .eyebrow { color:var(--at-red);font-size:.68rem;font-weight:750;letter-spacing:.11em;text-transform:uppercase; }
 .marketplace-callout h3 { margin:.3rem 0;font-size:1.25rem; }.marketplace-callout p { color:var(--muted);font-size:.9rem; }
-.marketplace-page { background:var(--at-paper); }.marketplace-page main { overflow:hidden; }.marketplace-page .site-header { position:relative;background:var(--at-paper);backdrop-filter:none; }
-.marketplace-page .header-inner { display:flex;align-items:center;justify-content:space-between;gap:1rem; }
-.marketplace-page .nav-toggle { display:none; }
-@media (max-width:900px) {
-  .marketplace-page .header-inner { flex-wrap:wrap; }
-  .marketplace-page .nav-toggle:not([hidden]) { display:inline-flex;align-items:center;min-height:44px;padding:.5rem .75rem;color:var(--at-ink);background:transparent;border:1px solid var(--at-line);border-radius:.3rem;font:inherit; }
-  .marketplace-page .site-header nav { width:100%;flex-direction:column;align-items:stretch; }
-  .marketplace-page .site-header nav a:not(.cta), .marketplace-page .site-header nav a.cta { display:block;padding:.75rem;min-height:44px;box-sizing:border-box; }
-  .hub-nav-ready .marketplace-page .site-header nav { display:none; }
-  .hub-nav-ready .marketplace-page .site-header nav.is-open { display:flex; }
-}
-.marketplace-page .site-header [aria-current="page"] { color:var(--at-red); }.marketplace-page .button { display:inline-flex;align-items:center;justify-content:center; }
+.marketplace-page { background:var(--at-paper); }.marketplace-page main { overflow:hidden; }
+.marketplace-page .button { display:inline-flex;align-items:center;justify-content:center; }
 .market-hero { position:relative;padding:clamp(3.5rem,7vw,6rem) 0;border-top:1px solid var(--at-line);border-bottom:1px solid var(--at-line);background:linear-gradient(135deg,var(--at-paper) 0%,#f4f0e8 72%,#eee8dc 100%);color:var(--at-ink); }
 .market-hero::before { position:absolute;top:0;right:10%;width:220px;height:4px;background:var(--at-red);content:""; }
 .market-hero-grid { position:relative;display:grid;grid-template-columns:minmax(0,1.45fr) minmax(280px,.65fr);align-items:center;gap:clamp(2.5rem,7vw,7rem); }
@@ -2171,3 +2056,41 @@ html:has(body.agentrust-hub) { scroll-behavior: smooth; }
 @media (max-width: 900px) {
   .agentrust-hub .ecosystem-grid { grid-template-columns: 1fr; }
 }
+
+/* Site header
+ * One header for every agentrust-io.com page. tools/build-header.py stamps the
+ * markup from tools/site_header.py, and hub-nav.js adds the mobile Menu toggle.
+ * Selectors hang off .hub-header rather than a body class, so the same block
+ * serves the hub (.agentrust-hub) and the editorial pages (.at-page). It sits
+ * last so their generic list and link rules cannot restyle it.
+ */
+.hub-header, .hub-header *, .hub-header *::before, .hub-header *::after { box-sizing: border-box; }
+.hub-header { position: sticky; top: 0; z-index: 100; padding: 0 2rem; background: var(--at-paper); color: var(--at-ink); border-bottom: 1px solid var(--at-line); font-family: var(--at-sans); font-size: 16px; line-height: 1.6; }
+.hub-header ul, .hub-header li { margin: 0; padding: 0; list-style: none; color: inherit; }
+.hub-header .header-inner { max-width: 1100px; height: 56px; margin: 0 auto; display: flex; align-items: center; justify-content: space-between; }
+.hub-header .logo { display: flex; align-items: center; gap: .5rem; color: var(--at-ink); font-size: 1.15rem; font-weight: 700; letter-spacing: -0.02em; text-decoration: none; }
+.hub-header .header-nav { display: flex; align-items: center; gap: 1.5rem; }
+.hub-header .header-nav a, .hub-header .spec-menu summary { color: var(--at-ink); font-size: .875rem; text-decoration: none; transition: color .15s; }
+.hub-header .header-nav a:hover, .hub-header .spec-menu summary:hover,
+.hub-header .header-nav [aria-current="page"], .hub-header .spec-menu.is-current > details > summary { color: var(--at-red); }
+.hub-header .nav-toggle { display: none; }
+.hub-header .spec-menu { position: relative; }
+.hub-header .spec-menu summary { cursor: pointer; }
+.hub-header .spec-menu ul { position: absolute; top: 2rem; right: 0; min-width: 17rem; padding: .75rem; background: var(--at-paper); border: 1px solid var(--at-line); border-radius: .5rem; box-shadow: 0 .5rem 1.5rem #0001; }
+.hub-header .spec-menu li a { display: block; padding: .65rem; }
+@media (max-width: 900px) {
+  .hub-header .header-inner { height: auto; min-height: 56px; flex-wrap: wrap; }
+  .hub-header .header-inner nav { margin-left: auto; }
+  .hub-header .nav-toggle:not([hidden]) { display: inline-flex; align-items: center; min-height: 44px; padding: .5rem .75rem; color: var(--at-ink); background: transparent; border: 1px solid var(--at-line); border-radius: .3rem; font: inherit; }
+  .hub-header .header-nav { flex-wrap: wrap; gap: .5rem 1rem; padding: .75rem 0; }
+  .hub-nav-ready .hub-header .header-nav { display: none; position: absolute; top: 100%; left: 0; right: 0; padding: .75rem 1.25rem; background: var(--at-paper); border-bottom: 1px solid var(--at-line); max-height: calc(100dvh - 56px); overflow-y: auto; }
+  .hub-nav-ready .hub-header .header-nav.is-open { display: flex; flex-direction: column; align-items: stretch; gap: 0; }
+  .hub-header .header-nav a, .hub-header .spec-menu summary { display: block; padding: .75rem; min-height: 44px; }
+  .hub-header .spec-menu ul { position: static; min-width: 0; box-shadow: none; margin: 0 .75rem .5rem; }
+}
+
+/* On this page: the section links an editorial page used to carry in its header. */
+.on-this-page { display: flex; flex-wrap: wrap; align-items: baseline; gap: .35rem 1.35rem; padding: .85rem max(var(--at-gutter), calc((100% - var(--at-wrap)) / 2)); border-bottom: 1px solid var(--at-line); background: var(--at-paper); font-family: var(--at-sans); font-size: .72rem; font-weight: 700; letter-spacing: .06em; line-height: 1.6; text-transform: uppercase; }
+.on-this-page span { color: var(--at-muted); font-size: .66rem; letter-spacing: .11em; }
+.on-this-page a { color: var(--at-ink); text-decoration: none; }
+.on-this-page a:hover { color: var(--at-red); }
diff --git a/extensions/ca2a/v0.1/index.html b/extensions/ca2a/v0.1/index.html
index f2275ca..68cbbdd 100644
--- a/extensions/ca2a/v0.1/index.html
+++ b/extensions/ca2a/v0.1/index.html
@@ -32,19 +32,42 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 
-<link rel="stylesheet" href="/design-system.css?v=10">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#adds">What it adds</a>
-    <a href="#declare">Declaring support</a>
-    <a href="#status">Status</a>
-    <a class="cta" href="https://ca2a.agentrust-io.com">cA2A docs</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu is-current"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">03 · Actions</a> · A2A extension URI</span>
@@ -53,7 +76,15 @@ <h1>Confidential A2A<br>(cA2A) v0.1</h1>
   <span class="uri">https://agentrust-io.com/extensions/ca2a/v0.1</span>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#adds">What it adds</a>
+  <a href="#declare">Declaring support</a>
+  <a href="#status">Status</a>
+  <a href="https://ca2a.agentrust-io.com">cA2A docs ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="adds">
   <span class="label">What it adds</span>
diff --git a/go/agent-anomaly-detection/index.html b/go/agent-anomaly-detection/index.html
index a79d804..19f8f23 100644
--- a/go/agent-anomaly-detection/index.html
+++ b/go/agent-anomaly-detection/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-anomaly-detection">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-circuit-breaker/index.html b/go/agent-circuit-breaker/index.html
index c37b2f7..b332723 100644
--- a/go/agent-circuit-breaker/index.html
+++ b/go/agent-circuit-breaker/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-circuit-breaker">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-identity-credential/index.html b/go/agent-identity-credential/index.html
index 55a7bc3..fa364c2 100644
--- a/go/agent-identity-credential/index.html
+++ b/go/agent-identity-credential/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-identity-credential">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-key-binding/index.html b/go/agent-key-binding/index.html
index 5dfa19d..a098e96 100644
--- a/go/agent-key-binding/index.html
+++ b/go/agent-key-binding/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-key-binding">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-purpose-declaration/index.html b/go/agent-purpose-declaration/index.html
index 64af282..6bb96ca 100644
--- a/go/agent-purpose-declaration/index.html
+++ b/go/agent-purpose-declaration/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-purpose-declaration">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-rate-limiting/index.html b/go/agent-rate-limiting/index.html
index 8fbfea3..dce9765 100644
--- a/go/agent-rate-limiting/index.html
+++ b/go/agent-rate-limiting/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-rate-limiting">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-session-revocation/index.html b/go/agent-session-revocation/index.html
index b3ca95e..37d91dd 100644
--- a/go/agent-session-revocation/index.html
+++ b/go/agent-session-revocation/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-session-revocation">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-state-rollback/index.html b/go/agent-state-rollback/index.html
index b553660..e3518e8 100644
--- a/go/agent-state-rollback/index.html
+++ b/go/agent-state-rollback/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-state-rollback">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/agent-termination/index.html b/go/agent-termination/index.html
index 8536d47..1b25ab9 100644
--- a/go/agent-termination/index.html
+++ b/go/agent-termination/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#agent-termination">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/attested-a2a-channel/index.html b/go/attested-a2a-channel/index.html
index 23d7711..bf6f53a 100644
--- a/go/attested-a2a-channel/index.html
+++ b/go/attested-a2a-channel/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#attested-a2a-channel">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/behavioural-baseline/index.html b/go/behavioural-baseline/index.html
index d0ab321..aff95f8 100644
--- a/go/behavioural-baseline/index.html
+++ b/go/behavioural-baseline/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#behavioural-baseline">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/blast-radius-containment/index.html b/go/blast-radius-containment/index.html
index 21fe3fc..70a80ba 100644
--- a/go/blast-radius-containment/index.html
+++ b/go/blast-radius-containment/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#blast-radius-containment">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/capability-attenuation/index.html b/go/capability-attenuation/index.html
index f058e0a..1c4fb1d 100644
--- a/go/capability-attenuation/index.html
+++ b/go/capability-attenuation/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#capability-attenuation">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/capability-manifest/index.html b/go/capability-manifest/index.html
index ece9ec6..dde5c30 100644
--- a/go/capability-manifest/index.html
+++ b/go/capability-manifest/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#capability-manifest">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/context-provenance/index.html b/go/context-provenance/index.html
index fde096a..91d5cb3 100644
--- a/go/context-provenance/index.html
+++ b/go/context-provenance/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#context-provenance">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/continuous-usage-control/index.html b/go/continuous-usage-control/index.html
index e394235..70cd0dd 100644
--- a/go/continuous-usage-control/index.html
+++ b/go/continuous-usage-control/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#continuous-usage-control">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/evidence-transparency-anchoring/index.html b/go/evidence-transparency-anchoring/index.html
index 853a7a2..0e66d6f 100644
--- a/go/evidence-transparency-anchoring/index.html
+++ b/go/evidence-transparency-anchoring/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#evidence-transparency-anchoring">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/graceful-degradation/index.html b/go/graceful-degradation/index.html
index 7d29d82..bf844c1 100644
--- a/go/graceful-degradation/index.html
+++ b/go/graceful-degradation/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#graceful-degradation">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/index.html b/go/index.html
index 007e7f6..c69c797 100644
--- a/go/index.html
+++ b/go/index.html
@@ -38,19 +38,42 @@
 }
 </script>
 
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#controls">Controls</a>
-    <a href="#opencre">OpenCRE</a>
-    <a href="#limits">Limits</a>
-    <a class="cta" href="https://github.com/agentrust-io">GitHub</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu is-current"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">Across the chain</a> &middot; Mapped to OpenCRE &middot; Stable permalinks</span>
@@ -61,7 +84,14 @@ <h1>AgenTrust<br>Agentic Controls</h1>
   <div><span class="status">30 controls &middot; 62 OpenCRE links &middot; 53 Common Requirements</span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#controls">Controls</a>
+  <a href="#opencre">OpenCRE</a>
+  <a href="#limits">Limits</a>
+</nav>
+
+<main id="main">
 
 <section id="opencre">
   <span class="label">How to read this</span>
diff --git a/go/input-schema-validation/index.html b/go/input-schema-validation/index.html
index 57a24cb..13cb18d 100644
--- a/go/input-schema-validation/index.html
+++ b/go/input-schema-validation/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#input-schema-validation">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/model-weight-custody/index.html b/go/model-weight-custody/index.html
index 6983ad6..577c4e9 100644
--- a/go/model-weight-custody/index.html
+++ b/go/model-weight-custody/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#model-weight-custody">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/output-encoding/index.html b/go/output-encoding/index.html
index f402214..b680fbc 100644
--- a/go/output-encoding/index.html
+++ b/go/output-encoding/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#output-encoding">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/output-personal-data/index.html b/go/output-personal-data/index.html
index 05fba36..3e0f7db 100644
--- a/go/output-personal-data/index.html
+++ b/go/output-personal-data/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#output-personal-data">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/policy-verdict-rationale/index.html b/go/policy-verdict-rationale/index.html
index 9311a95..6d0ee45 100644
--- a/go/policy-verdict-rationale/index.html
+++ b/go/policy-verdict-rationale/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#policy-verdict-rationale">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/prompt-injection-prevention/index.html b/go/prompt-injection-prevention/index.html
index 2a67af2..380bc1c 100644
--- a/go/prompt-injection-prevention/index.html
+++ b/go/prompt-injection-prevention/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#prompt-injection-prevention">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/resource-allowlist/index.html b/go/resource-allowlist/index.html
index 88a8f04..a6df017 100644
--- a/go/resource-allowlist/index.html
+++ b/go/resource-allowlist/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#resource-allowlist">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/runtime-attestation-evidence/index.html b/go/runtime-attestation-evidence/index.html
index f8dea78..8a22150 100644
--- a/go/runtime-attestation-evidence/index.html
+++ b/go/runtime-attestation-evidence/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#runtime-attestation-evidence">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/structured-action-logging/index.html b/go/structured-action-logging/index.html
index f0978c9..c10c8d5 100644
--- a/go/structured-action-logging/index.html
+++ b/go/structured-action-logging/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#structured-action-logging">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/tool-authorization/index.html b/go/tool-authorization/index.html
index 2216cef..51a1a0a 100644
--- a/go/tool-authorization/index.html
+++ b/go/tool-authorization/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#tool-authorization">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/transaction-limits/index.html b/go/transaction-limits/index.html
index 69f8e5d..d59d4f4 100644
--- a/go/transaction-limits/index.html
+++ b/go/transaction-limits/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#transaction-limits">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/go/verifiable-evidence-record/index.html b/go/verifiable-evidence-record/index.html
index 0c05be5..9293278 100644
--- a/go/verifiable-evidence-record/index.html
+++ b/go/verifiable-evidence-record/index.html
@@ -27,7 +27,7 @@
 <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
 <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
 <meta http-equiv="refresh" content="0; url=/go/#verifiable-evidence-record">
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 <main>
diff --git a/index.html b/index.html
index 84f5f78..9484f4d 100644
--- a/index.html
+++ b/index.html
@@ -126,13 +126,12 @@
     ]
   }
   </script>
-<link rel="stylesheet" href="/design-system.css?v=20">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="agentrust-hub" id="top">
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
 <a class="skip-link" href="#main">Skip to content</a>
-
-<!-- Header -->
-<header>
+<header class="hub-header">
   <div class="header-inner">
     <a href="/" class="logo">AgenTrust</a>
     <nav aria-label="Primary">
@@ -160,6 +159,8 @@
     </nav>
   </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <main id="main">
 
@@ -175,7 +176,7 @@ <h1>Prove what your AI ran, and what it did.</h1>
     </div>
 
     <figure class="verify-panel" id="verify-panel" aria-label="A genuine Intel TDX quote, verified in this browser">
-      <div class="verify-panel-bar"><span>/verify › tdx_quote.bin</span><span>offline · in this browser</span></div>
+      <div class="verify-panel-bar"><span>/verify › keybind_quote.bin</span><span>offline · in this browser</span></div>
       <ol class="verify-rows">
         <li><span class="key">quote</span><span>Intel TDX v4, GCP C3, captured 2026-09-14</span><span></span></li>
         <li data-step="quote-signature"><span class="key">step 1</span><span>attestation key signature over header and TD report</span><span class="state">not run</span></li>
@@ -413,8 +414,8 @@ <h3>Help steward it</h3>
   </div>
 </footer>
 
-<script src="/hub-nav.js"></script>
 <script type="module" src="/verify/home-panel.js"></script>
 
+<script src="/supernav.js"></script>
 </body>
 </html>
diff --git a/marketplace/catalog/index.html b/marketplace/catalog/index.html
index 8a5ea88..8d6a9f5 100644
--- a/marketplace/catalog/index.html
+++ b/marketplace/catalog/index.html
@@ -4,10 +4,40 @@
 <title>All AgenTrust Marketplace Integrations | AgenTrust</title>
 <meta name="description" content="Browse AgenTrust and Microsoft AGT integrations with descriptions and source links. This dated catalog works without JavaScript or external catalog requests.">
 <link rel="canonical" href="https://agentrust-io.com/marketplace/catalog/">
-<link rel="stylesheet" href="/design-system.css?v=19"><link rel="icon" href="/favicon.ico">
+<link rel="stylesheet" href="/design-system.css?v=21"><link rel="icon" href="/favicon.ico">
 </head><body class="at-page marketplace-page">
-<header class="site-header"><div class="wrap header-inner"><a class="wordmark" href="/">AgenTrust</a><a href="/marketplace/">Search marketplace</a></div></header>
-<main class="wrap"><section><p class="eyebrow">Marketplace catalog</p><h1>All integrations</h1>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu is-current"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
+</header>
+<!-- site-header:end -->
+<main class="wrap" id="main"><section><p class="eyebrow">Marketplace catalog</p><h1>All integrations</h1>
 <p>Browse descriptions and source links without JavaScript. Use your browser's Find command to locate a framework or technology.</p>
 <p>57 listings, captured 2026-09-07 from <a href="https://github.com/agentrust-io/integrations/tree/1e19c9d7082f803a0ee396f01f8718510f2309a8/marketplace">this source revision</a>. <a href="/marketplace/">Search the live catalog</a> for newer listings.</p>
 <p>Community listings are manifest-validated, not endorsed. AGT project listings describe integrations in the Microsoft Agent Governance Toolkit. Listing does not establish certification, hardware validation, or commercial availability.</p>
diff --git a/marketplace/index.html b/marketplace/index.html
index fb95224..d5863f0 100644
--- a/marketplace/index.html
+++ b/marketplace/index.html
@@ -8,11 +8,42 @@
   <link rel="icon" href="/favicon.ico" sizes="any"><link rel="apple-touch-icon" href="/apple-touch-icon.png">
   <meta property="og:type" content="website"><meta property="og:site_name" content="AgenTrust"><meta property="og:title" content="AgenTrust Marketplace"><meta property="og:description" content="Build on the open ecosystem for verifiable AI agents."><meta property="og:url" content="https://agentrust-io.com/marketplace/"><meta property="og:image" content="https://agentrust-io.com/og.png"><meta property="og:image:width" content="1200"><meta property="og:image:height" content="630"><meta property="og:image:alt" content="AgenTrust: open specifications for verifiable AI">
   <meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="AgenTrust Marketplace"><meta name="twitter:description" content="Discover integrations across the AgenTrust chain of open specifications."><meta name="twitter:image" content="https://agentrust-io.com/og.png">
-  <link rel="stylesheet" href="/design-system.css?v=19">
+  <link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page marketplace-page">
-<header class="site-header"><div class="wrap header-in header-inner"><a class="wordmark" href="/">AgenTrust</a><button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button><nav id="primary-links" aria-label="Primary navigation"><a href="/">Ecosystem</a><a href="/marketplace/" aria-current="page">Marketplace</a><a href="/#chain">Technology</a><a href="/quickstart/">Quickstart</a><a class="cta" href="https://github.com/agentrust-io/integrations">Add yours ↗</a></nav></div></header>
-<main>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu is-current"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/" aria-current="page">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
+</header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
+<main id="main">
   <section class="market-hero"><div class="wrap market-hero-grid"><div><p class="eyebrow"><a href="/#chain">Build</a> · AgenTrust Marketplace</p><h1>Build with the<br><em>verifiable AI ecosystem.</em></h1><p class="market-intro">Find integrations across AgenTrust and the Microsoft Agent Governance Toolkit, from framework adapters to policy enforcement and portable trust evidence.</p><div class="market-hero-actions"><a class="button primary" href="#browse">Explore integrations</a><a class="button secondary" href="https://github.com/agentrust-io/integrations/blob/main/CONTRIBUTING.md">Publish an integration ↗</a></div></div><aside class="market-signal" aria-label="Marketplace summary"><p><strong id="hero-count">&hellip;</strong> integrations in one directory</p><p><strong id="native-count">&hellip;</strong> AgenTrust integrations</p><p><strong id="agt-count">&hellip;</strong> AGT integrations</p><small id="catalog-status" aria-live="polite">Loading live repository catalogs…</small></aside></div></section>
   <p class="wrap"><a href="/marketplace/catalog/">Browse all integrations in an alphabetical list</a></p>
   <noscript><p class="wrap">Interactive search needs JavaScript. The complete catalog above includes integration descriptions and source links.</p></noscript>
@@ -25,6 +56,5 @@
   <section class="market-submit"><div class="wrap submit-grid"><div><p class="eyebrow">Make the ecosystem bigger</p><h2>Your integration belongs here.</h2></div><div><p>Connect a framework, platform, policy engine, or governance product to the AgenTrust stack. The submission path is public, self-serve, and governed by the same rules for everyone.</p><a class="button primary" href="https://github.com/agentrust-io/integrations/blob/main/CONTRIBUTING.md">List your integration ↗</a></div></div></section>
 </main>
 <footer class="site-footer"><div class="wrap foot-in"><div class="foot-brand"><a class="wordmark" href="/">AgenTrust</a><p class="tagline">Open specifications for verifiable AI</p></div><div class="foot-links"><a href="https://github.com/agentrust-io">GitHub</a><a href="https://discord.gg/grgzFEHgkj">Discord</a><a href="/">Ecosystem</a></div></div><div class="wrap foot-legal">Marketplace listings describe technical integrations, not endorsement, certification, or commercial availability.</div></footer>
-<script src="/hub-nav.js"></script>
 <script src="/marketplace/marketplace.js?v=5"></script>
 </body></html>
diff --git a/quickstart/index.html b/quickstart/index.html
index ebc02d3..909f2a7 100644
--- a/quickstart/index.html
+++ b/quickstart/index.html
@@ -56,20 +56,42 @@
 }
 </script>
 
-<link rel="stylesheet" href="/design-system.css?v=17">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust · cMCP Quickstart</a>
-  <nav>
-    <a href="#loop">How it works</a>
-    <a href="#quickstart">Quickstart</a>
-    <a href="#proof">Proof</a>
-    <a href="https://github.com/agentrust-io/cmcp" target="_blank" rel="noopener">GitHub</a>
-    <a class="cta" href="#quickstart">Run it</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu is-current"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/" aria-current="page">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <div class="split">
@@ -99,7 +121,15 @@ <h1>Set policy on your agent. Watch it <em>block a bad action.</em></h1>
   </div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#loop">How it works</a>
+  <a href="#quickstart">Quickstart</a>
+  <a href="#proof">Proof</a>
+  <a href="https://github.com/agentrust-io/cmcp">GitHub ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="problem">
   <span class="label">The problem</span>
diff --git a/registry/index.html b/registry/index.html
index ad158f0..5dafece 100644
--- a/registry/index.html
+++ b/registry/index.html
@@ -47,20 +47,42 @@
 }
 </script>
 
-<link rel="stylesheet" href="/design-system.css?v=17">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#checkpoint">Checkpoint</a>
-    <a href="#how">How it works</a>
-    <a href="#verify">Verify it</a>
-    <a href="#limits">Limits</a>
-    <a class="cta" href="https://github.com/agentrust-io/trace-registry">Repository</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu is-current"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/" aria-current="page">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">04 · Evidence</a> · Append-only · Signed checkpoints · Offline verification</span>
@@ -73,7 +95,16 @@ <h1>Check the published history<br>of agent evidence</h1>
   <div><span class="status">Public repository · Python verifier · First checkpoint published September 1, 2026</span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#checkpoint">Checkpoint</a>
+  <a href="#how">How it works</a>
+  <a href="#verify">Verify it</a>
+  <a href="#limits">Limits</a>
+  <a href="https://github.com/agentrust-io/trace-registry">Repository ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="proof" class="proof-section" aria-label="Registry evidence">
   <div class="proof-grid">
diff --git a/supernav.js b/supernav.js
index afaf4be..a73a19b 100644
--- a/supernav.js
+++ b/supernav.js
@@ -9,45 +9,37 @@
   'use strict';
 
   var SITES = [
-    { id: 'home',       label: 'agentrust-io', url: 'https://agentrust-io.com',                                ext: false },
-    { id: 'verify',     label: 'Verify',       url: 'https://agentrust-io.com/verify/',                        ext: false },
-    { id: 'quickstart', label: 'Quickstart',   url: 'https://agentrust-io.com/quickstart/',                    ext: false },
-    { id: 'demos',      label: 'Demos',        url: 'https://agentrust-io.com/demos/',                         ext: false },
-    { id: 'telemetry',  label: 'Telemetry',    url: 'https://agentrust-io.com/telemetry/',                     ext: false },
-    { id: 'registry',   label: 'Registry',     url: 'https://agentrust-io.com/registry/',                      ext: false },
-    { id: 'trace',      label: 'TRACE',        url: 'https://trace.agentrust-io.com',                          ext: false },
-    { id: 'manifest',   label: 'Manifest',     url: 'https://manifest.agentrust-io.com',                       ext: false },
-    { id: 'cmcp',       label: 'cMCP',         url: 'https://cmcp.agentrust-io.com',                           ext: false },
-    { id: 'ca2a',       label: 'cA2A',         url: 'https://ca2a.agentrust-io.com',                           ext: false },
-    { id: 'wcm',        label: 'WCM',          url: 'https://wcm.agentrust-io.com',                            ext: false },
-    { id: 'governance', label: 'Governance',   url: 'https://governance.agentrust-io.com',                     ext: false },
-    { id: 'agt',        label: 'AGT',          url: 'https://github.com/microsoft/agent-governance-toolkit',   ext: true  },
-    { id: 'github',     label: 'GitHub',       url: 'https://github.com/agentrust-io',                         ext: true  }
+    { id: 'home',       label: 'agentrust-io', url: 'https://agentrust-io.com',            ext: false },
+    { id: 'verify',     label: 'Verify',       url: 'https://agentrust-io.com/verify/',    ext: false },
+    { id: 'wcm',        label: 'WCM',          url: 'https://wcm.agentrust-io.com',        ext: false },
+    { id: 'manifest',   label: 'Manifest',     url: 'https://manifest.agentrust-io.com',   ext: false },
+    { id: 'cmcp',       label: 'cMCP',         url: 'https://cmcp.agentrust-io.com',       ext: false },
+    { id: 'ca2a',       label: 'cA2A',         url: 'https://ca2a.agentrust-io.com',       ext: false },
+    { id: 'trace',      label: 'TRACE',        url: 'https://trace.agentrust-io.com',      ext: false },
+    { id: 'governance', label: 'Governance',   url: 'https://governance.agentrust-io.com', ext: false },
+    { id: 'github',     label: 'GitHub',       url: 'https://github.com/agentrust-io',     ext: true  }
   ];
 
   var HOST = location.hostname;
   var PATH = location.pathname;
-  // Quickstart, demos, telemetry and registry live under the apex host, so the
-  // active item cannot be resolved from the hostname alone the way every other
-  // entry can. The /wcm branch below stays for the redirect stub still served
-  // at agentrust-io.com/wcm/: it highlights WCM for the instant before the
-  // reader is moved to wcm.agentrust-io.com.
-
-  var CURRENT_ID = (HOST === 'agentrust-io.com' && PATH.indexOf('/verify') === 0) ? 'verify'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/quickstart') === 0) ? 'quickstart'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/demos') === 0) ? 'demos'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/telemetry') === 0) ? 'telemetry'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/registry') === 0) ? 'registry'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/wcm') === 0) ? 'wcm'
-    : (HOST === 'agentrust-io.com' && PATH.indexOf('/extensions/ca2a') === 0) ? 'ca2a'
-    : HOST === 'agentrust-io.com' ? 'home'
-    : HOST.indexOf('trace.') === 0    ? 'trace'
-    : HOST.indexOf('manifest.') === 0 ? 'manifest'
+  // One link per property, in chain order. Everything else under the apex host
+  // (quickstart, demos, telemetry, registry, marketplace, community, /go/)
+  // highlights agentrust-io; /verify and the cA2A extension page have their own
+  // links. The /wcm branch stays for the redirect stub still served at
+  // agentrust-io.com/wcm/: it highlights WCM for the instant before the reader is
+  // moved to wcm.agentrust-io.com. The conformance suite belongs under TRACE.
+  var APEX = HOST === 'agentrust-io.com';
+  var CURRENT_ID = (APEX && PATH.indexOf('/verify') === 0) ? 'verify'
+    : (APEX && PATH.indexOf('/wcm') === 0) ? 'wcm'
+    : (APEX && PATH.indexOf('/extensions/ca2a') === 0) ? 'ca2a'
+    : APEX ? 'home'
+    : HOST.indexOf('wcm.') === 0         ? 'wcm'
+    : HOST.indexOf('manifest.') === 0    ? 'manifest'
     : HOST.indexOf('cmcp.') === 0        ? 'cmcp'
     : HOST.indexOf('ca2a.') === 0        ? 'ca2a'
-    : HOST.indexOf('governance.') === 0  ? 'governance'
-    : HOST.indexOf('wcm.') === 0         ? 'wcm'
+    : HOST.indexOf('trace.') === 0       ? 'trace'
     : HOST.indexOf('tests.') === 0       ? 'trace'
+    : HOST.indexOf('governance.') === 0  ? 'governance'
     : 'home';
 
   var NAV_ID = 'agt-supernav';
@@ -110,7 +102,8 @@
 
     var html = '';
     SITES.forEach(function (s, i) {
-      if (i === SITES.length - 2) {
+      // A rule sets the external links apart from the AgenTrust properties.
+      if (s.ext && i > 0 && !SITES[i - 1].ext) {
         html += '<span class="sep"></span>';
       }
       var active = s.id === CURRENT_ID ? ' class="active"' : '';
diff --git a/telemetry/index.html b/telemetry/index.html
index a65b983..1df8f5d 100644
--- a/telemetry/index.html
+++ b/telemetry/index.html
@@ -47,20 +47,42 @@
 }
 </script>
 
-<link rel="stylesheet" href="/design-system.css?v=17">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#contract">Contract</a>
-    <a href="#use">Use it</a>
-    <a href="#verify">Verify it</a>
-    <a href="#limits">Limits</a>
-    <a class="cta" href="https://github.com/agentrust-io/agentrust-telemetry">Repository</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu is-current"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/" aria-current="page">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">Between actions and evidence</a> · Observe · Correlate</span>
@@ -73,7 +95,16 @@ <h1>Portable governance telemetry<br>for AI-agent runtimes</h1>
   <div><span class="status">Alpha contract 0.1.0-alpha.4 · Python and TypeScript · MIT licensed</span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#contract">Contract</a>
+  <a href="#use">Use it</a>
+  <a href="#verify">Verify it</a>
+  <a href="#limits">Limits</a>
+  <a href="https://github.com/agentrust-io/agentrust-telemetry">Repository ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="fit">
   <span class="label">Where it fits</span>
diff --git a/tools/DISCOVERY.md b/tools/DISCOVERY.md
index 0a9f43c..3aea6fd 100644
--- a/tools/DISCOVERY.md
+++ b/tools/DISCOVERY.md
@@ -7,6 +7,7 @@ The public HTML is the primary source for readers and crawlers. `llms.txt` is a
 Run these commands from the repository root with Python 3.11 or later:
 
 ```sh
+python tools/build-header.py
 python tools/build-discovery.py
 python tools/build-discovery.py --check
 python tools/check-discovery.py
diff --git a/tools/build-controls.py b/tools/build-controls.py
index fe686d9..67459d7 100644
--- a/tools/build-controls.py
+++ b/tools/build-controls.py
@@ -16,16 +16,18 @@
 import re
 import sys
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import site_header  # noqa: E402
+
 ROOT = Path(__file__).resolve().parents[1]
 DATA = ROOT / 'data' / 'agentic-controls.json'
 GO = ROOT / 'go'
 BASE = 'https://agentrust-io.com'
 
 # Shared chrome. These are the only strings to change when the site's look moves.
-CSS_VERSION = '20'
+CSS_VERSION = site_header.CSS_VERSION
 OG_IMAGE_ALT = 'AgenTrust: open specifications for verifiable AI'
 TAGLINE = 'Open specifications for verifiable AI'
-WORDMARK = 'AgenTrust'
 EYEBROW = '<a href="/#chain">Across the chain</a> &middot; Mapped to OpenCRE &middot; Stable permalinks'
 REPO = 'https://github.com/agentrust-io/agentrust-io.github.io/blob/main'
 GENERATED_COMMENT = ('<!-- Generated by tools/build-controls.py from data/agentic-controls.json. '
@@ -215,16 +217,9 @@ def render_index(controls):
 </head>
 <body class="at-page">
 '''
+    header = site_header.render(section="Specs")
     body = [f'''
-<header class="site-header">
-  <a class="wordmark" href="/">{WORDMARK}</a>
-  <nav>
-    <a href="#controls">Controls</a>
-    <a href="#opencre">OpenCRE</a>
-    <a href="#limits">Limits</a>
-    <a class="cta" href="https://github.com/agentrust-io">GitHub</a>
-  </nav>
-</header>
+{header}
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow">{EYEBROW}</span>
@@ -235,7 +230,14 @@ def render_index(controls):
   <div><span class="status">{total} controls &middot; {links} OpenCRE links &middot; {unique} Common Requirements</span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#controls">Controls</a>
+  <a href="#opencre">OpenCRE</a>
+  <a href="#limits">Limits</a>
+</nav>
+
+<main id="main">
 
 <section id="opencre">
   <span class="label">How to read this</span>
diff --git a/tools/build-discovery.py b/tools/build-discovery.py
index 52403fb..52853c0 100644
--- a/tools/build-discovery.py
+++ b/tools/build-discovery.py
@@ -8,6 +8,10 @@
 import re
 from urllib.parse import urlsplit
 from urllib.request import Request, urlopen
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import site_header  # noqa: E402
 
 ROOT = Path(__file__).resolve().parents[1]
 BASE = 'https://agentrust-io.com'
@@ -55,10 +59,10 @@ def catalog_html(snapshot):
 <title>All AgenTrust Marketplace Integrations | AgenTrust</title>
 <meta name="description" content="Browse AgenTrust and Microsoft AGT integrations with descriptions and source links. This dated catalog works without JavaScript or external catalog requests.">
 <link rel="canonical" href="https://agentrust-io.com/marketplace/catalog/">
-<link rel="stylesheet" href="/design-system.css?v=19"><link rel="icon" href="/favicon.ico">
+<link rel="stylesheet" href="/design-system.css?v=''' + site_header.CSS_VERSION + '''"><link rel="icon" href="/favicon.ico">
 </head><body class="at-page marketplace-page">
-<header class="site-header"><div class="wrap header-inner"><a class="wordmark" href="/">AgenTrust</a><a href="/marketplace/">Search marketplace</a></div></header>
-<main class="wrap"><section><p class="eyebrow">Marketplace catalog</p><h1>All integrations</h1>
+''' + site_header.render(section='Build', script=False) + '''
+<main class="wrap" id="main"><section><p class="eyebrow">Marketplace catalog</p><h1>All integrations</h1>
 <p>Browse descriptions and source links without JavaScript. Use your browser's Find command to locate a framework or technology.</p>
 ''' + f'<p>{len(items)} listings, captured {escape(snapshot["captured"])} from <a href="https://github.com/agentrust-io/integrations/tree/{snapshot["source_commit"]}/marketplace">this source revision</a>. <a href="/marketplace/">Search the live catalog</a> for newer listings.</p>\n' + '''<p>Community listings are manifest-validated, not endorsed. AGT project listings describe integrations in the Microsoft Agent Governance Toolkit. Listing does not establish certification, hardware validation, or commercial availability.</p>
 <div class="grid">
diff --git a/tools/build-header.py b/tools/build-header.py
new file mode 100644
index 0000000..c0920ba
--- /dev/null
+++ b/tools/build-header.py
@@ -0,0 +1,82 @@
+"""Stamp the shared site header into every agentrust-io.com page.
+
+    python tools/build-header.py          # rewrite the header block in each page
+    python tools/build-header.py --check  # fail if any page's header differs
+
+The header itself is defined once, in tools/site_header.py. Each page carries it
+between the site-header:start and site-header:end markers, and this script owns
+everything between them, plus the design-system.css cache-bust. A hand edit
+inside the markers fails CI; change site_header.py and re-run this instead.
+
+/go/ and /marketplace/catalog/ are generated by build-controls.py and
+build-discovery.py from the same render(), so they are checked here too.
+"""
+import argparse
+from pathlib import Path
+import re
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import site_header  # noqa: E402
+
+ROOT = Path(__file__).resolve().parents[1]
+
+# page file -> (path the header marks current, menu the page belongs to)
+PAGES = {
+    'index.html': (None, None),
+    'community/index.html': ('/community/', None),
+    'verify/index.html': ('/verify/', None),
+    'quickstart/index.html': ('/quickstart/', None),
+    'demos/index.html': ('/demos/', None),
+    'telemetry/index.html': ('/telemetry/', None),
+    'marketplace/index.html': ('/marketplace/', None),
+    'marketplace/catalog/index.html': (None, 'Build'),
+    'registry/index.html': ('/registry/', None),
+    'go/index.html': (None, 'Specs'),
+    'extensions/ca2a/v0.1/index.html': (None, 'Specs'),
+    '404.html': (None, None),
+}
+
+# check-discovery.py requires the static catalog to carry no script at all.
+NO_SCRIPT = {'marketplace/catalog/index.html'}
+
+BLOCK = re.compile(re.escape(site_header.START) + r'.*?' + re.escape(site_header.END), re.S)
+CSS = re.compile(r'/design-system\.css\?v=\d+')
+
+
+def stamped(text, name, page, section):
+    if len(BLOCK.findall(text)) != 1:
+        raise SystemExit(f'{name}: expected exactly one site-header block between the markers')
+    if 'id="main"' not in text:
+        raise SystemExit(f'{name}: the skip link needs an element with id="main"')
+    if len(CSS.findall(text)) != 1:
+        raise SystemExit(f'{name}: expected exactly one design-system.css link')
+    text = BLOCK.sub(lambda _: site_header.render(page, section, script=name not in NO_SCRIPT), text)
+    return CSS.sub(f'/design-system.css?v={site_header.CSS_VERSION}', text)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument('--check', action='store_true', help='fail if any page header differs')
+    args = parser.parse_args()
+
+    stale = []
+    for name, (page, section) in PAGES.items():
+        path = ROOT / name
+        text = path.read_text(encoding='utf-8')
+        expected = stamped(text, name, page, section)
+        if expected != text:
+            stale.append(name)
+            if not args.check:
+                path.write_text(expected, encoding='utf-8', newline='\n')
+    if args.check:
+        if stale:
+            raise SystemExit(f'{len(stale)} page header(s) differ from tools/site_header.py: {", ".join(stale)}. '
+                             'Run python tools/build-header.py and commit the result.')
+        print(f'PASS site header matches tools/site_header.py on {len(PAGES)} pages')
+        return
+    print(f'Stamped {len(stale)} of {len(PAGES)} pages')
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/tools/site_header.py b/tools/site_header.py
new file mode 100644
index 0000000..8dd8c49
--- /dev/null
+++ b/tools/site_header.py
@@ -0,0 +1,84 @@
+"""The one header every agentrust-io.com page carries.
+
+Edit the menu here, then run `python tools/build-header.py` to stamp it into the
+hand-written pages. tools/build-controls.py (/go/) and tools/build-discovery.py
+(/marketplace/catalog/) import render() directly, so their --check and
+build-header's --check agree byte for byte. CI runs all three.
+
+The header styles live in design-system.css under `.hub-header`, and hub-nav.js
+adds the mobile Menu toggle. CSS_VERSION is the design-system.css cache-bust for
+every page; bump it here when that stylesheet changes.
+"""
+from html import escape
+
+CSS_VERSION = '21'
+
+START = '<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->'
+END = '<!-- site-header:end -->'
+
+# (label, href) for top-level links, and (summary, [(label, href), ...]) for menus.
+MENU = [
+    ('Verify', '/verify/'),
+    ('Specs', [
+        ('Model-weight custody (WCM)', 'https://wcm.agentrust-io.com'),
+        ('Agent identity (Manifest)', 'https://manifest.agentrust-io.com'),
+        ('Tool-call enforcement (cMCP)', 'https://cmcp.agentrust-io.com'),
+        ('Agent delegation (cA2A)', 'https://ca2a.agentrust-io.com'),
+        ('Runtime evidence (TRACE)', 'https://trace.agentrust-io.com'),
+        ('TRACE Registry', '/registry/'),
+        ('TRACE conformance suite', 'https://tests.agentrust-io.com'),
+    ]),
+    ('Build', [
+        ('10-minute quickstart', '/quickstart/'),
+        ('Demos', '/demos/'),
+        ('Telemetry', '/telemetry/'),
+        ('Marketplace', '/marketplace/'),
+    ]),
+    ('Community', '/community/'),
+    ('GitHub', 'https://github.com/agentrust-io'),
+]
+
+
+def _link(label, href, page, indent):
+    current = ' aria-current="page"' if href == page else ''
+    return f'{indent}<li><a href="{escape(href)}"{current}>{escape(label)}</a></li>'
+
+
+def render(page=None, section=None, script=True):
+    """Return the stamped header block, markers included, with no trailing newline.
+
+    page is the path of the page being rendered; the matching link gets
+    aria-current="page". section names the menu the page belongs to when it is not
+    itself a menu entry (for example 'Specs' for /go/); a page listed inside a menu
+    marks that menu without being told. script=False leaves out hub-nav.js for a
+    page that must work without JavaScript; its links then stay visible on phones.
+    """
+    lines = [
+        START,
+        '<a class="skip-link" href="#main">Skip to content</a>',
+        '<header class="hub-header">',
+        '  <div class="header-inner">',
+        '    <a href="/" class="logo">AgenTrust</a>',
+        '    <nav aria-label="Primary">',
+        '      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>',
+        '      <ul class="header-nav" id="primary-links">',
+    ]
+    for label, target in MENU:
+        if isinstance(target, str):
+            lines.append(_link(label, target, page, '        '))
+            continue
+        marked = section == label or any(href == page for _, href in target)
+        css = 'spec-menu is-current' if marked else 'spec-menu'
+        lines.append(f'        <li class="{css}"><details><summary>{escape(label)}</summary><ul>')
+        lines += [_link(child, href, page, '          ') for child, href in target]
+        lines.append('        </ul></details></li>')
+    lines += [
+        '      </ul>',
+        '    </nav>',
+        '  </div>',
+        '</header>',
+    ]
+    if script:
+        lines.append('<script src="/hub-nav.js" defer></script>')
+    lines.append(END)
+    return '\n'.join(lines)
diff --git a/verify/index.html b/verify/index.html
index 49dff58..28da2a6 100644
--- a/verify/index.html
+++ b/verify/index.html
@@ -46,19 +46,42 @@
 }
 </script>
 
-<link rel="stylesheet" href="/design-system.css?v=19">
+<link rel="stylesheet" href="/design-system.css?v=21">
 </head>
 <body class="at-page">
 
-<header class="site-header">
-  <a class="wordmark" href="/">AgenTrust</a>
-  <nav>
-    <a href="#run">Run it</a>
-    <a href="#limits">What it proves</a>
-    <a href="#source">How it matches Python</a>
-    <a class="cta" href="https://github.com/agentrust-io/agentrust-io.github.io/tree/main/verify">Source</a>
-  </nav>
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/" aria-current="page">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">10-minute quickstart</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+      </ul>
+    </nav>
+  </div>
 </header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
 
 <div class="hero"><div class="wrap">
   <span class="eyebrow"><a href="/#chain">04 · Evidence</a> · Offline · In your browser · Intel TDX</span>
@@ -71,7 +94,15 @@ <h1>Verify a real Intel TDX quote</h1>
   <div><span class="status">Three captures, 21 July and 14 September 2026 · Checked against the Python verifier on 5,526 inputs · <a href="/#hardware">SEV-SNP and H100 validation</a></span></div>
 </div></div>
 
-<main>
+<nav class="on-this-page" aria-label="On this page">
+  <span>On this page</span>
+  <a href="#run">Run it</a>
+  <a href="#limits">What it proves</a>
+  <a href="#source">How it matches Python</a>
+  <a href="https://github.com/agentrust-io/agentrust-io.github.io/tree/main/verify">Source ↗</a>
+</nav>
+
+<main id="main">
 
 <section id="run">
   <span class="label">Run it</span>
