Summary

• emits required metadata-only bundle product receipts: bundle-verification, scanner-safety, and negative-coverage
• requires those receipts in verify-bundle, audit-bundle, external-adoption smoke, and scanner-safe reference checks
• updates scanner-safe reference metadata, golden audit snapshots, current how-tos, SPEC-0011/0015/0017, and the active real-workflow goal

User path

A downstream user who generates a scanner-safe, TLS, OIDC, or webhook bundle now gets receipts that explain local verification, scanner-safety classification, and negative fixture coverage without copying generated payloads.

Boundary

This proves local bundle consistency and metadata classification only. It does not prove repo public claims, release readiness, provider compatibility, production security, scanner evasion, or downstream verifier correctness. It does not add profiles, contract packs, badges, release prep, tags, or publishing.

Proof

• cargo +nightly fmt --all -- --check
• cargo +nightly test -p uselesskey-cli --all-features bundle
• cargo +nightly test -p uselesskey-cli --all-features verify_bundle
• cargo +nightly test -p uselesskey-cli --all-features audit_bundle
• cargo +nightly test -p xtask external_adoption_smoke
• cargo +nightly clippy -p uselesskey-cli --all-targets --all-features -- -D warnings
• cargo +nightly xtask spec-check --strict
• cargo +nightly xtask docs-sync --check
• cargo +nightly xtask typos
• cargo +nightly xtask external-adoption-smoke --path .
• cargo +nightly xtask scanner-safe-reference --check
• cargo +nightly xtask no-blob
• cargo +nightly xtask adoption-regression --external
• cargo +nightly xtask pr-lite
• cargo +nightly xtask pr
• git diff --check

Risk / rollback

The diff changes generated bundle metadata and committed reference receipts, not fixture payload identity. It should be revertable as one bundle-receipt slice before later task-first docs or public-surface work depends on the new receipt contract.