[m1ngshum]

Audit's existing output does not provide a versioned inventory/completeness contract, so automation cannot reliably distinguish an empty mcpm store from an incomplete assessment. Add the explicit CLI-only mcpm audit --report-json opt-in while preserving legacy JSON (including empty-inventory text and fix wrappers), SARIF, served MCP audit results, scoring and safety gates.

The version-1 report identifies its mcpm-store/latest-metadata scope, selected checks and exclusions; retains valid siblings beside inventory or registry failures; and separates empty inventory, findings, no findings and incomplete assessment. Reuse the bounded strict reader, with fixed diagnostics and reduced findings that omit raw values. Report mode rejects mutation/other-output flags. Configured external scanners retain their existing explicit execution behavior; this is not installed-code, whole-host or native safety evidence.

This is a bounded first slice of project backlog IDs #131/#149, which remain open for broader client-read coverage. Update the report/CLI/agent contracts, public usage skill 1.3.2, relevant backlog/maintainer docs and Obsidian. Homepage, remaining-docs cleanup and #331 remain separate.

Sol implemented; Astra independently reviewed and guided fixes for strict bounded input, scope/privacy and registry response identity. Original feature head: 90b05e7572fca9272d80206d5a8280b6fd920a9c. Integrated current main at ca5d499898f2fbeb8ecb5718e9acca38b395ff95; Astra independently verified identical runtime/package/lock/skill bytes and preservation of unrelated main files. Fresh exact-head CI is required before merge.

Validation:

• Typecheck/build and full suite: 3,905 passed, 3 skipped; 102 focused builder tests and 249 independent reviewer tests passed.
• Exact candidate clean-install with strict engines and lifecycle scripts disabled; all 66 installed runtime JS files match the archive and built candidate.
• 44 public-CLI executions passed, including eight exact stdout/stderr/exit comparisons against independently built base 1907f66 for legacy empty/valid JSON, text, SARIF and fix-JSON. New cases cover partial/failed evidence, scanner output, malformed/future/duplicate stores, special files, privacy and invalid flags; report fixtures remain unchanged and no configured synthetic server launches.
• 64 Markdown files / 280 local references: no new broken links; public skill frontmatter and diff whitespace pass.

Limits: fixed mcpm-store inventory and latest publication metadata only; no installed-byte, client discovery, health, native/provider/model proof or release authentication. No Obsidian visual rendering or exhaustive external-link check. No merge or release included.