# Curbi v21 — agent-first discovery and signed amount lab

Released 2026-10-27. Production: https://curbi.io/ . Pinned deployment https://630e0c38.curbi-landing.pages.dev . Rollback https://e28ada56.curbi-landing.pages.dev .

## What shipped
- /agents/: static, readable agent quickstart with an executable request, error handling and trust limits.
- /ai.json and /.well-known/curbi-ai.json: capability manifest linking the actual OpenAPI and policy schema; explicit unavailable capabilities.
- /llms.txt, sitemap and robots discovery; HTML service-description/capability links.
- /lab/: editable signed amount example, real Ed25519 signing/verification with fresh temporary local keys, original-text findings, failed/unknown outcomes, public evidence inspection and report export. No API upload or provider write.
- Content-addressed checker, receipt and lab scripts prevent mixing cached code from older releases.
- engineering PR #124 amount-aware receipts, key rotation windows, updated 74-case corpus and contract. review additionally rejects non-USD receipts supporting dollar completion claims.

The local lab's test keys are not production keys. Its evidence proves only synthetic bytes under its temporary key. Public signing remains off. No execution gateway, payment connection or remote MCP endpoint is offered.

## Review / held core
engineering 42 execution tests reproduced. Three new review attacks intentionally fail: originating agent/subject can cross an idempotency lookup; negative budget values accepted; unrelated resource evidence can become DONE. Failing fixtures are in separate draft review PR #125, based on engineering #124. Reference issuer/target code is not merged with this site release and not deployed. See v21/AI-FIRST.md. No claim that 42 passing synthetic tests proves production prevention.

## Validation
65 targeted website tests pass. 74 Worker corpus cases +4 raw requests +2 documentation examples pass. 400 internal links checked across seven primary pages. Byte-identical rebuild. CUA verifies mismatched/matched amount, unknown hold, invalid cents, safe hostile-text rendering and 390px layout; no console errors. Full parity/mutation suite remains engineering-reported. Production discovery → manifest example → real Check API verified, with machine files matching artifact bytes. Hosting may transform HTML.

Build with python3 v17/build.py. v21/build.py generates agent/lab pages and discovery files. Primary pages use one local stylesheet, local fonts and strict self-script CSP.