Strict assurance and runtime provenance

Release: InvarLock 0.9.0 - Strict assurance, runtime provenance, and release evidence gates

Highlights

• evaluate and verify now have a strict assurance path with the invarlock-weight-edit-regression-v1 claim set, central report verdicts, strict paired-length checks, and structured evidence for synthesized, repaired, and fallback fields.
• Generated strict reports separate declared runtime provenance from verifier-confirmed provenance, keeping the top-level verdict pending until verify checks the runtime manifest.
• The docs now include the trust model, strict assurance checklist, runtime provenance guide, failure examples, one-run lifecycle, alternatives comparison, guard-validation smoke, and empirical guard-evidence contract.

0.9.0 is a trust-boundary release. The main user-visible change is not a broader robustness claim; it is a stricter way to decide whether an evaluation bundle is allowed to carry an assurance claim at all. Strict assurance now fails closed for host or unverified provenance, custom guard order, dev/aggressive profiles, unsupported blocking statuses, fallback fields, and missing guard evidence.

The site docs have been synced to the tagged v0.9.0 repository state. Start with the Strict Assurance Checklist, then read the Runtime Provenance Guide and Failure Examples for the cases that should reject instead of quietly degrading. The new One-Run Lifecycle gives the shortest path through evaluate, verify, and report html.

The release also clarifies the built-in quant_rtn path. It is now documented and reported as an RTN quantize/dequantize simulation edit: reports distinguish theoretical packed-memory estimates from actual floating-point dequantized storage, keep runtime-local parameter IDs under runtime_debug, and emit per-module plus aggregate quantization-error metrics. Real packed quantized artifacts should use adapter-backed or external subject workflows.

For maintainers and release reviewers, the evidence surface is tighter as well. The release adds CVE audit reporting, distribution checks, content-validating release evidence checks, strict example report-bundle checks, offline bundle validation, SBOM checks, runtime image digest checks, and an Empirical Guard Evidence contract for portable non-synthetic guard evidence references.

For the immutable release record, read the tagged CHANGELOG.md for v0.9.0.