Attested smoke lanes with package-native evidence pack signing

Release: InvarLock 0.5.1 - Faster attested smoke checks and signed evidence packs

Highlights

• InvarLock now runs a lightweight sshleifer/tiny-gpt2 attested smoke lane on push, with a heavier GPT-2 canary lane reserved for scheduled and manually dispatched end-to-end checks.
• Evidence-pack manifests can now be signed and verified with package-native Ed25519 flows, removing the older gpg dependency from the shipped verification path.
• Runtime verification, report provenance, and coverage enforcement were tightened across the shell/core split so the fail-closed contract introduced in 0.5.0 is exercised more directly and more often.

0.5.1 is a follow-through hardening release. The headline change is the attested smoke strategy: the repo now has a small, fast lane that is cheap enough to run on push, while the heavier GPT-2 canary lane stays available for deeper scheduled and operator-triggered checks. That reduces the time to detect trust-path regressions without turning every routine change into a full-model exercise.

The release also simplifies the evidence-pack trust path. Manifest signing, verification, and key generation now use package-native Ed25519 flows, which means signed evidence-pack verification no longer depends on host gpg tooling. In the same pass, runtime-manifest verification was converged on a single packaged verifier path so installed CLI behavior, local smoke runs, and CI checks are closer to the same contract.

Underneath those user-visible changes, 0.5.1 keeps the cleanup after 0.5.0 moving: trust-critical owner modules are split more aggressively, the remaining broad-exception cases are tracked under an explicit review-bucket contract, and stricter per-file coverage and remote-setup smoke checks now cover more of the critical surface. If you maintain wrappers around unsigned evidence packs or older verification assumptions, re-check them against the current docs and defaults before adopting 0.5.1.

For the immutable release record, read the tagged CHANGELOG.md for v0.5.1.