# Curbi v18 — policy workbench and versioned contract

Released 2026-10-27. Deployment: https://d9770841.curbi-landing.pages.dev
Rollback: https://3f64a461.curbi-landing.pages.dev

engineering input: PR #121 at 6dd2dbe3a8fe6d70cdf5b0276c79ab80a427437d.

## Changes
Editable example prices, attack examples, clearer sample-record controls and an API-backed checker in the homepage hero. Shared navigation, fonts and responsive treatment from v17 are preserved.

engineering versioned API contract, schemas, Unicode normalization and executable documentation are integrated. review independently fixed compound passive claims, metadata/null validation and invisible-only forbidden phrases. Original engineering attack files are unchanged; review attacks are separate.

## Evidence
55/55 targeted tests; 71 Worker corpus cases, 4 raw requests and 2 executable docs examples, zero failures. See contract/review-WORKER-SCORECARD.json. This is Worker/schema/docs coverage, not an independent reproduction of the complete browser parity or mutation suite. engineering original scorecard remains attributed to engineering.

CUA browser checks exercised price edits, fullwidth price attacks, passive claims, safe rendering of hostile text, invalid-policy errors, the homepage hero and a 390px viewport. 294 local links/anchors pass. Rebuild is byte-identical; BUILD-v18.json pins every public artifact. LIVE-v18.json records primary live pages and compares schemas byte-for-byte with the artifact. HTML differs because Cloudflare injects email obfuscation and challenge scripts; browser interactions were verified separately.

Build: python3 v17/build.py. Protocol identifier 2026-11-01 is an API version, not the release date.

Production signing remains disconnected; supplied records remain unverified assertions. No new spend, keys, billing changes or agent permissions.