How it works

Three ways in → same local check → review pack → human review. Optional drafts never replace check.

Not conformity assessment. Not CE marking. Not a notified-body opinion.

Three ways in — same local check

1. Write then check — start with curb outlines (pathway warm-start interview), then dual drafts with a Recommended: A or B, optional research brief, then cite-check (refuses uncited Claims), then check.
2. Bring docs then check — put existing policies on the pack paths (or point a custom pack JSON at your paths), then check. Skips curb outlines. Curbpack does not ingest portal PDFs; evidence means files in the repo.
3. CI check alone — run check in GitHub Actions anytime. Skips curb outlines. No draft step.

Write adds draft choice before check; Bring and CI go straight to check. Every path ends in a review pack for a human to judge.

1. Choose a rule pack

A rule pack is a JSON checklist of structural gates. You pick which packs to run. Frozen catalog today:

• house-policy — default cold start (house documentation / dependency hygiene)
• cra-baseline — Cyber Resilience Act (CRA)–shaped annex draft structure (informational)
• medtech-iec62304 — IEC 62304–shaped overlay (composes with CRA when selected)

Packs are checklists shaped like regulatory annex drafts, not the law itself. Green gates mean the pack rules passed on this tree. Compose with curbpack init --packs … or .curbpack.json. Pathway for Write is optional — prefer “choose checklists,” not “pathway to regulation.”

Local pack→rule map (after confirm-packs)

On the Write path, after you confirm packs, Curbpack exports a local pack→rule map that helps navigate house drafts. It is not regulation text and does not replace check. Optional refresh anytime: curbpack packs export-graph.

2. Draft choice (Write path only)

Assistants propose Option A and Option B, state Recommended: A or B with a few reasons, then stop for you. Optional allowlisted research brief informs cites; it never changes check pass/fail. After you pick, run cite-check before owning the prose. Bring and CI skip this stage.

3. Local check

curbpack init then curbpack check evaluates the chosen packs on disk. Dual output: machine-readable findings (JSON) and a short markdown report. Exit 0 = gates passed on this tree; 1 = findings remain. Daily check does not write the buyer one-pager.

On red: curbpack check --heal, then curbpack ask … --propose, then re-check — never invent green.

4. Review pack — hand to a buyer or auditor

After green: curbpack share is the handoff verb (check → context-pack → buyer-questions → prepare-release). It writes a review pack: gate JSON, action report, executive summary, optional SBOM/VEX drafts, and a buyer one-pager HTML. That is the artifact you hand over. Front = findings. Back = provenance, optional allowlisted Sources (informational — not a gate input), and human sign-off status.

5. Human review (when ready)

A person judges the evidence. When you are ready to bind a hash, run curbpack attest into Git Notes (ssh-agent signed when possible). Unsigned ≠ verified. After attest, you can open the local proof/index.html page and compare the bound hash from the evidence pointer—still human judgment, not conformity assessment.

6. How to interpret results

Curbpack decides pass/fail (deterministic). Humans decide what to claim. Tutors propose only and must re-check; they never greenlight or attest.

Committed sample (front + back): samples/onepager.html. Optional writer aid: research brief sample. Authorities path: for authorities. Go deeper: white paper. Pack authoring: write your own pack.