Curbpack · Front
sample-app
Teaching sample: open findings, then after-fix. Supplier evidence summary for procurement review — not a certificate of conformity.
Packs: House Policy Example
UNSIGNED — not cryptographically verified
Files to open
| Path | Question |
|---|---|
SECURITY.md |
For human review: Is a vulnerability disclosure path present? |
.well-known/security.txt |
For human review: Is a security.txt contact path present? |
Before fix — findings remain
| Gate | Severity | Finding / remediation |
|---|---|---|
security_md_present |
high | Missing SECURITY.md. Add a vulnerability disclosure path (even a short stub), then re-run curbpack check. |
text_forbid_cert_theater |
high | Forbidden claim-adjacent wording in docs. Remove certification theater; keep “not conformity assessment” framing. Re-check. |
dep_pin_note |
medium | Lockfile / pin note incomplete for a watched dependency. Record the intended pin or justify the range, then re-check. |
After fix — gates passed on this tree
Same sample, after remediations
Gates passed — pending human review & attest
| Gate | Severity | Finding |
|---|---|---|
| No open gate findings. Human still judges annex drafts and risk; attest when ready. | ||
Back — provenance & human sign-off
Local gate score on this tree: 62% — not certification
After fix, local gate score on this tree: 100% — not certification
Chosen rule packs are structural checklists (house policy or regulation-shaped drafts). Gate green is not legal conformity. Human sign-off is curbpack attest — ssh-agent signed means a human bound this tree; unsigned ≠ verified.
- Rule packs
- house-policy
- Commit
- teaching-sample (not a real SHA)
- Attest
- UNSIGNED — not cryptographically verified
- Signer
- local-unsigned
- User touch
- not-verified
- state_hash
- (none — run curbpack attest after human review)
- Human sign-off
- Pending human review. A reviewer runs curbpack attest; ssh-agent-signed = human-bound on this commit.
- Verify
- proof/index.html + local evidence pointer (client-side hash compare)
Sources (informational — not a gate input)
- EUR-Lex CRA (Regulation (EU) 2024/2847) — allowlisted link for human reading; informational Sources ≠ gate input.
Not conformity assessment. Not CE marking. Not a notified-body opinion. Generated as a committed teaching sample · Local gate score ≠ certification.