Summary

Corrects the language across the blocking Evidence Pointer Contract gate to say it establishes a claimed (not cryptographically verified) signer, and states the trust boundary explicitly: the cryptographic binding is enforced at ingest, not at the merge gate. Documentation/comments only — no behavior change.

Motivation / Context

The gate (verifier.CheckEvidenceTree / tools/evidence-pointercheck) establishes signer identity from the issuer/identity fields the committed pointer itself supplies, then derives the source slug and runs the allowlist classification against those same supplied values. It is an offline, structural anti-squat check — it does not pull the bundle or verify a Fulcio/Rekor signature binds that identity to the bundle digest. The code, CI workflow comment, and docs nonetheless described this signer as verified, overstating what the gate proves.

Pulling Sigstore verification into the offline merge gate (issue Option 1) is architecturally wrong (the gate runs with a read-only token and no registry/Sigstore egress, so it stays fork-safe) and redundant: the cryptographic binding already runs as a blocking step at ingest (evidence-ingest.yaml → VerifySignature + CrossCheckPointerSigner). A pointer that claims an allowlisted signer it does not control passes the merge gate but fails ingest and is never counted in corroboration. This PR takes Option 2 — make every gate-path surface honest about the claimed signer and state where trust actually derives.

PR #1528 already added a claimed-signer note to ADR-007; this completes the picture across the code, the CLI tool, the workflow, and the contributor guide, and adds the missing ingest-as-trust-anchor detail.

Fixes: #1535
Related: #1528, #1530

Type of Change

• Documentation update

Component(s) Affected

• Validator (pkg/validator)
• Docs/examples (docs/, examples/)
• Other: pkg/evidence, tools/evidence-pointercheck, CI workflow

Implementation Notes

• pkg/evidence/verifier/discover.go — CheckEvidenceTree godoc now spells out structural-not-cryptographic and the ingest trust anchor; checkPointerFile carries a one-line pointer; "verified" → "claimed".
• pkg/evidence/attestation/source.go — SourceSlug doc corrected.
• tools/evidence-pointercheck/main.go — package doc clarified; success message now notes the check is structural and that signature verification runs at ingest.
• .github/workflows/evidence-pointer-contract.yaml — header comment updated.
• docs/design/007-recipe-evidence.md, docs/contributor/evidence-publishing.md — trust-derivation paragraph and "claimed" wording.

Testing

go build ./pkg/evidence/... ./tools/evidence-pointercheck/...
go test ./pkg/evidence/verifier/... ./pkg/evidence/attestation/...
golangci-lint run -c .golangci.yaml ./pkg/evidence/... ./tools/evidence-pointercheck/...

Build, affected unit tests, and lint all pass (0 issues). No behavior change, so no new tests; coverage unaffected.

Risk Assessment

• Low — Comment/doc-only, no executable logic changed, trivially revertable.

Rollout notes: N/A

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)