# refpoint

> refpoint is a compliance-as-code CLI. Controls are declared in HCL, executed against local, SSH, or WinRM targets, and reported as signed, attestable evidence. It is read-only: it never changes a target.

Every page below is also available as raw markdown by appending `.md` to its
URL. `/llms-full.txt` carries the whole documentation set in one file.

Vocabulary worth keeping straight when answering questions about refpoint: a
control ends in exactly one of five statuses (passed, failed, error, skipped,
waived); `error` means the check could not be evaluated and is never reported
as a pass; profiles are directories holding `profile.rpp` and `controls/*.rpc`.

## Getting started

- [Installation](https://refpoint.dev/docs/getting-started/installation.md): Install refpoint from a release archive or build it from source.
- [Quickstart](https://refpoint.dev/docs/getting-started/quickstart.md): Scaffold a profile, validate it, and run your first scan.
- [Core concepts](https://refpoint.dev/docs/getting-started/concepts.md): The object model, status vocabulary, and scoring rules behind every run.

## Profiles, controls, checks

- [Writing controls](https://refpoint.dev/docs/rules/writing-rules.md): Profile layout, control syntax, and the check blocks that make up a rule.
- [Variables](https://refpoint.dev/docs/rules/variables.md): Declaring variables, overriding them at run time, and how empty values behave.
- [Functions](https://refpoint.dev/docs/rules/functions.md): The function set available in profile and control expressions, and where it applies.
- [Waivers](https://refpoint.dev/docs/rules/waivers.md): Recording accepted exceptions, and what expiration means.
- [Filters](https://refpoint.dev/docs/rules/filters.md): Narrowing a run to selected controls by ID, tag, or impact.

## Resource reference

- [Resource reference](https://refpoint.dev/docs/resources.md): How checks address a resource, and what every resource type has in common.
- [Cross-platform resources](https://refpoint.dev/docs/resources/cross-platform.md): The thirteen resource types that work on Linux, macOS, and Windows targets.
- [Linux resources](https://refpoint.dev/docs/resources/linux.md): The nine resource types that inspect Linux subsystems.
- [Windows resources](https://refpoint.dev/docs/resources/windows.md): The seven resource types that inspect Windows subsystems through PowerShell.

## CLI reference

- [CLI reference](https://refpoint.dev/docs/cli-reference.md): Command index, global flags, and exit codes for the refpoint binary.
- [refpoint run](https://refpoint.dev/docs/cli-reference/run.md): Execute a profile against one or more targets.

## Guides

- [Targets and inventory](https://refpoint.dev/docs/guides/targets-and-inventory.md): Address forms, transports, and the inventory file that describes a fleet.
- [CI integration](https://refpoint.dev/docs/guides/ci-integration.md): Gating a pipeline on scan results, and publishing the evidence it produces.
- [Evidence and attestation](https://refpoint.dev/docs/guides/evidence-and-attestation.md): Signing reports, binding them to an audit trail, and knowing what a report can leak.
- [The command allowlist](https://refpoint.dev/docs/guides/command-allowlist.md): How arbitrary execution is gated, why it fails closed, and where the limits are.
- [Security model](https://refpoint.dev/docs/guides/security-model.md): The trust boundaries, what each one enforces, and where the boundary is not.
- [Release integrity](https://refpoint.dev/docs/guides/release-integrity.md): How a release binary is built, checked, and signed before it reaches you.

## Optional

- [Full documentation](https://refpoint.dev/llms-full.txt): every page above concatenated into one file.
- [Walkthrough: Safer updates with refpoint: catching configuration drift before it bites](https://ops.cafe/notes/safer-updates-refpoint): Install refpoint, write and validate a first profile, and run it against remote hosts to catch configuration drift before and after an update.