Release 2.1.138 (2026-07-14)

Bug fixes

• scope harvest artifact download to required gates (#2341) download_evidence_artifacts globbed ci-evidence-* and treated every match as a gate expecting gates//evidence.json. The security gate uploads SARIF partials (ci-evidence-security-part-codeql/-trivy/-semgrep) alongside the consolidated ci-evidence-security; the partials carry no evidence.json, so harvest crashed with FileNotFoundError, never wrote harvest-state.json, and the attach step cascaded (release 2.1.137).

Scope the download to the exact ci-evidence- artifact name of each required gate (the config-derived set already computed by required_evidence_gates), intersected against the run's artifact list. Partials and any non-matching artifact are ignored; a required gate whose artifact is genuinely absent is left undownloaded and surfaces as a substantive IncompleteEvidenceError at completeness validation, never a silent skip.

Second bake finding for the CI-evidence harvest under epic vergil-project/.github#140.

CI Evidence: All gates passed — full audit bundle available. Download →