Security model

What you can trust — and what unsigned does not mean.

Not conformity assessment. Not CE marking. Not a notified-body opinion.

• Install checksums: release downloads verify checksums.txt (sha256, fail-closed) in both install.sh and the GitHub Action.
• Unsigned vs signed: unsigned capsules are labeled unsigned. Fake agent-bind tokens are never treated as verified signatures. Unsigned ≠ verified.
• Offline packs: daily check needs no network. Network pack update requires a sha256 pin; otherwise stay offline / import locally.
• MCP / integrator IPC: MCP shells out to CLI by default. Optional Unix sock sidecar (curbpack-sock in examples/mcp/; private path mode 0600 when used).
• Regex limits: pack patterns are length-capped and time-bounded to reduce regular expression denial-of-service (ReDoS) risk.

Full write-up: docs/security-model.md. Co-promotion / RISE-neutral language: docs/promotion-firewall.md. Report vulnerabilities via SECURITY.md.

Pin @v0.5.2. This page is not an incident runbook and not a certification statement. Sign-off brief: for authorities.