Curbpack

Source: RI-SE/curbpack — clone, install, releases, and docs. Development supported by RISE as an applied research / competence object; RISE does not certify products that use Curbpack gate results. GitHub Action pin: RI-SE/curbpack@v0.5.2 (version bump still needs human tabletop).

Article 14 reporting starts 11 September 2026. Install once, then scan — writes nothing:

curl -fsSL https://raw.githubusercontent.com/RI-SE/curbpack/main/scripts/install.sh | sh
cd /path/to/your/git/repo
curbpack scan

Not conformity assessment. We never see your repo.

Curbpack checks your repository against local rule packs and writes a review pack you can hand to a buyer or auditor—on your machine, without claiming certification.

Not conformity assessment. Not CE marking. Not a notified-body opinion.

Site · RI-SE/curbpack · White paper · Voice and terms · For builders · Art 14 scan · Docs index

Who are you?

You are	Start here
Supplier / builder	For builders · Share handoff · Install
Buyer / reviewer	For reviewers · Buyer evidence · Sample one-pager
Authority / auditor	For authorities · Site Authorities

Quickstart (install + scan)

Inside any git repo — read-only diagnosis after a one-line install. Pin install URLs to v0.5.4 (Action stays @v0.5.2 until human pin bump).

curl -fsSL https://raw.githubusercontent.com/RI-SE/curbpack/main/scripts/install.sh | sh
cd /path/to/your/git/repo
curbpack scan

Scan defaults to cra-baseline and prints the Art 14 reporting clock. scan uses exit 0 when diagnosis completes, even when findings remain — use curbpack check for repository gate pass/fail. When you want hooks and a daily score, use the full ladder below. Stuck? troubleshooting.

Full ladder (below)

Install when you want a local binary (Windows PowerShell · macOS/Linux curl): install. After install, curb is a short alias for curbpack.

Windows (PowerShell)

irm https://raw.githubusercontent.com/RI-SE/curbpack/main/scripts/install.ps1 | iex

macOS / Linux

curl -fsSL https://raw.githubusercontent.com/RI-SE/curbpack/main/scripts/install.sh | sh

Then the same ladder on every OS:

curbpack doctor
curbpack demo              # sandbox; optional --open
cd /path/to/your/product   # git repo
curbpack scan              # read-only diagnosis — no init, no hooks, no score
curbpack fix --art14       # one Art 14 rehearsal file (diff preview; human confirm)
curbpack share             # optional --bundle; --reveal opens review-pack in Explorer/Finder
curbpack init              # when ready: house-policy default; --profile cra|medtech
curbpack check --score     # daily loop — exit code is authoritative
# human only when ready:
curbpack attest
# verify: proof/index.html vs hpurl-pointer.json

curbpack ask-my-suppliers emits the same buyer checklist as export --buyer-questions. On red: curbpack check --heal then curbpack ask .github/curbpack/cache/latest_failure.json --propose, then re-check. Optional drift checklist: curbpack drift (exit 0 always). After OS update / PATH loss: curbpack doctor --repair (local only — not auto-update; Windows also: install.ps1 -Repair).

Three ways in

Every path ends in the same local check. Write adds optional pathway drafts first; Bring and CI skip outlines. Full table and ladders: 60-second paths · pathway guide.

What you get

Artifact	When	What it is
Gate report	Every check	JSON + markdown findings—structural evidence, not a legal finding
Review pack	prepare-release or share	Layered reports for human review
Buyer one-pager	After green + share	Supplier evidence summary HTML you hand to a buyer
Evidence bundle	share --bundle	Offline review-pack/evidence-bundle.html with embedded hpurl pointer
Reveal / Attach	share --reveal	Opens review-pack (or bundle) in Explorer/Finder; stdout Attach: <abs path> on every OS
Drift checklist	curbpack drift	Multi-signal human checklist (exit 0; not a compliance meter)
Attest capsule	Human attest when ready	Git Notes hash bind—unsigned ≠ verified
Proof page	After attest	Local proof/index.html vs evidence pointer—still human judgment

Optional exports: SARIF, ContextPack, buyer-questions, lay-of-land. Teaching sample: site/samples/onepager.html.

How to interpret results

Signal	Meaning
Exit 0 on check	Gates passed on this tree—for human review, not certification
Exit 0 on scan	Diagnosis completed (findings may remain); not a gate pass
Exit 0 on doctor	Environment report finished; advisory issues do not mean gate failure
Exit 1	Gate findings remain or operational error (typically check)
Exit 2	Usage / environment (unknown command, not a git repo when required)
Unsigned attest	Capsule present; not cryptographically verified
ssh-agent-signed	Real SSH signature produced

Gate pass is not certification, CE marking, or notified-body approval. Humans decide what to claim. Only check provides repository gate pass/fail.

Where to go deeper

Reader	Start
Builder	For builders · Share handoff · pathway · daily loop
Buyer / reviewer	Buyer evidence · for-reviewers
CISO / authority	For authorities · site Authorities
Full system	White paper · how it works
Abbreviations	Glossary and audience

GitHub Action

Action runners are Linux/macOS only (local Windows CLI is supported separately).

- uses: RI-SE/curbpack@v0.5.2
  with:
    heal: "true" # opt-in; Action default is false (scaffold ≠ readiness)
    comment_on: red
    upload_sarif: "true"

Pin @v0.5.2. Drop-in example: examples/workflows/curbpack-check.yml. Pilot deploy: ./scripts/redteam-pilot.sh.

Advanced

Binary size (~10 MB, Go CGO=0 -s -w), doctor soft-exit tips, and Zig non-goals live here—not on the first screen.

Compose, do not conquer: Curbpack prepares structural evidence for product repos. Pair with SCA (e.g. Trivy/OSV) and secret scanners (e.g. Gitleaks) for depth — not a security program. Boundary: strategy boundary.

Confirms are human-only (--i-am-human or CURBPACK_ALLOW_CONFIRM=1; TTY alone is not enough). Research briefs never gate pass/fail. Assistants: docs/assistant-loop.md · thin MCP examples/mcp/.

Command	Purpose
(bare)	doctor if uninitialized, else check
demo [--keep] [--open]	Sandbox check; --open opt-in browser
validate [--json]	Pack gates (dual-rep); prefer check daily
check --diff	Delta mode — not release-gate safe
ask [file] --propose	Explain GateFailure JSON (propose-only)
packs list|update|import|export-graph|doctor	Packs, local pack→rule map export, validity doctor
export --sarif|--explain-packet|--watchlist-join|--buyer-questions|--lay-of-land|--context-pack	Standards / tutor packet / buyer checklist / map / ContextPack
share	Thin recipe: check → context-pack → buyer-questions → prepare-release
pathway status	One next ask (human default; --technical for phase path)
pathway suggest|note	Warm-start seed + session notes — not a gate input
pathway confirm-*	Human only — --i-am-human or CURBPACK_ALLOW_CONFIRM=1
research [--fetch]|--cite-check	Allowlisted citation packet + human brief — never gates check
completion bash|zsh|fish	Print shell completions
init --bare	Minimal scaffold (no hooks/skill/ide)
init --packs a,b	Override default house-policy packs
init --workflow	Opt-in: write .github/workflows/curbpack.yml if missing

Deep docs: Intent vs Scope · Security model · Write your own pack · Migration · Adopters

Claim-safe wording enforced by scripts/claim-safety.sh. Preferred public language: docs/voice-and-terms.md.