In @.github/workflows/ci.yml:
- Around line 27-31: Update the GitHub Actions steps named "Install cargo-fuzz"
and "Install cargo-mutants" to avoid compiling from source on every run: add the
--locked flag to cargo install for reproducible installs, and prefer installing
prebuilt binaries (e.g., use binstall or download a release tarball) or rely on
the existing Rust cache (~/.cargo/bin) to restore those tools rather than
running cargo install unconditionally; ensure the workflow checks the cache
before installing and only falls back to install when the binary is missing.
- Around line 10-12: The CI workflow jobs lack timeout-minutes which can allow
hung xtask runs to consume minutes indefinitely; add a reasonable
timeout-minutes (e.g., 30 or 60) to each job definition—specifically update the
job keyed as pr and the other CI job referenced around the same block (the
second job at lines ~45-47) to include timeout-minutes: <minutes> so the GitHub
Actions runner will cancel long-running or stuck builds.
- Around line 37-43: The "Upload receipt" artifact step currently runs only on
success and is skipped if the preceding "xtask pr" step fails; update the Upload
receipt steps (the step with name "Upload receipt" that uses
actions/upload-artifact@v4 and uploads name: receipt-pr path:
target/xtask/receipt.json) to include if: always() so the receipt artifact is
uploaded regardless of job success; apply the same change to the equivalent
"Upload receipt" in the main job.

In `@AGENTS.md`:
- Line 1: The markdown heading inside the file is incorrect: change the
top-level heading text from "# CLAUDE.md" to "# AGENTS.md" (update the heading
string at the top of the file) so the file heading matches the filename and
project conventions.
- Around line 77-87: AGENTS.md's workspace list and the "cargo xtask ci"
description are out of sync with CLAUDE.md; update the AGENTS.md entries to
include the missing adapter crates (uselesskey-rustls, uselesskey-ring,
uselesskey-rustcrypto, uselesskey-aws-lc-rs) and align the "cargo xtask ci"
description to match CLAUDE.md (include "matrix + guard + bdd + no-blob +
mutants + fuzz"), or choose one canonical source and regenerate the other from
it so the lists (the crate lines like `crates/uselesskey-rustls`, etc.) and the
`cargo xtask ci` description remain consistent across both documents.
- Line 126: Update the MSRV mention in AGENTS.md so the line currently reading
"`clippy.toml` - MSRV 1.88" matches the actual toolchain version; change it to
"`clippy.toml` - MSRV 1.92" to be consistent with rust-toolchain.toml and
Cargo.toml (search for the exact string "`clippy.toml` - MSRV 1.88" and replace
it with the updated version).

In `@Cargo.toml`:
- Around line 71-76: The change raised opt-level = 2 for both [profile.dev] and
[profile.test], which increases incremental compile times workspace-wide;
instead revert those global opt-levels to a lower level and add a per-crate
profile override for only the RSA/crypto crate(s) that need higher optimization
(use the Cargo profile override header syntax e.g.
[profile.dev.package."your_rsa_crate_name"] and
[profile.test.package."your_rsa_crate_name"] with opt-level = 2), so only the
crate(s) requiring faster release-like codegen pay the compile cost while other
crates keep fast incremental builds.

In `@CLAUDE.md`:
- Line 87: Update the X.509 description so both files match: pick either "X.509
self-signed certificate fixtures" or "X.509 certificate fixtures" and apply it
consistently in CLAUDE.md and AGENTS.md; specifically modify the entry for
crates/uselesskey-x509 and its description referencing the X509FactoryExt trait
so the two files are identical.
- Around line 69-74: Add a blank line immediately before the fenced code block
that begins with "```bash" (the code block containing "cargo test -p
uselesskey-core test_name" and "cargo test -p uselesskey-rsa test_name") in
CLAUDE.md so the markdown conforms to MD031; ensure there is an empty line
separating the preceding paragraph and the code fence.

In `@crates/uselesskey-aws-lc-rs/Cargo.toml`:
- Around line 22-28: The "all" feature currently enables rsa, ecdsa, and ed25519
but not native, so consumers using default-features = false with features =
["all"] won't enable aws-lc-rs and the conversion traits (AwsLcRsRsaKeyPairExt,
AwsLcRsEcdsaKeyPairExt, AwsLcRsEd25519KeyPairExt) remain unavailable; update the
Cargo.toml [features] section by adding "native" to the "all" feature so it
becomes all = ["native", "rsa", "ecdsa", "ed25519"] to ensure aws-lc-rs and the
gated conversion traits are enabled when users opt into "all".

In `@crates/uselesskey-aws-lc-rs/src/lib.rs`:
- Around line 30-34: The doc example uses the misleading variable name
`ring_kp`; update the example to use a name that reflects this crate (e.g.,
`aws_kp`) wherever `ring_kp` appears in the rsa_key_pair_aws_lc_rs example
block, and adjust any subsequent references like `ring_kp.public_modulus_len()`
to `aws_kp.public_modulus_len()` so the example matches the aws-lc-rs adapter
naming.

In `@crates/uselesskey-bdd/Cargo.toml`:
- Around line 14-16: The inline dev-dependencies p256, p384 and x509-parser in
Cargo.toml should be moved to the workspace dependency table; remove the version
strings here and change each to use workspace = true (preserving feature lists
for p256 and p384 like ["ecdsa","pkcs8","pem"]) and then add their versions once
under [workspace.dependencies] in the workspace Cargo.toml so the workspace
centrally manages their versions and prevents drift.

In `@crates/uselesskey-bdd/features/chain.feature`:
- Around line 61-68: Add missing step definitions referenced by the "certificate
chain supports multiple SANs" scenario: implement functions (e.g.,
step_generate_certificate_chain_for_domain, step_add_san_to_chain,
step_leaf_certificate_should_contain_san) in crates/uselesskey-bdd/tests/bdd.rs
that create a deterministic certificate chain for a domain, append SAN entries
to the chain, and assert that the leaf certificate's SAN extension contains the
given names; reuse and adapt the existing single-certificate X.509 helpers in
bdd.rs (parsing, SAN handling, deterministic factory) to build the chain,
mutate/add SANs on the leaf, and perform the assertions so the new scenario
steps are wired to the feature file.

In `@crates/uselesskey-bdd/features/cross_key.feature`:
- Around line 55-61: The RSA 3072 key generated for label "rsa-3072" is never
asserted; update the scenario to either remove the "When I generate an RSA key
for label \"rsa-3072\" with spec 3072" step or add an assertion that checks its
modulus length (the JWK n value) falls between the lengths of "rsa-2048" and
"rsa-4096". Concretely, augment the existing Then step (or add a new Then step)
to assert that length(n for "rsa-2048") < length(n for "rsa-3072") < length(n
for "rsa-4096") so the "rsa-3072" generation is actually validated.

In `@crates/uselesskey-bdd/features/ecdsa.feature`:
- Around line 143-149: The ES384 scenario "ES384 public JWK has correct format"
is missing parity checks present in the ES256 scenario; update that scenario by
adding the assertions 'And the ECDSA public JWK should have a kid' and 'And the
ECDSA public JWK should have x and y parameters' so the scenario includes checks
for kid and the x/y coordinates (matching the ES256 checks).

In `@crates/uselesskey-bdd/features/hmac.feature`:
- Around line 1-4: The feature declares HS256/HS384/HS512 but only exercises
HS256; add two new scenarios to crates/uselesskey-bdd/features/hmac.feature that
mirror the existing HS256 deterministic/stability scenario(s) but set the
algorithm to HS384 and HS512 respectively (e.g., "Scenario: deterministic HS384
HMAC fixture" and "Scenario: deterministic HS512 HMAC fixture"), using the same
Given/When/Then steps and assertions as the HS256 scenarios so they validate
stable output length and values for the HMAC fixture generator referenced by the
Feature: HMAC fixtures.

In `@crates/uselesskey-bdd/features/jwks.feature`:
- Around line 93-101: Add a check for the ECDSA key's "alg" field in the JWKS
ECDSA scenario to match the RSA scenario parity: update the "ECDSA JWKS key
contains required fields" scenario (where you call public_jwk() via the
deterministic factory and generate an ES256 key for label "ecdsa-fields") to
include an assertion that the JWKS EC key contains field "alg" (expecting
"ES256" or at least presence), similar to the RSA scenario's alg assertion.

In `@crates/uselesskey-bdd/features/x509.feature`:
- Around line 141-145: The X.509 identity PEM tempfile scenario only checks the
filename suffix and misses verifying file contents; update the scenario for
"X.509 identity PEM writes to tempfile" to also read the tempfile and assert its
contents equal the certificate's identity_pem() (similar to the cert and key
scenarios). Locate the scenario that generates the X.509 with label "temp-chain"
and add a step like "reading the X.509 identity tempfile should match the
identity_pem()" so the test reads the tempfile path produced and compares the
file contents to identity_pem() for the generated identity.

In `@crates/uselesskey-bdd/tests/bdd.rs`:
- Around line 9-90: UselessWorld has repeated groups of fields for
RSA/Ed25519/ECDSA; extract that pattern into a new KeyArtifacts struct (named
KeyArtifacts) containing the repeated Option fields (pkcs8_pem_1/2,
spki_der_1/2, pkcs8_der_original, mismatch_1/2, corrupted_pem, truncated_der,
kid_1/2) and replace the per-key flat fields in UselessWorld with rsa_artifacts:
KeyArtifacts, ed25519_artifacts: KeyArtifacts, ecdsa_artifacts: KeyArtifacts;
update any code that referenced the old flat fields to use the new nested fields
and ensure the World derive macro still works with the nested struct (if it
fails, keep the flat layout but extract a private helper type or implement
Default/From conversions to reduce duplication).
- Around line 565-753: This file duplicates many Ed25519 step functions that
mirror RSA/ECDSA ones; split the long BDD file into per-key-type modules to
improve navigability: extract the Ed25519 When/Then functions (e.g.,
gen_ed25519, gen_ed25519_again, gen_ed25519_second, get_ed25519_mismatch,
corrupt_ed25519_bad_header, truncate_ed25519_der, capture_ed25519_kid and all
ed25519_* Then functions) into a new module (suggest steps/ed25519.rs), move
ECDSA and RSA blocks into steps/ecdsa.rs and steps/rsa.rs respectively, export
or import the shared UselessWorld type and any helper uses (ed25519_dalek
imports) from the new modules, add mod declarations and use the step functions
from the original tests/bdd.rs (or replace the large blocks with mod includes),
and ensure visibility (pub) and imports compile; this keeps behavior unchanged
while reducing file size and making each key-type block isolated.

In `@crates/uselesskey-core/src/derive.rs`:
- Around line 53-67: The test derive_seed_unknown_version_is_deterministic
triggers an eprintln from the unknown-version fallback in derive_seed, producing
noisy stderr; update the test or the fallback so tests don't print: either (A)
change the fallback in derive_seed to use a log macro (e.g., log::warn!) instead
of eprintln! so callers/tests can control/silence it, or (B) suppress/capture
stderr inside the test derive_seed_unknown_version_is_deterministic by
temporarily redirecting stderr (for example using the gag crate or a std-based
temporary stderr redirect) for the duration of the derive_seed calls so the
determinism assertion still runs without emitting to stderr.

In `@crates/uselesskey-core/src/sink/tempfile.rs`:
- Around line 156-159: The current read_to_string method uses
String::from_utf8_lossy which silently replaces invalid UTF-8; change it to
return an error on invalid UTF-8 by using String::from_utf8(bytes).map_err(...)
instead of from_utf8_lossy so callers get a clear error; update the
implementation in the read_to_string function to call self.read_to_bytes(), then
attempt strict conversion with String::from_utf8 and propagate a suitable Error
(or map to the existing Error type) to preserve behavior consistent with
std::fs::read_to_string.
- Around line 195-214: The test tempfile_deleted_on_drop uses a fragile
sleep-based polling loop to wait for deletion; instead, after creating
TempArtifact via TempArtifact::new_string inside the inner block and capturing
path = temp.path().to_path_buf(), remove the loop and immediately assert that
the path does not exist (call assert!(!path.exists(), ...)) since NamedTempFile
removal is synchronous; update the tempfile_deleted_on_drop test to drop the
TempArtifact by leaving the inner scope and perform a single immediate assertion
on the captured path variable.

In `@crates/uselesskey-core/tests/core_prop.rs`:
- Around line 13-25: The local variable `_id` created via `ArtifactId::new`
inside `derive_seed_for_test` is unused dead code; remove that construction so
the function only uses `Factory::deterministic(*master)` and
`fx.get_or_init(...)` to produce the seed, and then clean up the `ArtifactId`
import if it becomes unused elsewhere; ensure `derive_seed_for_test`,
`Factory::deterministic`, and `fx.get_or_init` remain unchanged except for
deleting the `_id` line.

In `@crates/uselesskey-core/tests/factory_env.rs`:
- Around line 23-27: Add a brief SAFETY comment documenting the invariant around
calling the unsafe std::env::set_var/remove_var in the test helper: in
EnvGuard::drop (the drop implementation shown) annotate the unsafe {
std::env::remove_var(&self.key) } with a // SAFETY: comment explaining that the
env var name is uniquely generated for the test and therefore removing it is
safe even if it does not exist; likewise locate the corresponding unsafe
std::env::set_var usage in the EnvGuard constructor (or test setup) and add a
matching // SAFETY: comment describing the scoped safety guarantee.
- Around line 5-11: The helper unique_env_var currently uses only
SystemTime::as_nanos() which can collide across threads; modify unique_env_var
to append a per-thread identifier or random component (e.g.,
std::thread::current().id() or a small RNG/UUID) to the format string so
generated names are unique even when invoked concurrently; update the format
call in unique_env_var to include the chosen thread_id or random token alongside
{suffix} and {nanos}.

In `@crates/uselesskey-core/tests/negative_prop.rs`:
- Around line 52-71: The expression target_bytes = pem.len() / fraction.max(1)
is redundant because fraction is drawn from 1usize..10 and therefore always ≥ 1;
update the test function corrupt_pem_truncate_produces_correct_length to remove
the .max(1) (compute target_bytes = pem.len() / fraction) and keep the existing
prop_assume! checks (target_bytes < pem.len() and target_bytes > 0) so behavior
and assertions remain unchanged.

In `@crates/uselesskey-ecdsa/Cargo.toml`:
- Around line 23-27: The blake3 dependency is not optional but sits under the
"Optional JWK/JWKS support" block; move the blake3 entry out of that comment
group into the main [dependencies] section (the same section that contains
rand_core) so it is a required dependency; update its entry accordingly (remove
it from the optional block and add the blake3 declaration under [dependencies])
and ensure there are no optional = true flags left for blake3.

In `@crates/uselesskey-ecdsa/src/keypair.rs`:
- Around line 26-40: The Inner struct holds a redundant spec: EcdsaSpec field
that duplicates the spec already stored on EcdsaKeyPair and is unused (marked
#[allow(dead_code)]); remove the spec: EcdsaSpec field from Inner and any
references to Inner::spec, keeping EcdsaKeyPair::spec as the single source of
truth to eliminate dead weight in the cache (update constructors or builders
that populated Inner to stop initializing spec and update any code that accessed
Inner::spec to read from EcdsaKeyPair::spec instead).
- Around line 150-202: Extract the duplicated uncompressed-point parsing into a
private helper (e.g., a function like split_uncompressed_point or
parse_uncompressed_coords) that takes &self.inner.public_key_bytes (or &[u8])
and returns the x and y slices after asserting bytes[0] == 0x04 and computing
coord_len = (bytes.len()-1)/2; then call that helper from public_jwk and
private_key_jwk to obtain x and y and encode them instead of repeating the
assertion and slicing logic.

In `@crates/uselesskey-ecdsa/src/spec.rs`:
- Around line 37-45: Add a brief doc comment to the EcdsaSpec::stable_bytes
function (or adjacent to the EcdsaSpec type) explaining that the 4-byte
encodings intentionally overlap with HmacSpec (e.g., Es256 == Hs256) but this is
safe because ArtifactId includes a separate domain field and uniqueness is only
required within the same domain; reference HmacSpec and ArtifactId::domain in
the comment so future contributors understand the domain separation guarantee.

In `@crates/uselesskey-ecdsa/tests/keypair.rs`:
- Around line 116-129: The test tempfiles_match_in_memory only exercises
EcdsaSpec::es256(); update it to run the same assertions for both
EcdsaSpec::es256() and EcdsaSpec::es384() by iterating over the specs (e.g., a
small loop or array of specs) and creating a key from Factory::random() for each
spec, then calling key.write_private_key_pkcs8_pem(),
key.write_public_key_spki_pem(), reading the tempfile contents and asserting
they equal key.private_key_pkcs8_pem() and key.public_key_spki_pem()
respectively; keep the existing helper calls (Factory::random(),
write_private_key_pkcs8_pem, write_public_key_spki_pem, private_key_pkcs8_pem,
public_key_spki_pem) but run them for both EcdsaSpec::es256() and
EcdsaSpec::es384().

In `@crates/uselesskey-ed25519/Cargo.toml`:
- Line 11: The crate's Cargo.toml sets readme = "../../README.md" which is
inconsistent with other adapter crates; either add a crate-level README.md and
update the readme key to "README.md", or change the readme value to "README.md"
to match the other crates; locate the readme entry in Cargo.toml (the readme
key) and replace the path or add a local README.md file accordingly so all
adapters use the same crate-level readme convention.
- Around line 20-24: The blake3 entry is a required dependency but is placed
under the "Optional JWK/JWKS support" comment which is misleading; open
Cargo.toml and move the blake3.workspace = true line out of that optional block
(place it above the optional JWK/JWKS comment, e.g., directly after the other
non-optional dependencies around where serde_json and base64 are declared) so it
is clearly in the required dependencies section, and do not mark it optional or
gate it behind the jwk feature (leave blake3 as a plain workspace dependency).

In `@crates/uselesskey-ed25519/src/spec.rs`:
- Around line 24-28: Ed25519Spec's stable_bytes uses ASCII magic ([b'E', b'd',
0x01, 0x00]) while EcdsaSpec and HmacSpec use numeric discriminants, so make the
encoding consistent: change Ed25519Spec::stable_bytes to return the same numeric
discriminant form as the others (e.g., [0, 0, 0, 1]) or refactor all specs to
use a shared enum/constant for discriminants; update the
Ed25519Spec::stable_bytes implementation (and optionally add a shared
SPEC_DISCRIMINANT constant used by EcdsaSpec, HmacSpec, RsaSpec) so all spec
types follow the same convention.

In `@crates/uselesskey-ed25519/tests/jwk_private.rs`:
- Around line 65-71: The test kid_is_deterministic currently only exercises a
cache hit because k1 and k2 come from the same Factory; change it to instantiate
two independent factories using the same Seed::from_env_value("ed25519-kid")
(e.g., let fx1 = Factory::deterministic(...); let fx2 =
Factory::deterministic(...)), call fx1.ed25519("issuer", Ed25519Spec::new()) and
fx2.ed25519("issuer", Ed25519Spec::new()), then assert_eq!(k1.kid(), k2.kid())
to verify cross-factory deterministic derivation of kid().

In `@crates/uselesskey-hmac/README.md`:
- Around line 1-6: The README for the uselesskey-hmac crate is sparse compared
to sibling crates; update it to match workspace conventions by adding a features
table (list features and cargo feature flags), a short usage example showing how
to import and call the crate’s API for generating HMAC keys/fixtures (mention
HS256/HS384/HS512 usage), and a license section that matches the repository
license; ensure the crate name uselesskey-hmac is referenced and that the
examples mirror the format used in uselesskey-ring so the README is consistent
for crates.io consumption.

In `@crates/uselesskey-hmac/src/spec.rs`:
- Around line 12-51: Public API methods on HmacSpec lack /// doc comments; add
concise one-line Rustdoc comments for hs256(), hs384(), hs512(), alg_name(),
byte_len(), and stable_bytes() describing what each returns/represents (e.g.,
constructor for each variant, algorithm name string, key byte length, and stable
4-byte encoding for derivation), mirroring the style and level of detail used in
RsaSpec so crates.io docs are consistent; ensure comments are placed immediately
above the functions (hs256, hs384, hs512, alg_name, byte_len, stable_bytes) and
mention any important stability/compatibility note for stable_bytes about
bumping the derivation version in uselesskey-core.

In `@crates/uselesskey-jsonwebtoken/README.md`:
- Around line 26-36: The README example uses undefined symbols `claims` and
`Claims`; add a brief placeholder explaining/defining them so the snippet is
self-contained: declare or mention a `Claims` struct (e.g., derive
Serialize/Deserialize) and create a `claims` instance before calling `encode`
and `decode` so readers can copy the example; update the example near the
`encode`/`decode` usage of `encoding_key()`/`decoding_key()` to reference that
`claims` variable and the `Claims` type.

In `@crates/uselesskey-jwk/src/lib.rs`:
- Around line 86-101: Add Debug implementations for the public JWK types so
users can inspect them in tests: add #[derive(Debug)] to the structs
RsaPublicJwk, EcPublicJwk, OkpPublicJwk, PublicJwk and the Jwks collection type;
for AnyJwk, either add #[derive(Debug)] if it’s an enum or provide a manual impl
that matches on the inner variant and delegates to its Debug (taking into
account the existing custom Debug for PrivateJwk) so dbg!()/println!("{:?}",
...) works for all public JWK wrappers.
- Around line 306-311: Display for PrivateJwk currently serializes and prints
full JWK JSON (exposing secret fields like d, k); change the fmt::Display impl
for PrivateJwk to emit a redacted representation that matches the existing Debug
behavior by omitting secret key fields (e.g., d, k, etc.) — either serialize a
redacted/public-only view of the struct or reuse the Debug formatting under
fmt::Display (avoid calling serde_json::to_string(self) directly). Ensure the
new impl uses the same redaction rules as Debug so format!("{}"),
log::info!("{}") and println!("{}") never print secret material.

In `@crates/uselesskey-rsa/src/keypair.rs`:
- Around line 160-181: public_jwk() (and private_key_jwk()) hardcode alg="RS256"
which is wrong for non-2048 RsaSpec keys; modify RsaSpec to expose the intended
JWK alg (e.g. add an enum or field describing the algorithm or add a method like
jwk_alg() that maps bits -> "RS256"/"RS384"/"RS512") and update public_jwk() and
private_key_jwk() to call that new accessor instead of the hardcoded "RS256";
reference RsaSpec, public_jwk, and private_key_jwk when making the change so the
JWK alg value is derived from the spec rather than fixed.

In `@crates/uselesskey-rsa/tests/rsa_prop.rs`:
- Around line 93-120: Rename the misleading test function
all_spec_configs_produce_parseable_keys to reflect it only exercises the RS256
spec (e.g., rs256_spec_produces_parseable_keys); update the test function
identifier and any related doc/comment text to reference RsaSpec::rs256() and
2048-bit/65537 exponent so the name accurately matches the behavior of the test.

In `@crates/uselesskey-rustcrypto/src/lib.rs`:
- Around line 56-67: rsa_public_key currently calls rsa_private_key(),
re-parsing the PKCS#8 DER on every call; change rsa_public_key to avoid
re-deserializing the private key by parsing the public-key SPKI/PKCS#8 DER
directly (e.g. use a public-key DER accessor on uselesskey_rsa::RsaKeyPair such
as public_key_spki_der() and call rsa::RsaPublicKey::from_public_key_der or the
appropriate rsa::pkcs8 decode function) so callers don't incur repeated
private-key deserialization in RsaKeyPair::rsa_public_key(); if no public-key
DER accessor exists, update the API/docs to recommend callers call
rsa_private_key() once and derive the public key themselves.

In `@crates/uselesskey-rustls/Cargo.toml`:
- Around line 31-35: The server-config and client-config features currently
enable dep:rustls but do not pull in any crypto provider, causing a build
failure; fix this by either updating Cargo.toml so server-config and
client-config require one of the provider features (e.g., include "rustls-ring"
or "rustls-aws-lc-rs" in the feature arrays for server-config and client-config)
or add a compile-time check in the crate root (lib.rs) that emits a
compile_error when server-config or client-config is enabled without either
feature rustls-ring or rustls-aws-lc-rs; refer to the feature names
server-config, client-config, rustls-ring, rustls-aws-lc-rs and the dep:rustls
entry when applying the change.

In `@crates/uselesskey-rustls/README.md`:
- Around line 3-5: Update the README opening to reflect that this crate
integrates with both rustls-pki-types and rustls itself: change the first
sentence to mention "rustls" (or "rustls and rustls-pki-types") integration for
the uselesskey test fixtures and add a link to the rustls docs; also ensure the
second sentence still explains conversion to rustls types and the optional
ServerConfig/ClientConfig builders (referencing rustls::ServerConfig and
rustls::ClientConfig) so the broader scope is accurately communicated.

In `@crates/uselesskey-rustls/src/config.rs`:
- Around line 359-527: The three tests tls_handshake_roundtrip,
mtls_with_provider_roundtrip, and mtls_roundtrip duplicate the same
client↔server handshake loop; extract that logic into a helper function (e.g.,
drive_handshake or complete_handshake) that accepts mutable references to
rustls::ClientConnection and rustls::ServerConnection and runs the byte-transfer
loop with the progress flag and safety assert using MAX_HANDSHAKE_ITERATIONS,
then replace the loop in each test with a call to that helper (refer to the test
functions tls_handshake_roundtrip, mtls_with_provider_roundtrip, mtls_roundtrip
and the helper name you create).

In `@crates/uselesskey-rustls/src/lib.rs`:
- Around line 286-293: In test_ecdsa_es384_private_key replace the incorrect
method call keypair.private_key_derustls() with the correct identifier
keypair.private_key_der_rustls() so the assertion uses the actual Rustls-format
private key; update the variable/key reference in that function (key =
keypair.private_key_der_rustls()) to match the corrected method name.

In `@crates/uselesskey-x509/src/cert.rs`:
- Around line 242-255: Extract the duplicated base_time derivation into a shared
helper function (e.g., fn derive_base_time(label: &str, subject_cn: &str,
issuer_cn: &str, rsa_bits: u32) -> DateTime/Type) in util.rs and replace the
inlined blocks in cert.rs and chain.rs to call this helper; the helper should
perform the same steps (create blake3::Hasher, update with lengths and bytes of
label, subject_cn, issuer_cn, update with rsa_bits as u32 in big-endian, then
call deterministic_base_time(hasher)) so callers pass label, spec.subject_cn,
spec.issuer_cn and spec.rsa_bits and get back the base_time.
- Around line 210-212: The trivial wrapper function load_inner simply forwards
to load_inner_with_spec with identical arguments; remove the load_inner function
and replace its single call site with a direct call to
load_inner_with_spec(factory, label, spec, variant), preserving the return type
(Arc<Inner>) and any ownership/borrowing semantics; delete the unused load_inner
definition and run a build to ensure no other references remain.

In `@crates/uselesskey-x509/src/chain_spec.rs`:
- Around line 136-137: The stable_bytes implementation currently does a lossy
cast with (self.rsa_bits as u32) which can truncate on 64-bit platforms; update
the code in stable_bytes (or where rsa_bits is serialized) to perform a checked
conversion using u32::try_from(self.rsa_bits) and propagate or handle the Result
(return an error or panic with a clear message) instead of silently truncating,
or alternatively change the rsa_bits field type to u32 in the struct so no
conversion is needed; ensure you update matching uses of rsa_bits elsewhere
(constructors/decoders) if you change the field type.
- Around line 49-52: Change the default leaf certificate lifetime from 3650 to
365 by updating the default value for leaf_validity_days in the ChainSpec/chain
spec struct initialization (symbol: leaf_validity_days) so leaf defaults align
with util.rs expectations for "good leaf certs"; also update the corresponding
test that asserts the default leaf validity (the test referencing the ChainSpec
default) to expect 365 instead of 3650. Ensure any documented comments or
constants referencing 10-year leaf validity are amended to reflect the new
365-day default.

In `@crates/uselesskey-x509/src/negative.rs`:
- Around line 85-97: The two functions corrupt_cert_pem and truncate_cert_der
are thin wrappers that simply call uselesskey_core::negative::corrupt_pem and
uselesskey_core::negative::truncate_der with identical signatures; replace the
wrappers with direct re-exports so callers can use the domain-specific path
without indirection: remove the corrupt_cert_pem and truncate_cert_der functions
and add pub use uselesskey_core::negative::corrupt_pem as corrupt_cert_pem and
pub use uselesskey_core::negative::truncate_der as truncate_cert_der (or
equivalent re-export names) so the same identifiers remain available but now
reference the core implementations directly.
- Around line 47-54: The inline comment for X509Negative::SelfSignedButClaimsCA
is misleading: although spec.key_usage is set to KeyUsage::ca() (so the cert can
structurally sign via key_cert_sign), the real negative condition is that the
cert is self-signed while claiming CA authority without a proper chain; update
the comment next to X509Negative::SelfSignedButClaimsCA (and references to
spec.is_ca / spec.key_usage) to match the description() text by noting that the
certificate is self-signed and claims CA status despite lacking a valid chain,
rather than saying it "can't actually sign anything valid."

In `@crates/uselesskey-x509/src/spec.rs`:
- Around line 206-221: The public methods not_before_duration() and
not_after_duration() expose a lossy unsigned Duration that hides direction from
NotBeforeOffset; fix by either (A) removing these public helpers entirely and
making any remaining helpers private (so callers must use not_before_offset
directly), or (B) redesigning their signatures to return a signed offset or
concrete time (e.g., return a chrono::Duration or an i64/i128 seconds offset, or
compute and return a SystemTime) so the caller can detect future vs past; update
all callers of not_before_duration / not_after_duration accordingly and adjust
docs/tests to reflect the new API; keep the not_before_offset enum usage intact.

In `@crates/uselesskey/examples/jwt_signing.rs`:
- Around line 28-35: The ECDSA and HMAC example blocks call methods that require
the `jwk` feature (e.g., ecdsa_key.public_jwk() and hmac_key.jwk()), so wrap
those blocks with combined cfg guards to require `jwk` in addition to
`ecdsa`/`hmac`; replace #[cfg(feature = "ecdsa")] with #[cfg(all(feature =
"ecdsa", feature = "jwk"))] for the block that uses EcdsaSpec::es256() and
ecdsa_key.public_jwk(), and replace #[cfg(feature = "hmac")] with
#[cfg(all(feature = "hmac", feature = "jwk"))] for the block that uses
HmacSpec::hs256() and hmac_key.jwk().

In `@crates/uselesskey/examples/negative_fixtures.rs`:
- Around line 90-94: Replace the manual open/read_to_string pattern that creates
cert_contents by calling std::fs::File::open(...).read_to_string(...) with a
single call to std::fs::read_to_string(temp_cert.path()).unwrap() and assign its
result to cert_contents; also remove the unnecessary std::io::Read import (the
one on line 11) since read_to_string eliminates that need. This change affects
the code that references cert_contents and temp_cert.path() in
negative_fixtures.rs and should use std::fs::read_to_string for simplicity and
clarity.

In `@crates/uselesskey/examples/tls_server.rs`:
- Around line 59-63: The example creates an expired certificate via
self_signed.expired() but assigns it to a variable (_expired) that's never used;
either drop the binding or print a meaningful field to demonstrate the result.
Update the snippet that calls self_signed.expired() to either remove the unused
_expired binding or to inspect and print a property such as _expired.not_after
(or another relevant field) so the example shows the certificate's expiry and is
informative for readers.
- Around line 24-26: The current println lines slice PEM strings like
&chain.root_cert_pem()[..50], which can panic if the PEM is shorter; replace
those byte-index slices with a safe truncation approach for
chain.root_cert_pem(), chain.intermediate_cert_pem(), and chain.leaf_cert_pem():
either build a preview via chars().take(50).collect::<String>() (preserves
Unicode boundaries) or use .get(..50).unwrap_or(&full_string) to avoid panics,
and then print the resulting safe preview instead of direct byte slicing.
- Around line 49-53: The current prints use fragile byte-slicing
(&self_signed.cert_pem()[..50] and &self_signed.private_key_pkcs8_pem()[..50])
which can panic on multibyte UTF-8; fix by binding the PEM strings to locals
(e.g., let cert = self_signed.cert_pem(); let key =
self_signed.private_key_pkcs8_pem();) and then safely take the first N
characters for display via .chars().take(50).collect::<String>() when formatting
the println! calls for Certificate and Private key so you never index into the
string by bytes.

In `@deny.toml`:
- Line 16: Add an inline comment on the allow = [...] line in deny.toml
explaining why "OpenSSL" is permitted: note that the transitive dependency
uselesskey-aws-lc-rs (and its aws-lc-sys) requires OpenSSL via its license
expression ("ISC AND (Apache-2.0 OR ISC) AND OpenSSL"), so removing "OpenSSL"
would block that dependency; reference those crate names (uselesskey-aws-lc-rs,
aws-lc-sys) and the license string in the comment for future maintainers.

In `@docs/architecture.md`:
- Around line 83-91: Replace the informal phrase "a bunch of" in the "Why
\"variant\"" section (the sentence starting "Variant strings solve a bunch of
test cases cleanly:") with a more formal word such as "several" or "many" so the
sentence reads e.g. "Variant strings solve several test cases cleanly:"; keep
the rest of the paragraph and examples unchanged.
- Around line 121-126: Update the "Planned adapters" section to reflect that
`uselesskey-rustls` and `uselesskey-ring` are included in this PR (their
Cargo.toml and src/lib.rs exist) by either moving them into the main adapter
list or removing the "Planned" heading; additionally add the new adapters
introduced here (`uselesskey-rustcrypto`, `uselesskey-aws-lc-rs`) and reformat
entries to use backticks and short descriptions (e.g., `uselesskey-rustls` —
returns `PrivateKeyDer` / `CertificateDer` directly, `uselesskey-ring` — returns
ring's native key types) so the documentation matches the actual crates added in
this change.

In `@docs/release.md`:
- Around line 7-36: The release docs missing the new adapter crates: add
`uselesskey-ring`, `uselesskey-rustcrypto`, `uselesskey-rustls`, and
`uselesskey-aws-lc-rs` to both the numbered publish-order list and the `cargo
publish -p ...` commands in docs/release.md, placing them in the proper
dependency order relative to existing crates (after core/key-type crates and
alongside other adapters such as `uselesskey-jsonwebtoken`), so the final list
and publish commands include all nine original crates plus these four adapters
in correct build/publish order.

In `@docs/roadmap.md`:
- Around line 42-52: The roadmap's "X.509 — cert chains and negative fixtures"
section is still under Planned but the PR claims "three-level chains, CRLs, and
negative fixtures" are implemented; update the document by moving the entire
"X.509 — cert chains and negative fixtures" heading and its two checklist items
("Cert chain fixtures" and "X.509 negative fixtures") into the Implemented
section (or mark each checkbox as completed), ensuring the sub-items (Root CA →
Intermediate → Leaf, Deterministic serial numbers, Expired certificates, Wrong
SAN, Unknown CA, Revoked cert) are either checked off or removed from Planned so
the roadmap and the PR summary are consistent.
- Around line 54-61: The roadmap is missing the new adapter crate; add a checked
Implemented entry for uselesskey-rustcrypto in the Implemented section: include
a bullet "- [x] **`uselesskey-rustcrypto`**" with two sub-bullets "RustCrypto
key conversions" and "Native key types for RustCrypto ecosystem users" so the
crate is listed alongside the other adapter crates (refer to the existing
adapter entries like `uselesskey-rustls` / `uselesskey-ring` for formatting).
- Around line 54-61: The roadmap incorrectly leaves the adapter crates under
"Planned"; move the three entries for `uselesskey-rustls`, `uselesskey-ring`,
and `uselesskey-aws-lc-rs` from the "Adapter crates"/planned list into the
"Implemented" section and mark their checkboxes complete (change "- [ ]" to "-
[x]") and keep their existing descriptions (including "Returns
`rustls::pki_types::PrivateKeyDer`, `CertificateDer`" and "Native key types for
`ring` and `aws-lc-rs` users") so the docs reflect that these new adapter crates
were added in this PR.
- Around line 32-38: The roadmap's X.509 entry is out of date: update the "X.509
leaf certificates" section for the uselesskey-x509 crate to reflect that
three-level chains, CRLs, and negative fixtures are implemented in this PR (in
addition to the existing self-signed certs and X509FactoryExt), so mark those
items as completed and remove them from the "Planned" list (ensure references to
"three-level chains", "CRLs", "negative fixtures", and "X509FactoryExt" are
moved to the checked/implemented items).

In `@xtask/src/main.rs`:
- Line 152: Extract the duplicated hardcoded path "target/xtask/receipt.json"
into a single constant (e.g., const RECEIPT_PATH: &str =
"target/xtask/receipt.json") and replace all direct uses with that constant
where receipt::Runner::new(...) is called; update the five call sites named
ci(), feature_matrix_cmd(), coverage(), publish_preflight(), and pr() so each
uses RECEIPT_PATH instead of the literal to keep them in sync.
- Around line 709-784: walk_for_blobs currently recurses directories unbounded
and will follow symlink loops; fix by preventing infinite recursion: add either
a depth limit parameter to walk_for_blobs (e.g., max depth 50) and return early
when exceeded, or detect and skip symlinked directories by checking
entry.file_type().is_symlink() (and/or entry.metadata().is_dir()) before
recursing; you can also maintain a visited set of canonicalized paths
(HashSet<PathBuf>) to skip already-seen directories. Update walk_for_blobs
signature (and callers like find_secret_blobs) to accept the new depth/visited
parameter(s), and ensure is_ignored_dir still applies after resolving whether an
entry is a real directory (use entry.path()). Keep error contexts (with_context)
intact.
- Around line 895-1057: Tests mutate environment with unsafe
env::set_var/remove_var and manually call restore_env, which can leak env
changes on panic; implement an RAII EnvGuard (referencing ENV_LOCK and
restore_env behavior) that captures previous XTASK_BASE_REF and GITHUB_BASE_REF
on creation and restores them in Drop, then replace the manual
prev_*/restore_env pairs in resolve_base_ref_* tests with EnvGuard instances so
env is always restored even if the test panics; keep the existing ENV_LOCK usage
to serialize tests.
- Around line 846-893: The dep_guard function currently bails whenever any
unique rand_core version string is collected from `cargo tree --duplicates`;
change the check so it only errors when multiple distinct versions are present
(i.e., require versions.len() >= 2 to bail). Concretely, in dep_guard, keep the
existing parsing that fills the versions Vec<String>, but replace the final
if/else that bails on non-empty with a check on versions.len(): if 0 -> print ok
and return Ok(()), if 1 -> treat as ok (optionally log the single version) and
return Ok(()), and only construct the error message and bail when versions.len()
>= 2; reference symbols: dep_guard, versions, and the final bail block that
formats and joins versions.
- Around line 598-626: In run_impacted_tests remove the dead second check that
tests for "uselesskey-bdd": the targets Vec is already filtered for that name,
so delete the if name == "uselesskey-bdd" { continue; } guard inside the for
name in targets.drain(..) loop and keep the step creation (step_name and
runner.step closure) as-is; this removes unreachable code and avoids redundant
checks.
- Around line 151-193: run_ci_plan currently always runs the mutants and fuzz_pr
steps which will bail if their tools are missing; add availability checks like
the existing is_llvm_cov_installed() check and skip those steps when tools
aren't installed. Concretely, in run_ci_plan wrap runner.step("mutants", None,
mutants)? and runner.step("fuzz", None, fuzz_pr)? with if
is_cargo_mutants_installed() { runner.step(...)? } else { runner.skip("mutants",
Some("cargo-mutants not installed".into())); } (and similarly for fuzz_pr using
an is_cargo_fuzz_installed() check and runner.skip("fuzz", ...)). Ensure the
skip messages match the coverage pattern and that no bail! from mutants/fuzz_pr
can escape when the check indicates the tool is missing.

In `@xtask/src/plan.rs`:
- Around line 105-114: The boolean expression in is_rust_code_change relies on
&& binding tighter than || which hurts readability; parenthesize the crates
branch to make precedence explicit: wrap (path.starts_with("crates/") &&
(path.contains("/src/") || path.contains("/tests/"))) so it's obvious that the
crates check and its src/tests conditions form one unit, leaving the other
starts_with checks as separate alternatives.
- Around line 38-43: The compound conditional that sets bdd_feature_changed is
correct but unclear; update the if in plan.rs (the block that references
variable bdd_feature_changed and uses path) to add explicit parentheses around
the last conjunct — e.g., wrap (path.ends_with(".feature") &&
path.contains("features/")) — and optionally group the OR terms with parentheses
so the intent is obvious when scanning the condition.
- Around line 148-206: In the dependents function the mapping for
"uselesskey-bdd" is self-referential ("uselesskey-bdd" => &["uselesskey-bdd"])
which is redundant and misleading; update the dependents function to return an
empty slice for the "uselesskey-bdd" key (i.e., replace the self-reference with
&[]) so the dependents table accurately reflects no dependents for
uselesskey-bdd while leaving other entries (e.g., "uselesskey-jwk") unchanged.

In `@xtask/src/receipt.rs`:
- Around line 9-31: StepReceipt::status and FeatureMatrixEntry::status are plain
Strings; replace them with a serde-friendly enum (e.g., enum Status { Ok,
Failed, Skipped } with #[derive(Serialize, Deserialize)] and #[serde(rename_all
= "lowercase")]) to enforce allowed values; update the structs Receipt,
StepReceipt, and FeatureMatrixEntry to use this Status enum, adjust any
construction sites and serialization usage, and update the summary() logic to
match on Status variants instead of string comparisons so exhaustiveness is
enforced by the compiler.
- Around line 63-96: The timing uses start.elapsed() twice causing inconsistent
durations; capture the elapsed Duration once at the start of each match arm and
reuse it for both the printed seconds and the StepReceipt duration_ms. In both
the Ok and Err branches of the function (the block that prints "==> {name}" and
pushes StepReceipt onto self.receipt.steps), call let elapsed = start.elapsed();
then compute secs from elapsed.as_secs_f64() and duration_ms from
elapsed.as_millis() as u64, replacing the duplicate start.elapsed() calls so the
log and StepReceipt use the same measured duration.