Summary

TLS contract-pack and public crate-surface cleanup release. Bumps workspace from v0.7.x to v0.8.0.

What's new

TLS contract pack

• `uselesskey bundle --profile tls` produces a deterministic chain fixture with 4 negative classes (expired leaf, not-yet-valid, hostname mismatch, untrusted root). Per-fixture rejection expectations: `docs/release/v0.8.0-tls-profile-design.md`. (docs: define TLS contract-pack profile #585, feat(cli): add tls bundle profile #587)
• `cargo xtask bundle-proof --profile tls` produces the release-evidence proof artifact mirroring the OIDC pack. (xtask: add tls contract-pack proof #588)
• Task-first how-to: `docs/how-to/test-tls-chain-validation.md`. (docs: add TLS chain-validation how-to #589)

Task-first user docs sweep

Five new how-to pages: Vault KV export (#590), build.rs materialize (#591), WebAuthn ceremony validation (#592), PKCS#11 mock fixtures (#593), webhook signature validation (#594).

Public crate-surface cleanup

29 published-internal shim crates removed. v0.7.0 folded their content into owner crate `srp::*` modules; v0.7.x kept the shims as compatibility re-exports; v0.8.0 removes them entirely. The v0.7.x crate versions remain on crates.io as historical records.

• HMAC fold: `uselesskey-core-hmac-spec` -> `uselesskey-hmac::srp::spec` (refactor(hmac): fold core-hmac-spec content into uselesskey-hmac::srp::spec #595)
• rustls fold: `uselesskey-core-rustls-pki` -> `uselesskey-rustls::srp::pki` (refactor(rustls): fold core-rustls-pki content into uselesskey-rustls::srp::pki #598)
• PGP fold: `uselesskey-pgp-native` -> `uselesskey-pgp::native` (feature `native`) (refactor(pgp): fold uselesskey-pgp-native content into uselesskey-pgp::native #599)
• Shim deletion: 29 crates removed in chore(workspace): remove folded internal shim crates #602
• Migration guide: `docs/how-to/migrate-to-v0.8.md` (docs: add v0.7.x to v0.8.0 crate-surface migration guide #603)

Publish-system hardening

• Clippy 1.94/1.95 ratchets activated workspace-wide (8 lints). (policy: activate Clippy 1.94/1.95 ratchets #505)
• 8 dependabot bumps: blake3, tokio, clap, tonic, cucumber, rustls-pki-types, signature, codecov-action.

Toolchain

No MSRV change. v0.8.0 stays on Rust 1.95.

Claim boundary

`uselesskey` is a test-fixture layer. It is not production key management, scanner evasion, or cryptographic assurance.

Validation

Local validation (worktree):

• `cargo xtask public-surface` — ok
• `cargo xtask docs-sync --check` — ok
• `cargo xtask publish-preflight` — ok
• `cargo xtask publish-check` — ok

CI will run the full `xtask pr` lane (bdd, full test matrix, fuzz build, clippy, etc.) plus the rest of `release-evidence --version 0.8.0 --summary` (TLS contract-pack proof, scanner-safe proof, OIDC proof, economics, audit-surface, perf, mutants-nightly --scope public). The local lane couldn't complete the fuzz build because the agent ran from a worktree where `cargo fuzz` resolves `fuzz/Cargo.toml` against the main-checkout workspace root.

Post-merge

1. Tag v0.8.0 on the merge commit and push the tag.
2. `release.yml` runs end-to-end with `cargo xtask publish`.
3. Verify all 22 publishable crates land at 0.8.0 on crates.io.
4. `gh release edit v0.8.0 --notes-file <$TEMP/v0.8.0-release-body.md>` to swap in the hand-written body.
5. Run `cargo xtask cratesio-smoke --version 0.8.0` post-publish to prove the registry user path.
6. Complete the v0.8.0 post-release audit per `docs/release/post-release-audit.md`.

References

• v0.7.0 retrospective: `docs/release/v0.7.0-lessons-learned.md`
• Publish recovery procedures: `docs/release/publish-recovery.md`
• v0.7.x -> v0.8.0 migration guide: `docs/how-to/migrate-to-v0.8.md`

Test plan

• CI green (preflight + pr full lane)
• No publish=false dep regression (xtask: reject versioned workspace deps on publish=false crates #578 guard catches it)
• All 22 publishable crates show at 0.8.0 post-publish
• docs.rs builds queued/complete for the facade