[Spectorian]

Add a repeatable CLI/stdio MCP consumer check and a dated observation of the installed wheel built from e48d771a26f7398b36256ceb8d8f94adce3d5c44. Link the procedure from the README.

The report records artifact identity, exact controlled inputs, CLI exits, real MCP initialization/discovery/invocations, and the integrating agent's interpretation. It demonstrates that default exit 0 can accompany incomplete CAUTION analysis, and that a HIGH P1 finding can coexist with an aggregate SAFE score. Requested-but-unavailable LLM analysis is kept separate from intentional static-only scanning, including the CLI/MCP differences. Scanner and output contracts are unchanged.

Validation:

• All 148 package files matched source, wheel, and installed copy; wheel SHA-256 and environment versions recorded.
• 12 CLI observations matched the expected gate behavior across four controls and three exit modes.
• Four real stdio MCP calls completed; seven client frames and six server frames were valid JSON-RPC, with matched IDs and scanner exit 0.
• Both documentation examples ran: fixture hashes matched, and the SDK example completed four additional real MCP calls with matching verdicts.
• Markdown rendering, local links/anchors, and whitespace checks passed.

The missing-credential control intentionally produced failed/partial analysis. This is a bounded observation of one artifact/client/transport, not full CI, scanner-accuracy, or live-provider validation. No fixtures were installed or executed.