feat(review): signal integrity — digests, classifier, airlock, batch

AGENTS.md

@@ -15,6 +15,7 @@ curbpack init              # when ready — house-policy default
 curbpack check             # exit code authoritative
 # red: curbpack check --heal && curbpack ask .github/curbpack/cache/latest_failure.json --propose
 # green: curbpack ask-my-suppliers  # durable buyer checklist + pack draft
+# green (share): curbpack share → hand review-pack/; reviewers: curbpack review <received-pack> (offline triage)
 # optional pathway sidecar (never gates check):
 curbpack pathway status    # human next ask by default (--technical for phase path)
 # optional research sidecar (never gates check): curbpack research [--fetch] [--gate-id=…]
@@ -41,7 +42,7 @@ trust-import · review-sign · Last tabletop: · confirm-* · attest · pin-bump
 
 1. After doc/dep edits → run `curbpack check` (exit code authoritative).
 2. On red → `curbpack check --heal` then `curbpack ask … --propose` — never invent certification; never auto-attest.
-3. On green → optional `curbpack export --context-pack` / `--buyer-questions` for humans.
+3. On green → optional `curbpack export --context-pack` / `--buyer-questions` for humans; reviewers receiving a share can run `curbpack review <received-pack>` offline (document triage — not confirm/attest).
 4. Prefer ContextPack + dual-rep IR over guessing cache files.
 5. Pin Action / examples at **`@v0.5.2`**. Never claim CE / notified-body approval.
 6. **Pathway:** call `curbpack pathway status|suggest|note` only — never forge `pathway-seed.json` or invent pack ids. Stop for human `confirm-*` and `attest`. Prefer ContextPack pathway next + RKG after confirm-packs; post-attest next is local proof verify (human). MCP never confirms/attests. Seed is not a gate input.

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased (on `main`, not yet pinned — Action pin stays `@v0.5.2`)
 
+- **Reader review wedge (comms + CLI)** — `curbpack review <dir>` offline document triage (confirmed / unconfirmed / contradicted) on curbpack-native review-packs — not a product verdict. Teaching sample at `site/samples/review-pack/`; site page `site/receiving-submissions/` (“Are you receiving submissions?”). Home / for-reviewers promote artifact trust table + review path. Pin stays `@v0.5.2`. Not certification.
+- **Phase 0-slim honesty** — installer fallback no longer prints a failing `go install …/RI-SE/curbpack` line; claim-safe guidance points to RI-SE binary releases / `docs/getting-started/install.md` and notes the Go module path remains `github.com/afelin/curbpack` until wave-2 (strangers: binary only). SDD banner + §8–§10 clarify **`curbpack verify` is not a shipped CLI verb** (future reader wedge: `curbpack review`). Directional evaluator tip-drift note + `scripts/evaluator-behavior-check.sh`. Pin stays `@v0.5.2`. Not certification.
+- **Reader wedge (`curbpack review`)** — offline triage of a received curbpack-native `review-pack/` (no git, no network): confirmed / unconfirmed / contradicted on structure, digests, and references (allowlisted URLs recorded never fetched). Pasteable triage note; exit 1 on contradicted. Frozen sample: `testdata/sample-review-pack` + `site/samples/review-pack`. Site: reviewers-first home, receiving-submissions page, trust-table links. Phase 6 scaffold + post-kill-test gates for intake/lint/batch. Document triage only — not a product verdict. Pin stays `@v0.5.2`.
 - **Slice A HITL honesty** — structural evidence for human review — not certification and not a CRA-compliant / CE / notified-body claim. GateFailure IR + ContextPack populate optional `agent_id` / `model_hash` / `active_mandate_id` from env; `source` is `self-declared` vs `bridge` when the Coreward sock path is present; missing sock fail-opens (`not_installed` / `unavailable`) and does not fail check; AgentIdentity is not in `state_hash`; no new sock ops. `TestNoVerdictSurface` locks public renderers so compliant / merge-allow are not a Curbpack verdict (`readiness_score` stays on GateFailurePayload). Opt-in `cra-baseline` file gate `docs/incident/art14-path.md` (Art 14 reporting rehearsal vs later handling clock; not house-policy default). **`--diff` always runs `anti_placeholder`** (committed heal stub + unrelated README change still fails `HOUSE-ANTI-PLACEHOLDER` / `CRA-ANTI-PLACEHOLDER` with scaffold body overlap). **`pathway confirm-prose` requires every displayed prose path independent** (not one-of); always runs inward cite-check (repo artifact or allowlisted cite; heal stubs / empty / agent-cache are not grounding). **Existing `cra-baseline` greens go red until `docs/incident/art14-path.md` is real prose.** `--heal` remaining red is intended. `--i-am-human` / `CURBPACK_ALLOW_CONFIRM=1` unchanged. Counsel note: Art 14 reporting vs handling; AI Act Art 50 grace is not blanket. Example workflow: compose Trivy/Gitleaks beside check; never set `CURBPACK_ALLOW_CONFIRM=1` on the Action. Pin stays `@v0.5.2`. Pack catalog frozen (three ids). Trust-surface freeze continues (no Action resolve / SafeJoin / OCC / airlock / sock / pack catalog).
 - **Handoff honesty** — one-pager cover sheet (files-to-read front, gate score on the back); `anti_placeholder` fails DefaultScaffoldBody overlap (`--heal` remaining red is intended); drift `docs_changed_since_attest` / `docs_unchanged_since_attest` plus optional security.txt contact signals; medtech formhints guess path `docs/medtech/…`. Proof yes/no stamp copy; share prints `share_stale` first; doctor warns on `CURBPACK_ALLOW_CONFIRM=1`; optional attest `--reviewed-by` in evidence only. Structural evidence for human review — not certification. Pin stays `@v0.5.2`. Trust-surface freeze continues (no Action resolve / SafeJoin / OCC / airlock / sock / pack catalog).
 - **Premortem production fixes (PR #57)** — `init` gitignores cache/evidence; Action `heal` default **false** + scaffold≠readiness warning; pathway confirm requires `--i-am-human` / `CURBPACK_ALLOW_CONFIRM=1` (TTY alone refused); `LatestNoteCommit` walks notes (not HEAD-without-note); Action refuses Windows runners + red `REMEDIATION REVIEW` artifacts; claim-safety scans `*.ps1`; redteam **18/18**; maintainer playbook [`docs/getting-started/release-v0.5.2.md`](docs/getting-started/release-v0.5.2.md)

CLAUDE.md

@@ -19,6 +19,7 @@ curbpack check
 #   curbpack pathway note --set last_draft_pick=A|B|edited
 # before confirm-prose: curbpack research --cite-check <draft.md>
 # green (optional share): curbpack export --context-pack
+# reviewers (offline): curbpack review <received-pack>  # document triage — not confirm/attest
 ```
 
 ## Human-only acts

docs/getting-started/buyer-evidence.md

@@ -20,6 +20,14 @@ Suppliers may reach green via Write, Bring, or CI; that path is theirs. Optional
 | **Local gate score** | Not a certification score or market-access percentage |
 | **UNSIGNED** | Capsule may be present; not cryptographically verified |
 | **ssh-agent-signed** | Real SSH signature on the attest capsule |
+| **`curbpack review` triage** | Offline document consistency (confirmed / unconfirmed / contradicted, with cause split) — not a product verdict |
+
+**Offline / locked laptop:** install via [Ladder 3 — manual binary + checksums](install.md#ladder-3--manual-binary--checksums) (receive binary as file + `checksums.txt`, verify fail-closed). Then:
+
+```bash
+curbpack review <received-pack-dir>
+# terse default; --full for all findings + dropped tokens; --json for schema v2
+```
 
 Use the full [artifact trust table](../../site/for-reviewers/) before equating any artifact with legal conformity or CE readiness.
 

docs/getting-started/install.md

@@ -89,6 +89,8 @@ Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
 
 ### Ladder 3 — Manual binary + checksums
 
+For locked-down or offline assessor laptops: receive the release binary **as a file** (email attachment, USB, or internal file drop) together with `checksums.txt`, verify sha256 fail-closed, then place on PATH — same steps as below. No installer required. See also [buyer evidence](buyer-evidence.md) and [for reviewers](../../site/for-reviewers/).
+
 1. Open the release for pin **`v0.5.4`**: https://github.com/RI-SE/curbpack/releases/tag/v0.5.4  
 2. Download the asset for your OS from the manifest (`curbpack_darwin_*`, `curbpack_linux_*`, or `curbpack_windows_amd64.exe`) **and** `checksums.txt`.  
 3. Verify sha256 (fail closed if mismatch).  

docs/internal/evaluator-tip-drift.md

@@ -0,0 +1,32 @@
+# Evaluator tip drift (directional)
+
+> Maintainer note. Dual-remote mirror sync was removed (`scripts/curb-sync.sh` deprecated). **RI-SE/curbpack** is the sole public source of truth; **afelin/curbpack** is private development.
+
+## Behavior bar (do not re-derive)
+
+Vacuous-pass / not-started / target-absent semantics for tip evaluators are already locked by tests under `internal/validate`. Treat those cases as the behavior bar — do not invent a second definition of “aligned.”
+
+Relevant cases include:
+
+- `TestAntiPlaceholderTargetAbsentWhenAllMissing` — missing annex targets must **not** vacuous-pass `anti_placeholder` (target absent).
+- `TestNPMDepBanVacuousPassPresentManifest` — present manifest with no banned pin may pass.
+- `TestNPMDepBanTargetAbsentMissingManifest` — missing `package.json` must **not** vacuous-pass dep-ban (target absent).
+- Related `anti_placeholder` stub / fresh-stub tests in the same package.
+
+`AllNotStarted` / `IsNotStartedFailure` in `internal/validate` classify scaffold / absent / not-started findings for TTY; tip comparison must respect that split (○ not-started ≠ ✘ fail ≠ silent green).
+
+Lean runner: [`scripts/evaluator-behavior-check.sh`](../../scripts/evaluator-behavior-check.sh).
+
+## Drift checks must be directional
+
+When comparing public tip to another tip (or a private development tip):
+
+1. Report **which side is ahead** (commit/date), not only whether hashes differ.
+2. **Fail loudly** if evaluator behavior diverges (vacuous-pass / AllNotStarted / anti_placeholder target-absent semantics).
+3. Do **not** treat hash-only mirror noise as a pass/fail signal — missing dual-remote sync means tip inequality alone is expected noise, not a gate.
+
+## Public SoR
+
+Public tip comparison is against **RI-SE `main`**. Private afelin work is development; it is not a second public mirror to keep byte-identical for its own sake.
+
+Not conformity assessment. Exit codes and local `curbpack check` remain authoritative for repo gates.

docs/internal/historical-verify-target.md

@@ -0,0 +1,36 @@
+# HISTORICAL / TARGET — `curbpack verify` sketches
+
+> **NOT SHIPPED.** `curbpack verify` is **not** a CLI verb. Do not run it; do not teach it as available.
+>
+> Recipient-side document triage is intended as future **`curbpack review`**. Do not resurrect `verify` as the ship name.
+>
+> Structural evidence for human review — not conformity assessment, not certification, not CE / notified-body opinion.
+
+These snippets were design-intent examples formerly presented without enough shipping fences in the SDD. Kept here so implementers can see the old shape without mistaking it for product surface.
+
+## Asker loop (historical wording)
+
+```
+asker publishes signed pack → supplier runs it locally →
+supplier returns signed evidence → asker runs `curbpack verify`
+```
+
+**Today:** stop after signed evidence; humans review artifacts. **Target ship name:** `curbpack review`.
+
+## Operations sketch (historical)
+
+```
+curbpack packs sign <pack>
+curbpack packs trust import <allowed_signers>   # human-only; not built yet
+curbpack verify <bundle|pack|onepager>          # NOT SHIPPED — historical name only
+```
+
+## Artifact footer (historical)
+
+```
+Generated locally by curbpack. Nothing was uploaded. Verify it yourself: `curbpack verify <file>`.
+```
+
+**Today:** do not print a `curbpack verify` invitation. Prefer claim-safe review language until `curbpack review` ships.
+
+See also: [software-design-document.md](../software-design-document.md) banner + §9.1; [sdd-gap-analysis.md](sdd-gap-analysis.md).

docs/internal/phase6-kill-test.md

@@ -0,0 +1,92 @@
+# Phase 6 — kill-test scaffold
+
+> Maintainer note. Procedure scaffold only — results TBD. Not conformity assessment. Not certification.
+
+## Goal
+
+Falsify or support product value of offline **document triage** (`curbpack review` on curbpack-native review-packs): a useful mix of **confirmed** / **unconfirmed** / **contradicted** states across real submissions — reported as the **cause split**, never vanity summed `% unconfirmed` alone.
+
+**Variance required:** ~100% confirmed **or** ~100% unconfirmed across the public set **falsifies** product value (no discriminative signal). Report **distribution**, never name-and-shame projects.
+
+## Gate before cohort
+
+**Negative (sensitivity) + specificity PASS is required before any cohort / `--batch` kill-test n=10.**
+
+| Control | Pass rule |
+|---------|-----------|
+| Sensitivity matrix | Broken packs must detect: absent cited path → `unconfirmed`+`genuine`; altered `result_digest` / wrong sbom digest → `contradicted`+`self_disagree` |
+| Specificity | Known-good bundle → `UnconfirmedGenuine == 0` **and** `ContradictedCount == 0` exactly |
+| Extractor | Dogfood `UnconfirmedExtractor == 0` (non-zero is a classifier regression — fix before cohort) |
+
+P4 red → no cohort, no circular OSS share→review as sole kill-test. See tests in `internal/review`.
+
+## Procedure
+
+### 1. Dogfood curbpack-on-itself (split metrics)
+
+1. Run the existing dogfood path: [`.github/workflows/curbpack-dogfood.yml`](../../.github/workflows/curbpack-dogfood.yml) (Action against this repo; local equivalent: build binary → `curbpack check` / share path as documented).
+2. If a local curbpack-native **review-pack** directory is present (e.g. after prepare-release / share; often gitignored as `/review-pack/`), run:
+
+   ```bash
+   curbpack review --full <path-to-review-pack>
+   ```
+
+3. Record **split** counts: confirmed; unconfirmed by cause (`producer` / `extractor` / `genuine` / `external`); contradicted by cause (`self_disagree` / …). Document triage ≠ product verdict.
+
+### 2. Ten public OSS projects (only after P4 green)
+
+1. Select **ten** public open-source projects that publish **security documentation** (e.g. SECURITY.md, security.txt, disclosure policy — claim-safe selection criteria only).
+2. For each, produce or obtain a curbpack-native review-pack via the normal local loop (scan/init/check/share as applicable on a clone) — **on the evaluator’s machine**; do not upload proprietary trees.
+3. Prefer **independent docs+code or intake-completeness** pilots when negatives fire and specificity holds — do **not** treat circular OSS share→review as the sole kill-test.
+4. Run `curbpack review <dir>` (or `--batch` over prepared dirs) on each pack.
+5. Aggregate **only** the distribution of split counts across the ten. **Do not** publish a per-project shame table. Internal worksheets may keep ids; public write-ups stay anonymized aggregates.
+
+### 3. Named org case study
+
+A **named** organization case study requires **prior written consent**. Without consent: keep anonymized or omit.
+
+## Cohort decision (after dogfood + P4)
+
+| Observation | Decision |
+|-------------|----------|
+| Negatives fire; specificity holds; dogfood genuine low | Detector works; prefer independent docs+code or intake-completeness pilot |
+| Sensitivity or specificity fails | No cohort |
+| `extractor` non-zero on dogfood | Classifier regression — fix first |
+
+Defer `intake` / `packs lint` per [post-kill-test-gates.md](post-kill-test-gates.md).
+
+## Results table (placeholder)
+
+| Cohort | n | confirmed | unconfirmed split (P/E/G/X) | contradicted | Notes |
+|--------|---|-----------|-----------------------------|--------------|-------|
+| Self dogfood (this repo `review-pack/`) | 1 | 23 | 0 / 0 / 0 / 0 | 0 | After digest-fingerprint + triage-surface harden: digests confirmed; extractor 0; genuine 0 (no cache-path flood) |
+| Frozen sample fixture | 1 | 10 | 7 / 0 / 1 / 1 | 0 | `testdata/sample-review-pack` — aha path; extractor 0; genuine=SECURITY.md cite |
+| Public OSS (security docs) | 10 | TBD | TBD | TBD | **Blocked until human records dogfood + decides cohort type** |
+| Named org (consent) | TBD | TBD | TBD | TBD | Omit until written consent |
+
+**P4 controls (automated):** sensitivity matrix + specificity known-good — PASS in `internal/review` (`TestSensitivityMatrix`, `TestSpecificityKnownGood`). Extractor on sample = 0.
+
+**Cohort decision (process):** Prefer independent docs+code or intake-completeness pilot once a human records self-dogfood split metrics; do **not** use circular OSS share→review as the sole kill-test. Intake/lint remain deferred.
+
+## Public OSS cohort (internal worksheet — consent-free)
+
+Ten public projects with published security documentation (selection only; results stay aggregated):
+
+1. curl/curl  
+2. openssl/openssl  
+3. golang/go  
+4. kubernetes/kubernetes  
+5. torvalds/linux (security docs only — expect heavy; optional substitute: aquasecurity/trivy)  
+6. sigstore/cosign  
+7. aquasecurity/trivy  
+8. github/codeql-action  
+9. rustls/rustls  
+10. python/cpython  
+
+Procedure per clone: shallow clone → `curbpack init --yes` (or house profile) → `check` / `share` as far as the tree allows → `curbpack review <review-pack>` → record **split** counts only. Never publish a per-project shame table.
+
+## Claim discipline
+
+- Triage is about the **received document**, not legal conformity.
+- Never equate kill-test metrics with CE, notified-body, or CRA compliance.
+- Pin stays as documented in AGENTS.md until a human approves a bump.

docs/internal/post-kill-test-gates.md

@@ -0,0 +1,24 @@
+# Post kill-test gates (compress-after)
+
+> Maintainer note. Structural evidence for human review — not conformity assessment.
+
+## Rule
+
+**Intake** and **packs lint** stay **gated** until either:
+
+1. **Phase 6 kill-test** completes with an acceptable outcome (see [phase6-kill-test.md](phase6-kill-test.md)), **or**
+2. An **explicit human risk accept** is recorded (written maintainer decision — not an agent invent, not a chat greenlight).
+
+`curbpack review --batch` is available after **sensitivity + specificity** controls pass (see phase6 gate table) for ranked local triage. It is **not** a greenlight for intake/lint or public cohort advice.
+
+Do **not** implement intake or packs-lint expansion while this gate is closed.
+
+## Why
+
+The reader wedge (`curbpack review` + review-pack triage) must prove distributional value on real packs before we widen intake surface. Shipping intake early creates operational load without a falsifiable product signal.
+
+## Out of scope here
+
+- Implementing intake / packs lint
+- Pin bumps, trust-import, attest, or HPURL work
+- Claiming certification or CE / notified-body outcomes from kill-test metrics

docs/internal/sdd-gap-analysis.md

@@ -28,7 +28,7 @@
 |----------|------------|
 | `internal/report` | Missing — findings re-declared across ~8 structures |
 | `internal/sign` | Missing — attest uses ssh-agent notes, not `ssh-keygen -Y` pack verify |
-| `verify` command | Missing — proof page is client-side hash compare only |
+| `verify` command | **Missing** — **`curbpack verify` is not a shipped CLI verb**; proof page is client-side hash compare only. Intended reader wedge name: future `curbpack review` (document triage). See [historical-verify-target.md](historical-verify-target.md). |
 | `references` check primitive | Missing |
 | Check-kind registry (§6.3) | Partial — `checkRegistry` map in `checks.go`, not unified `CheckKind` descriptor |
 | `packs init --from-repo` | Missing |

docs/migration-cyberready-to-curbpack.md

@@ -47,11 +47,9 @@ curl -fsSL https://raw.githubusercontent.com/RI-SE/curbpack/main/scripts/install
 curb doctor && curb demo
 ```
 
-From source:
+From source (maintainers / clone holders only):
 
-```bash
-go install github.com/afelin/curbpack/cmd/curbpack@v0.5.0
-```
+The Go module path remains `github.com/afelin/curbpack` until wave-2 migration. With the development repo private, strangers should use the binary installers above — do not treat `go install github.com/RI-SE/curbpack/...` as a working path (module path differs), and do not rely on `go install github.com/afelin/curbpack/...` as a public install.
 
 ## Pedagogy (unchanged gates)