Release 2.1.129 (2026-07-13)

Features

• derive required evidence-gate set from branch-protection config (#2292) Add EvidenceGate, classify_evidence_gate, and required_evidence_gates to github_config, deriving the evidence-producing gate set from the same required-status-check computation that drives branch protection (desired_ci_gates_ruleset). This makes the enforced gates and the evidence-required gates provably identical, with no hand-maintained list and no drift.

classify_evidence_gate maps a required check name to its gate via a module-level prefix/literal table (security / test / audit / quality; version -> None as non-evidence-producing). required_evidence_gates reuses _extract_status_checks over the derived ruleset, classifies, groups, and drops non-evidence checks.

Task T1 of epic vergil-project/.github#140.

• add manifest builder, bundle assembler, and metadata files (#2293) Add src/vergil_tooling/lib/ci_evidence.py: the pure, network-free core that shapes a release's CI-evidence bundle (Task 2 of epic vergil-project/.github#140).

Provides GateEvidence and HarvestContext dataclasses, sha256_file, build_manifest (schema 1.0 per spec section 8), write_checks_json, write_readme, copy_sbom, and assemble_bundle. Timestamps are injected by the caller so the logic is deterministic and unit-testable; bundle members are added in sorted order for a reproducible archive.

Fully unit-tested with zero network dependency; 100 percent coverage on new lines.