What we shipped on the night of 3 to 4 November 2026

How we counted: the 32 list items under "Night of 3 to 4 Nov 2026" in the changelog. Every item below is one of them, shortened, with a link to the live page where it can be tried or checked. Numbers are as of that night. Natural hazards at your plot is still being finished and is not counted here.

Desk review and AI4

The desk review on real websites, and an open benchmark for it.

• The desk review finds where a site sells: from a home page it looks through the same site for the sales page, in 13 languages, with the sitemap as a fallback. Example: a Bali developer whose offer sits on an "Invest" page, not on its home page. Tested on 19 live developer websites. fix
• Pages built by JavaScript are now read from the data embedded in them, instead of coming out nearly empty. fix
• Blocked readers are named: when a website blocks automated readers, the desk review says so instead of reporting on what little it could read.
• AI benchmark: public test pages, the checks a correct answer must pass, every answer signed. Models forced to answer alone: Haiku 18 of 18 cases (108 of 108 checks), Sonnet 16 of 18 (105 of 108). A script scores your own system.

Verify us6

Ways to check our numbers, our pages and our log without trusting us.

• Number provenance: click a marked number on the home page, /database, /trust, /investors/dossier, /prices or /status to see its source, read again in your browser with its signature or SHA-256 checked.
• Verify this page: your browser hashes the page and its scripts and compares them with a signed manifest of 2,090 published files. At launch 175 of 175 HTML pages matched. Now in the site footer.
• Reproducible worker builds: the code that serves the site is bundled twice in clean folders; the SHA-256 of each build is published and signed.
• Log witnesses: an open kit lets anyone outside Kolaboro check every day that our public log only grows and cosign it with their own key, free on GitHub Actions. Registering witnesses and running our own: a key and a database step. opens after setup
• Service level objectives with error budgets, computed in your browser from the live measurements, and a published policy for when a budget runs out. Availability today: 100%.
• Bug bounty scope and hall of fame. Rewards today are thanks and public credit; no cash rewards yet.

Buyer tools6

Free tools; the document and visit tools run on your own device.

• Contract check: ten clauses from your purchase agreement, each with the exact words and what the law says in Indonesia, Dubai, Thailand, Spain and Portugal. Optional AI (Qwen2.5 via WebLLM) on your own device. Nothing is uploaded.
• Law notes: 21 short notes on ownership, escrow and deposit rules, each quoting and linking the official text.
• Permit QR check: your device reads the QR code on a permit, title or ad, shows the link and says whether it belongs to the official agency.
• Image check verifies C2PA Content Credentials and lists metadata left by generative AI tools. It does not guess whether a picture was made by AI.
• Site visit app, works offline: checklist, photos with GPS and time, entries chained on your phone, exported as a signed JSON and PDF. Nothing is uploaded.
• Signed buyer reports: buyers report delays, payment problems or good experiences, signed with a passkey; proof of purchase stays on their device and a person reads every report first. opens after setup

Data and APIs9

Who is behind a project, natural hazards at a plot, how websites and prices move, and events for partners.

• Natural hazards for any plot: six open sources read live (height, flood model, earthquakes since 1900, tsunami run-ups, volcanoes, coastline), each with source, query and limits. No score.
• Hazard figures for 168 tracked projects and 27 watched areas, monthly and rounded so no plot can be located.
• Zoning guide: how to check a plot on the official Indonesian maps. The official services refuse automated queries, tested hourly, so we never show a zone.
• Company graph: 17 UK projects matched on Companies House, 56 current directors, 1,253 other companies in their networks (counted per project). Anonymised.
• Court search by exact company name: UK (Find Case Law) when you ask. US (CourtListener) waits for an access token. The Indonesian court database refuses our servers. opens after setup
• Mystery shopper: the six questions we will ask every developer and how answers will be measured. 0 enquiries sent, so no numbers yet. not started
• Website change watch: where a developer's page changed, as shapes only, so projects stay anonymous. First run: 148 baselines of 580 projects with their own website.
• Asking-price index: same-project advertised prices, 30 markets, recomputed in your browser. All markets 100.03 on 3 Nov against 100 on 28 Oct. A few days of history, thin counts, asking prices only.
• Signed webhooks: an Ed25519-signed event when a project's public record changes, replay-safe, with retries and verifiers in JavaScript and Python. Ping and sample work today; saving subscriptions waits for a database step. opens after setup

Speed, reliability and privacy10

Fixes and hardening, most found by our own checks.

• Lighthouse every day on 20 pages. Latest: phone performance 83 on average, desktop 97, accessibility 98, SEO 100, best practices 77.
• Project pages no longer jump while loading: layout shift 1.5 to 0.001; Lighthouse performance 53 to 82 on phones, 69 to 97 on desktop. fix
• Headings in order: pages with a heading-order problem went from 36 of 40 tested to 0 of 40; footer column titles are real headings on 155 pages. fix
• Email protection script removed from the 20 pages that show an email address (it carries no security nonce). fix
• Session recording masked on pages with keys, logins, agent data, developer replies, signed results, and in the contract and permit checks. For about 30 minutes after launch it recorded the contract check's sample text. fix
• Developer replies with a document link could not be saved (a database pattern limit). Fix prepared, applied with the next database update. fix
• Deadlines on slow calls: 15 s for a developer's page, 60 to 120 s for an AI model. The chaos drill gained a slow-model scenario: 9 of 9.
• Security hardening: 27 inline event handlers removed, server-added scripts carry the nonce, project and market pages kept out of shared caches, open data cached 60 s.
• 0 serious accessibility issues on the client portal, the sample report and the satellite pages. fix
• Open-source copy in sync with the live site again; property tests 22 of 22.

What is built but opens after setup, and what has not started

From the changelog: "the code is live but waits for a key, an account or a database step from us."

• Signed buyer reports: a database step
• Signed webhooks: saving subscriptions: a database step
• Log witnesses: registering witnesses and running our own: a key and a database step
• US court search (CourtListener): an access token
• Mystery shopper: not started: a sending mailbox and approval of the wording

How to check us: Verify this page, Trust center, System status, Public log, Log witnesses.

The day before: what we shipped on 3 November 2026.