Ask the supplier for a buyer one-pager (supplier evidence summary) and, if needed, the review pack (JSON + markdown). Then decide whether to dig deeper.
Not conformity assessment. Not CE marking. Not a notified-body opinion.
Open sample review page Sample review-pack Receiving submissions?
Two paths — both write-free document triage (confirmed / unconfirmed / contradicted). Neither is a product verdict, conformity assessment, or claim-to-artifact linking.
Received pack (supplier handoff):
curbpack review <received-pack-dir>
# terse default · --full for all findings · --json for schema v2 · --since <prior.json>In-repo (governed docs in a tree you already have):
curbpack review --repo [.] [--packs a,b] [--json] [--full] [--since prior.json]Advanced: curbpack review --verify-chain <parent.json> <child.json> checks record digests between prior JSON reports — still not a product verdict.
Teaching folder: /curbpack/samples/review-pack/. Longer path: Are you receiving submissions?
Locked laptop? Receive the release binary as a file (email/USB) with checksums.txt, verify sha256, then PATH — install guide. No installer engineering required.
| Artifact | What you can trust | What you must not assume |
|---|---|---|
| Gate JSON / action report | Structural evidence on the tree shown | Legal conformity or CE readiness |
| SARIF (Static Analysis Results Interchange Format) | Same findings in CI/IDE form | A security audit complete |
| Buyer-questions / lay-of-land | Honest checklist and map | A CVE or GRC program |
| Buyer one-pager / review pack | Shareable evidence snapshot | A certificate of conformity |
curbpack review triage | Offline document consistency (confirmed / unconfirmed / contradicted) | A product verdict or conformity assessment |
| Sources (allowlisted links) | Informational citation trail on the back of the one-pager | Legal authority or gate pass/fail input |
| SBOM / OpenVEX drafts | Best-effort inventory / draft notes | Complete vulnerability status |
| Attest capsule | Signed only if ssh-agent signed | Unsigned equals verified |
Procurement language must stay claim-safe: never equate gate pass with CE marking or notified-body approval. Optional Sources on a one-pager are informational only—they do not prove conformity. Deeper brief: for authorities. Voice: voice and terms.
For suppliers who used research when drafting: research brief sample (informational writer aid — not a peer to the buyer one-pager; never a gate input).