fix(ci): the Gate's coverage artifact had the name its only consumer wanted, plus .json

[stranske]

The Coverage Guard's annotations, fixed. This is the second defect the workflow holds were concealing, after #90's six F821s.

What the annotations said

Both newly-unheld runs failed — #3 (scheduled) and #4 (manual):

error: Coverage verification could not find required coverage artifacts on a successful Gate run.
warn:  Unable to locate a recent successful Gate workflow run with required coverage artifacts:
       gate-coverage-trend, gate-coverage-trend-history, gate-coverage.

The cause: an artifact name and a file name are not the same thing

maint-coverage-guard.yml downloads exactly three artifact names (L251/261/271). Measured on Gate run #241 (main, success), the Gate uploaded:

artifact
gate-coverage-trend	✅ required, present
gate-coverage-trend-history	✅ required, present
gate-coverage	❌ required, absent
gate-coverage.json	← the same data, under the wrong name

Plus gate-coverage-summary.md, gate-summary.md, gate-coverage-summary, gate-coverage-3.12-1, gate-coverage-3.13-1.

So the guard probed ten successful runs, found two of three every time, and correctly concluded it had no usable run. name: is the artifact name; path: is the file. This step conflated them.

A paired literal in two files that disagreed — this repo's signature defect — invisible for exactly as long as the guard was held.

Why renaming is safe (checked, not assumed)

• gate-coverage.json as an artifact name appears nowhere else in this repo — its only occurrence was its own upload step.
• The only download-artifact steps in any workflow here are the guard's three.
• The file inside the artifact is still gate-coverage.json, so anything reading contents is unaffected.

pr-00-gate.yml is create_only in the sync manifest with Orchestrator absent from overwrite_repos, so this fix persists rather than being clobbered.

Worth raising upstream separately

The mismatch is between an upstream-templated Gate and an upstream-synced guard, so every consumer whose Gate emits coverage likely has the same silently-broken guard. I haven't filed that — it's a Workflows-repo change and you may want it batched with the app-id deprecation below.

Also in those annotations, not fixed here

Five warnings, all the same: Input 'app-id' has been deprecated with message: Use 'client-id' instead — from create-github-app-token in maint-coverage-guard.yml, which is a normal synced file. Editing it locally would be clobbered by the next template sync, so the fix belongs upstream. Harmless today; it will break when the action drops the input.

Verification

test_ci_gate_config.py 12 passed, 448 collected, ruff and black clean, YAML parses. No test asserts on artifact names, so nothing needed updating — arguably a gap, but adding a test that pins two upstream-owned literals together is the kind of paired assertion that goes stale; the guard failing loudly is now the real check.

[coderabbitai]

Warning

Review limit reached

Next included review available in 51 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 71 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d5e825ff-5286-42f8-81b4-b437be67544b

📥 Commits

Reviewing files that changed from the base of the PR and between 1d39ae2 and 390d43b.

📒 Files selected for processing (1)

• .github/workflows/pr-00-gate.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Automated Status Summary

Head SHA: e142d61
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.