Attested smoke lanes with package-native proof-pack signing

Release: InvarLock 0.5.1 - Faster attested smoke checks and signed proof packs

Highlights

• InvarLock now runs a lightweight sshleifer/tiny-gpt2 attested smoke lane on push, with a heavier GPT-2 canary lane reserved for scheduled and manually dispatched end-to-end checks.
• Proof-pack manifests can now be signed and verified with package-native Ed25519 flows, removing the older gpg dependency from the shipped verification path.
• Runtime verification, report provenance, and coverage enforcement were tightened across the shell/core split so the fail-closed contract introduced in 0.5.0 is exercised more directly and more often.

0.5.1 is a follow-through hardening release. The headline change is the attested smoke strategy: the repo now has a small, fast lane that is cheap enough to run on push, while the heavier GPT-2 canary lane stays available for deeper scheduled and operator-triggered checks. That reduces the time to detect trust-path regressions without turning every routine change into a full-model exercise.

The release also simplifies the proof-pack trust path. Manifest signing, verification, and key generation now use package-native Ed25519 flows, which means signed proof-pack verification no longer depends on host gpg tooling. In the same pass, runtime-manifest verification was converged on a single packaged verifier path so installed CLI behavior, local smoke runs, and CI checks are closer to the same contract.

Underneath those user-visible changes, 0.5.1 keeps the post-0.5.0 cleanup moving: trust-critical owner modules are split more aggressively, the remaining broad-exception cases are tracked under an explicit review-bucket contract, and stricter per-file coverage and remote-setup smoke checks now cover more of the critical surface. If you maintain wrappers around unsigned proof packs or older verification assumptions, this is the patch release to re-check against the current docs and defaults.

For the immutable release record, read the tagged CHANGELOG.md for v0.5.1.