Summary

• Adds a JSON Schema for installed bundle audit receipts.
• Adds reference docs for stable fields, check objects, failure classes, and machine-readable CI boundaries.
• Advances the active downstream CI polish goal from bundle-audit-json-schema to audit-bundle-ci-policy.

Files added/changed

• docs/schemas/bundle-audit.schema.json
• docs/reference/bundle-audit-json.md
• .uselesskey/goals/active.toml

Validation

• powershell JSON parse for docs/schemas/bundle-audit.schema.json
• cargo test -p uselesskey-cli --all-features audit_bundle
• cargo xtask docs-sync --check
• cargo xtask typos
• git diff --check

Non-goals

• No CLI behavior change.
• No release prep, version bump, tag, publish, new contract pack, or badge.
• No provider compatibility, production security, or scanner-evasion claim.

What this enables next

• Downstream CI can target a documented audit receipt shape before the lane adds CI policy controls.