v0.7.0 — The audit fails closed

Integrity hardening. v0.1–v0.6 proved the tool can do a lot; v0.7 proves it knows when it must not quietly keep going. No new lanes — every change makes an existing verdict harder to fool. Driven by an external code review of v0.6.0 (all findings reproduced) plus our own audit of the same code.

One pagination discipline

A single fail-closed collector (pagination.py) replaces four ad-hoc cursor walkers with three different page ceilings. Every lane now audits every page of tools, resources and prompts — a prompt-injection tool hidden on page 2 is seen exactly like one on page 1. Repeating cursors and mid-walk failures are explicit outcomes, never silent truncation. Prompts gained the pagination check the other surfaces always had (PROMPT-04, MUST). Check counts: 32 modern · 27 legacy · 6 security.

Fixture-set integrity gate

Before anything replays, verify_fixture_set recomputes every contract hash and verifies the manifest fingerprint. A listed fixture missing from disk, a fixture edited after recording, a tampered manifest fingerprint, duplicates, stale unlisted files, or a missing manifest each fail the gate — previously they were silently skipped, alphabetized, or replayed out of order. (v0.7.2 later tightened this further: unverifiable baselines fail closed instead of replaying with a note.)

Fixture schema v4

Every content part recorded in full — v3 collapsed non-text parts to their type, so a completely different image replayed as OK; binary payloads become {sha256, bytes} digests. Sequence-prefixed filenames stop same-tool-same-args overwrites, and the manifest fingerprint is order-sensitive: save→get and get→save are different contracts.

Verdicts that respect machines and evidence

Any value change in structuredContent — or in text that parses as JSON — is at least VALUE and fails the gate; "approved"→"denied" can never pass as COSMETIC. Number comparison uses Decimal. Argument synthesis validates every candidate before calling (skipped_synthesis reported); negative probes prove their baseline valid first. TOOL-06 split into static MUST + dynamic TOOL-08 (unobservable → SKIP with the reason, never a silent pass); TOOL-07 reports a hang as a hang, not as rejection. The security walker resolves $ref/allOf and descends nested schemas — config.shell.command can't hide one level down. MSSS gained the partial status so clean-but-indirect evidence can never claim met.

Two fingerprints (report schema v2)

behavior_sha256 covers check/replay verdicts and protocol facts only — reproducible across machines; run_hash additionally freezes auditor version, launch command and evidence text.

30 new adversarial tests (page-2 violations, cursor loops, every fixture-tampering vector, image-payload drift, float-folding, deep-schema injection) · 107 total · CHANGELOG.md

Backfilled release notes — condensed from the CHANGELOG entry of the same date.