Summary

• Add cargo xtask user-path-smoke as a bounded first-run adoption check.
• Exercise scanner-safe, TLS, OIDC, and webhook bundle generation plus verify-bundle.
• Build a webhook-focused metadata-only verification pack and advance the active goal to lane closeout.
• Refresh the generated ripr+ badge endpoint for the added xtask tests.

Files added/changed

• xtask/src/user_path_smoke.rs
• xtask/src/main.rs
• .uselesskey/goals/active.toml
• badges/ripr-plus.json

Validation

• cargo xtask fmt --fix
• cargo test -p xtask user_path_smoke
• cargo xtask user-path-smoke
• cargo clippy -p xtask --all-targets -- -D warnings
• cargo xtask pr-lite
• cargo xtask badges --check
• git diff --check

Generated smoke artifacts were removed from target/user-path-smoke, target/release-evidence/webhook, and target/claim-proof/webhook-contract-pack after validation.

Non-goals

• No new fixture profile or public claim.
• No release evidence widening.
• No generated payloads committed.
• No README badge additions.

What this enables next

• The first-run UX lane can close with a concrete adoption smoke command covering the visible bundle and reviewer-proof paths.