Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/export-evidence-ref/action.yml:
- Around line 41-49: The bundle reference handling in the export-evidence-ref
action should distinguish between a truly missing bundle and a partial one.
Update the logic around the `oci`/`digest` checks so `exit 0` only happens when
both `bundle.oci` and `bundle.digest` are absent; if `bundle.oci` exists but
`bundle.digest` is missing or malformed, fail the step instead of skipping
ingest. Keep the output formatting in the same action flow (`oci`, `digest`,
`repo`, and the `GITHUB_OUTPUT` write) but add a validation path that rejects
unpinned/tag-only bundle refs.

In @.github/workflows/evidence-ingest.yaml:
- Around line 185-194: The Sync source-keyed tree to GCS step uses root-level
gcloud storage rsync without removing stale objects, so re-ingesting the same
run can leave old ctrf/*.json files behind. Update this workflow step so the
per-run directory is replaced in place during upload, using a delete-aware sync
strategy scoped to the run/output tree while preserving other sources and
prefixes; keep the change localized to the Sync source-keyed tree to GCS block
and the rsync invocation.
- Around line 96-100: The checkout in the evidence ingest workflow only fetches
the last two commits, which can miss the real push range when the event spans
more history. Update the Checkout step to either fetch full history or
explicitly fetch the commit referenced by github.event.before before the ingest
script runs, so the push-mode diff logic can compare against the correct base.
Use the existing Checkout step and the downstream ingest script trigger as the
key places to adjust.

In `@docs/contributor/evidence-ingest.md`:
- Around line 18-35: Add a language tag to the fenced block(s) in the
contributor evidence ingest doc so markdownlint stops flagging them; update the
diagram/code fence around the pipeline illustration to use a text fence, and
make the same change for the other referenced fence in this section. Use the
existing fenced-block content in the document and keep the formatting otherwise
unchanged.

In `@pkg/evidence/project/classify.go`:
- Around line 56-60: The nil-allowlist fallback in classify.go is too broad
because firstPartyIdentity only matches the repository prefix, so Classify(nil,
...) can incorrectly mark any NVIDIA/aicr workflow path as first-party. Tighten
the interim heuristic in Classify and/or firstPartyIdentity so it only
recognizes the intended canonical workflow identity (not arbitrary paths or refs
under the repo), and keep the fallback behavior aligned with the documented
allowlist replacement used by the ingest path.
- Around line 153-159: The overlap check in overlaps() is too weak because it
only compares representativeIdentity() samples, so Validate() can miss
intersecting regex allowlist entries and later Classify() depends on class
order. Update the overlap detection to either reject unsupported regexp
constructs in allowlist patterns or perform a real intersection test over the
parsed regexp AST instead of relying on a single synthesized identity. Keep the
fix centered around overlaps(), representativeIdentity(), Validate(), and the
classification path used by Classify().

In `@pkg/evidence/project/idhash_test.go`:
- Around line 22-56: Add a golden assertion to the SignerIDHash tests so the
issuer/identity pair in TestSignerIDHash is checked against one fixed expected
hash value, not just shape and relative behavior. Keep the existing determinism
and collision checks, but pin a single known output for the SignerIDHash
function to lock the persisted contract against changes to idHashLen, the
separator, or the encoding.

In `@pkg/evidence/project/idhash.go`:
- Around line 22-26: The signer hash truncation in idHashLen is too short for a
durable bucket/dedup key and can merge distinct verified signers downstream.
Update the signer hashing logic in idHashLen and any helper in idhash.go to
retain at least 128 bits, or use the full digest, so the results/.../<idHash>/
subtree and GP4 dedup key stay unique and collision-resistant.

In `@pkg/evidence/project/synthesize.go`:
- Around line 186-206: The idempotent replace flow in synthesize should be made
atomic instead of deleting the existing runDir up front. Update the run
directory setup in synthesize to stage all output into a sibling temporary
directory, run copyCTRFReports and write meta.json there, then replace runDir
with a single os.Rename only after the full tree is complete. Keep the existing
cleanup/error handling around the staging dir so a cancellation or I/O failure
cannot remove the last good result.
- Around line 215-218: The bundle-local file reads in readRecipeView and
copyCTRFReports can still follow symlinks outside bundleDir, so harden both
paths before opening anything. Add a symlink/realpath check for the recipe and
each ctrf phase file, and reject any target that resolves outside the verified
bundle directory before calling readBoundedFile, os.Stat, or copying. Use the
existing readRecipeView and copyCTRFReports helpers to centralize the guard so
all bundle file accesses stay confined to bundleDir.

In `@tools/evidence-project/main.go`:
- Around line 117-121: The ref validation in main.go is letting
--allow-unpinned-tag bypass checkTrustedRegistry for all remote refs, including
digest-pinned refs. Update the ref handling so the allow-unpinned escape hatch
only skips the unpinned-tag restriction, while pinned refs still go through
checkTrustedRegistry in the existing ref and checkTrustedRegistry flow. Add a
regression test around the main/o trust check path to confirm a digest-pinned
oci:// ref is still rejected when its registry is not on the allowlist, even if
--allow-unpinned-tag is set.
- Around line 64-82: The main entrypoint currently passes context.Background()
into run, which leaves registry and filesystem I/O unbounded and can hang the
CLI. Update main to create a signal-aware root context and wrap it with a
timeout from pkg/defaults before invoking run, keeping the change localized
around main and the run(context, o, os.Stdout) call. Ensure the timeout-bounded
context is used for all downstream ingest work so pull/verify operations inherit
cancellation and deadline handling.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/contributor/evidence-ingest.md`:
- Around line 155-157: The publish workflow description is inconsistent with the
new delete-aware rsync behavior used by the evidence publish path. Update the
documentation around the publish job and the planned identity switch to reflect
that the future GCS role must allow object deletion for the target prefix, or
revise the publish approach before describing an objectCreator-only account.
Refer to the publish job details and the rsync
--delete-unmatched-destination-objects behavior when updating the plan.

---

Duplicate comments:
In `@pkg/evidence/project/classify.go`:
- Around line 262-265: The overlap validation in classify.go still treats
syntax.OpAlternate as a single representative branch, so class resolution can
miss shared matches like same-issuer alternations. Update the logic around
overlaps() and the case handling for syntax.OpAlternate to either reject
alternation patterns outright or expand all finite alternation branches and
check them pairwise against existing entries before accepting a class.

In `@pkg/evidence/project/synthesize.go`:
- Around line 220-227: The final swap in synthesize should not delete the
existing run before the replacement is safely in place. Update the
runDir/staging handoff in synthesize so the current directory is first moved
aside with os.Rename, then rename staging into runDir, and if the second rename
fails restore the backup before cleaning it up. Keep the changes localized
around the swap logic that currently uses os.RemoveAll and os.Rename.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/uat-aws.yaml:
- Around line 303-305: The summary currently rebuilds a mutable run tag instead
of using the validated digest-pinned reference, which can point reviewers at the
wrong artifact. Update the summary generation in uat-aws workflow to use the
exported reference from steps.evidence_ref.outputs.ref everywhere the bundle ref
is printed or linked, and remove any reconstruction of the :run-${{
github.run_id }} tag so the summary always matches the verified evidence bundle.

In @.github/workflows/uat-gcp.yaml:
- Around line 272-276: The summary is still using the mutable `:run-${{
github.run_id }}` OCI tag instead of the digest-pinned ref already exported by
`steps.evidence_ref.outputs.ref`. Update the summary generation in the workflow
to reference `steps.evidence_ref.outputs.ref` wherever the evidence bundle link
is rendered, so the human-facing pointer matches the verified artifact and stays
immutable.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/uat-aws.yaml:
- Around line 303-305: The summary currently rebuilds a mutable run tag instead
of using the validated digest-pinned reference, which can point reviewers at the
wrong artifact. Update the summary generation in uat-aws workflow to use the
exported reference from steps.evidence_ref.outputs.ref everywhere the bundle ref
is printed or linked, and remove any reconstruction of the :run-${{
github.run_id }} tag so the summary always matches the verified evidence bundle.

In @.github/workflows/uat-gcp.yaml:
- Around line 272-276: The summary is still using the mutable `:run-${{
github.run_id }}` OCI tag instead of the digest-pinned ref already exported by
`steps.evidence_ref.outputs.ref`. Update the summary generation in the workflow
to reference `steps.evidence_ref.outputs.ref` wherever the evidence bundle link
is rendered, so the human-facing pointer matches the verified artifact and stays
immutable.