Phase 3: vault MCP server with execution-time evidence revalidation

package.json

@@ -17,5 +17,9 @@
     "typecheck": "tsc --noEmit",
     "lint": "biome check .",
     "format": "biome format --write ."
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "zod": "4.4.3"
   }
 }

src/contract/findings.ts

@@ -43,4 +43,7 @@ export type FindingCode =
   | "value_out_of_domain"
   | "candidate_malformed"
   | "contract_hash_mismatch"
-  | "output_hash_mismatch";
+  | "output_hash_mismatch"
+  // vault execution-time revalidation: the stored candidate no longer matches
+  // what the vault can reproduce from its own data
+  | "evidence_mismatch";