Summary

• The runtime bundle profile's scanner-safe predicate only inspected the artifact kind, so RSA / ECDSA / Ed25519 entries emitted as public JWKs (no d / p / q / seed bytes) were still recorded as scanner_safe: false in manifest.json and receipts/audit-surface.json.
• After this fix, runtime_entry_is_scanner_safe(kind, format) considers both: public-shaped formats (Jwk/Jwks) for asymmetric kinds are scanner-safe, while Pem/Der private bytes, HMAC k, and token values remain non-scanner-safe.
• For uselesskey bundle --profile runtime --format jwk, the audit surface now reports runtime_material_count: 2 (just hmac + token) instead of 5.

Reproduction (before)

$ uselesskey bundle --profile runtime --seed test --label svc --out /tmp/b
$ jq '.artifacts[] | {path,kind,format,scanner_safe}' /tmp/b/manifest.json
{ "path":"rsa.jwk.json",     "kind":"rsa",     "format":"jwk", "scanner_safe":false }   # public-only RSA JWK ⇒ should be true
{ "path":"ecdsa.jwk.json",   "kind":"ecdsa",   "format":"jwk", "scanner_safe":false }   # public-only ECDSA JWK ⇒ should be true
{ "path":"ed25519.jwk.json", "kind":"ed25519", "format":"jwk", "scanner_safe":false }   # public-only Ed25519 JWK ⇒ should be true
{ "path":"hmac.jwk.json",    "kind":"hmac",    "format":"jwk", "scanner_safe":false }   # has secret `k` ⇒ correct
{ "path":"token.json",       "kind":"token",   ...,            "scanner_safe":false }   # has token value ⇒ correct

After

rsa.jwk.json     scanner_safe=True   # public only
ecdsa.jwk.json   scanner_safe=True   # public only
ed25519.jwk.json scanner_safe=True   # public only
hmac.jwk.json    scanner_safe=False
token.json       scanner_safe=False

The PEM/DER path is unchanged (uselesskey bundle --profile runtime --format pem still marks RSA/ECDSA/Ed25519 PEM artifacts as scanner_safe: false).

Test plan

• cargo test -p uselesskey-cli (all 26 + 1 new integration + 5 + 4 + 4 + 3 + 6 tests pass)
• cargo clippy -p uselesskey-cli --all-features --tests -- -D warnings
• cargo fmt --check
• New unit test runtime_public_jwk_outputs_are_scanner_safe covers the kind × format matrix.
• New integration test bundle_profile_runtime_jwk_marks_public_key_artifacts_scanner_safe exercises the full bundle flow and asserts the audit-surface runtime_material_count.

Generated by Claude Code