# Curbi v16 — reviewed receipts and visual refinement

Live: https://curbi.io · deployment https://ff3b63f2.curbi-landing.pages.dev
Rollback: https://b7a33d42.curbi-landing.pages.dev
engineering input: PR118 at0259dde03e7ba07e0e21ed99ea4e6af0089f5aac.

## User-visible changes
GitLab-inspired structure in Curbi colors: white canvas, cyan/blue/magenta spectrum, subtle grid, tighter hero, dark architecture band, compact API example, service disclosure and clearer developer path. No borrowed logos, product screenshots or customer claims. Neutral empty checker state. API browser navigation redirects to docs; machine GET remains JSON. Receipt Lab sends fixed synthetic examples only and compares optional assertion acceptance with required-signature rejection. No action is executed.

## Receipt contract and review
Reproduced CAIO43/43, preserving every engineering test. Four independent review fixtures failed before fixes: malformed effects crash; unsigned facts inherit curbi_signed; inverted validity window accepted; malformed configured JWK aborts import. All corrected. Three targeted removal mutations are caught. Added real Worker and strict-page tests.49/49 pass. No public/private production key generated, installed or published; public key set is empty; live production action signing is NOT connected.

Receipts authenticate a configured signer's operation/subject/effect-key statement. Caller-provided facts remain unverified. Subject matching is not caller/tenant authentication. Dedupe is within one request, not global consumption. Proof metadata makes these limits explicit; no authorization is granted. An authenticated committed-effect issuance path binding tenant/resource/arguments/provider observation remains next engineering work.

## Security and browser checks
Site baseline headers on static pages AND Worker-generated responses. Strict CSP on check/developers/pricing/platform, with inline script hashes; mobile navigation moved from blocked inline handlers to external JS. No new microphone/camera/location usage. Per-isolate burst guard remains best-effort, not distributed.

Live10 endpoints200 with baseline headers; strict CSP present on4pages; browser API302 to docs; live required-signature example held;5assets exact source.390px homepage/check/docs no horizontal overflow; mobile menu, neutral empty state, proof buttons, quickstart anchor tested; no browser errors observed. See TESTS-v16.txt, MUTATIONS-v16.json, BUILD-v16.json, LINKS-v16.json, LIVE-v16.json.

## Source and build
public/ is the exact complete deployable release. v15/apply.py deterministically rebuilds four pages, shared footer, receipt/checker modules, routes and security policy using v15/catalog-worker.js as the immutable routing template. It preserves the current public/index.html homepage. Running it twice leaves all public bytes identical. The older root build.py alone recreates the previous v14 homepage: use this release entry point. cto-review/*refine* and visual-v16.py record one-time transformations, not repeatable build commands. Do not rerun them over a prepared release.

No billing, prices, auth-flow behavior, provider action permissions or inference spending changed. Strict CSP on older pages and a distributed rate limiter remain open work. SECURITY.md records technical responsibilities, not autonomous grants.

Design reference read and visually inspected: https://about.gitlab.com/ . Curbi retains its own brand and implementation.