The third external review found the same class of hole in two places: things the tool said that its fingerprints didn't cover. Both were reproduced as live attacks before being fixed — and both attacks now live in the test suite.
Report schema v3 — verify covers the whole document
The v2 run_hash was a curated field list; the verdict banner, audit status, summary counters, MSSS table and next steps were all editable without breaking mcp-proof verify — a report edited to claim "99/99 MUST · SHIP-READY" verified as intact. The v3 hash is built by subtraction instead: the whole model minus its two fingerprints and the volatile observation block, so a field added later is fingerprinted by default rather than silently joining the editable set. Stored v2 reports still verify under their frozen recipe with an explicit coverage note; flipping the version field defeats itself; schemas newer than the tool are refused. verify is now described as what it is — an internal-consistency check, not a signature (attestation stays on the roadmap).
Hash-stripping no longer disarms the integrity gate
Deleting a single fixture's contract_sha256 inside a current v4 set used to skip its per-fixture check and the whole set's aggregate fingerprint — zero warnings, tampered baseline replayed as truth. Hash requirements now key off the manifest's schema version: in a v3+ set, a hashless fixture is an integrity ERROR like any other tamper. Baselines that predate contract hashing fail closed with re-record instructions; --allow-legacy-fixtures opts in explicitly (on run and replay).
Integrity failures abort — they don't impersonate drift
replay() raises FixtureIntegrityError before the server is even launched. The missing-manifest "best-effort replay" is gone: with no trusted order, stateful sequences replay wrong and manufacture false drift.
One exit-code taxonomy, CLI-wide
Anything escaping a command is one stable line and exit 2 — never a traceback, and never exit 1 for something that isn't target behaviour (MCP_PROOF_DEBUG=1 re-raises for debugging). replay now agrees with run that a missing baseline is exit 2.
Also in this release: a truth pass over both READMEs (verify wording, MSSS described precisely as a 24-entry control matrix — 23 fully documented controls plus the MCP-DEPLOY-04 placeholder), a corrected report footer, and all four demo reports regenerated with the 0.7.2 engine.
140 tests (21 new adversarial tests in tests/test_v072.py) · 3-OS × 3-Python CI green · full details in CHANGELOG.md