v0.7.1 — The auditor knows when it cannot conclude
Release hardening. v0.7 taught the audit to fail closed on bad data; v0.7.1 teaches it to fail closed on itself. Driven by a second external review (release-management focused) — every claim verified against the code before implementation.
An auditor bug is never a target verdict
_safe now swallows only genuine transport failures; any other exception in check logic surfaces as an AUDIT INCONCLUSIVE outcome instead of being converted into "could not start probe" and charged to the target. Exit codes form a taxonomy: 0 passed · 1 the audit completed and the target failed it · 2 the audit did not complete and proves nothing — in either direction. The JSON model and SARIF carry audit.status; the HTML renders an inconclusive banner that blames nobody.
Baselines fail closed
run --fixtures no longer records a baseline implicitly when none exists — a gate that can silently regenerate its own contract is not a gate. Missing baseline → exit 2 with instructions; --record-if-missing opts in explicitly, and a baseline recorded in the same run labels itself "baseline recorded this run — no historical comparison" instead of posing as a regression verdict.
mcp-proof verify report.json
The JSON model is self-contained, so both fingerprints are recomputable offline; verify exits 1 on any post-audit edit, and a flipped verdict vs. a rewritten evidence string are caught by different fingerprints — the output says which. (v0.7.2 later widened the run fingerprint from a curated field list to the whole document.)
Wording now matches the gate
"Zero security findings" overstated a gate that only blocks FAILs; README (both languages) and the verdict banner now say no blocking security findings. A new evidence-scope card states on the first screen what the report proves and what it never assesses (deployment, source, process, authorization); on a failing report, "Recommended next steps" moves above the detail tables.
Also: README restructured (Validation section, Current/Next/Later roadmap, positioning vs. the official conformance suite), --version, Windows Chrome discovery for --pdf. 119 tests.
Backfilled release notes — condensed from the CHANGELOG entry of the same date.