v0.5.0 — lean Forge footprint, Nostr auth/provenance, correctness hardening

Summary

Changes since v0.4.0 (96 commits).

Memory & Forge footprint

• Shrink bare Forge RSS so larger models fit: defer native runtime imports, honest Free-memory reclaim for sidecars/managed vLLM, Apple-only lean cache defaults (#430)
• Live-update Model Hub free-memory strip without changing OS headroom math (#429)
• Fix macOS unified memory reporting and startup Bun lock / doctor Hub checks (#399, #428)
• Ship Nostr relay deps with [forge] on every OS install path (#428)

Nostr auth & provenance

• Make Nostr keygen the default Forge auth path; document onboarding + default provenance (#408, #409)
• Add opt-in Nostr provenance attestation (#406)
• NIP-49 encrypted ncryptsec key backup (replaces plaintext nsec download) + hardening/tests (#414–#416)
• Harden Nostr client for NIP-01 addressable semantics (#420)
• Merkle corpus membership proofs for training provenance (#411, #412)

Security & correctness

• Path sandbox hardening (#398)
• Lock training HTTP cancel/SSE/IDOR and gpu_task restore contracts (#417)
• Multi-pass correctness audits: Compat tools honesty, pool leaks, distributed WORLD_SIZE/MASTER_*, slime, SSRF, model-pool, KB/export/job-stream (#394–#396, #418–#419, #421, #423–#426)
• Remove post-train censorship prompts (#397)
• Locked-deps CI fixes (#400)

Training & platform

• Remove dead training paths; align single vs multi-GPU configs (#422)
• Harden distributed env resolution against leftover MASTER_* and rank gates (#424)
• Unify RL-quant preset registry (#393)
• Add Buzz agent skill to orchestrate Seiso jobs (#410)

Deps / UI

• Migrate Forge UI to react-router 8.3.0 (GHSA-qwww-vcr4-c8h2) (#405)
• Bump kernels, mypy, TypeScript, testing-library (#401–#404)

Full changelog: v0.4.0...v0.5.0