State the use-review bar (layer role, positive control, backed claims, bound pin) in the evidence flow's step 8

[seathatflowsinourveins]

Writes the review bar that #185's receipts met into docs/contributing-evidence.md §3 step 8. A reproduce-only agree no longer passes as a full review of a use receipt.

Why

#201's seven Mac receipts were merged with agrees whose reviewer re-ran the commands. That shows the commands reproduce. It does not show that they exercise the layer role, include a positive control, back the pin claims, or bind to the winner's pin. An independent review found blocking issues in all seven (#201 comment 5818957285), and #209 records those needs_changes reviews. Step 8 asked only that "the commands make the component do its job". It did not name these four points, so a reproduce-only agree read as complete.

What changes

Step 8 now says an agree on a use receipt needs all four points:

1. Layer role: a server observed serving, a build's output served or used, a verifier's verdict read.
2. Positive control: where a clean result proves nothing, show a failure on a deliberate fault, as Record Mac (macos-m5pro-20260924) foundation use receipts: rtk, worktrunk, gitleaks #185's gitleaks fixture does.
3. Backed claims: a retained command behind every install, version and pin claim.
4. Bound to the winner: the winner's component_id, and tool_versions equal to its pin.

It also says:

• Re-running the commands is reproduce-only and is not an agree.
• When any point fails, record needs_changes and name the point.
• The review's --ref states what the review did: which commands were re-run (reproduce-only) and which points were checked (adequacy-checked). This was suggested by Record Mac (macos-m5pro-20260924) application and data use receipts and the macOS pnpm 12.6.0 re-qualification #201's independent reviewer.

The help and version rule is unchanged. No tooling changes: host_receipts.py review and the status derivation stay as they are. This is guidance to reviewers, not an enforced check.

Checks

• scripts/validate.py: exit 0.
• scripts/evidence_manifest.py --check: exit 0. The doc's registered sha256 and size are updated.
• tests.test_adoption_docs_consistency, tests.test_platform_status, tests.test_host_receipts and tests.test_release_pin_contents: 187 OK, 1 skipped.
• release_due.py --strict-if-repinned origin/main: reports only, since this PR doesn't re-pin. docs/contributing-evidence.md is now in its changed list.
• Guarded gitleaks over origin/main..HEAD: no leaks.

Independent reviewer: agent-lab-e9, who wrote the bar in the #201 review.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seathatflowsinourveins]

Independent review (agent-lab-e9): agree

I read the whole §3 step 8 diff at 0230413. It states the bar exactly as applied to #185 and #201:

• layer role, with the server observed serving, a build's output served or used, and a verifier's verdict read;
• a positive control for scanners, test runners, linters and gates;
• install, version and pin claims backed by retained commands;
• component_id and tool_versions bound to the winner.

It also says that reproduce-only is not an agree, and that --ref must separate reproduce-only from adequacy-checked.

Checked on a detached checkout of the PR head: validate.py, evidence_manifest.py --check and host_receipts.py validate all exit 0. No other doc restates the review criteria in a way that conflicts (I searched contributing-evidence.md, next-host-stages.md and bootstrap.md).

Two notes, neither blocking:

1. Point 4's "tool_versions equal the winner's pin" means equal under pin_matches normalisation (scripts/host_receipts.py:152-180), not byte equality. One clause saying so would stop a reviewer rejecting v1.5.5 against 1.5.5.
2. The last paragraph cites Record independent needs_changes reviews on #201's Mac application receipts #209 as having held Record Mac (macos-m5pro-20260924) application and data use receipts and the macOS pnpm 12.6.0 re-qualification #201's receipts at needs_changes. Merge Record independent needs_changes reviews on #201's Mac application receipts #209 first so that statement is true when State the use-review bar (layer role, positive control, backed claims, bound pin) in the evidence flow's step 8 #210 lands. I'm merging Record independent needs_changes reviews on #201's Mac application receipts #209 on green now.