# Curbi v17 — delivery optimization and product navigation

Production https://curbi.io · deployment https://3f64a461.curbi-landing.pages.dev · rollback https://ff3b63f2.curbi-landing.pages.dev

## Shipped
- Shared accessible Products disclosure and navigation on homepage, checker, docs, pricing and platform. Real destinations, explicit preview labels, Escape/outside/focus dismissal, mobile behavior and visible Sign in.
- Existing Inter/IBM Plex Mono fonts served locally with OFL licenses (68,544bytes Latin font resources). No Google font requests on five primary pages. Other scripts may use system fallback for glyphs outside this subset.
- Content-fingerprinted style/JS bundles and immutable caching for generated assets/fonts. Each primary page has one style request; homepage was5styles including inline, now1. Homepage HTML31,386→19,492bytes before/after this build; this is an artifact-size reduction, not a measured LCP claim. Subpages gain the richer navigation and code controls, so their HTML grows modestly.
- Homepage JS delivered as one deferred bundle; legacy header initializer removed from that bundle because shared navigation owns it. Core checker bytes preserved within bundle. Existing voice modal and same-origin revenue-audit iframe preserved.
- Strict homepage CSP with self-only script and font sources. Primary-page CSP uses local fonts. No signing, API business logic, pricing, auth or spending behavior changed.
- Developer copy-code controls and consistent focus states.

## Evidence
52tests pass (engineering tests unchanged; review own prior delivery test adapted to fingerprinted navigation). Actual Worker receipt/header suite retained.290internal links/anchors resolve. Build twice yields identical public bytes. Desktop Products menu opens, Escape closes; mobile390 has no overflow, shows signin and nested products; hero guarantee sample checks; existing voice and audit dialogs/iframe work; developer copy controls present. Final live evidence is recorded in LIVE-v17.json.

## Build
Run python3 v17/build.py. Homepage source is v17/homepage.source.html; shared navigation, UI, fonts and refinement sources are in v17/. It runs the v15 generator first, then produces primary pages, bundles and CSP/cache headers. Do not run old build.py or v15/apply.py alone as a final release build. public/ is the complete deployable artifact.

## engineering next direction
See v17/engineering-NEXT-WEBSITE.md: versioned API/policy schema and OpenAPI with browser/Worker parity, executable docs and hostile-input corpus. This complements, but does not replace, authenticated committed-effect receipt issuance. A signature verifier is not a live receipt issuer.

## Remaining limits
No production signing keys; receipt proofs still cover operation/subject only, with per-request dedupe. Distributed quotas and full CSP coverage for legacy pages remain open. Large original brand PNGs remain unchanged (logo~400KB/icon~753KB); this release does not pretend those assets were optimized. No field-performance benchmark or end-to-end production activation claim is made.