0.52.0 — the verify command was the one shell nothing watched

A release about things this project was saying that were not true, and the guards that will not let them come back.

The verify command was the one shell nothing watched

CommandVerifier ran its string with shell=True on the host — outside the kernel, the taint ledger and the host-exec gate, all of which wrap tools. And that string does not have to come from you: when a run omits it, the command is inferred from the repository's own package.json, Makefile or pyproject.toml, and it can equally come from a cron job, a kanban card or a workflow file. It is the exact shape arXiv 2609.03884 used to compromise all seven agent harnesses it evaluated.

It now runs in the same sandbox as the agent's own shell. A command that was not typed by you passes the CHIMERA_HOST_EXEC gate; declined, it abstains rather than failing the attempt, so the loop's other evidence decides. CHIMERA_VERIFY_NETWORK=1 exists for a verifier that needs the network and says plainly that such a verifier runs on the host, and only when you typed it.

Two guards keep it shut: no shell=True anywhere in chimera/ outside chimera/sandbox/, and no CommandVerifier built without saying who authored its command. chimera/eval/selftest.py, the last exempted caller, went the same way.

This came out of an audit — docs/audits/sleeper-channels.md — that traces every path by which text written earlier runs later with different authority: hooks, cron, skill cards, memory, MCP manifests, project state. Each channel gets a verdict and a file:line. Hooks are closed. Two were open, and one of them is fixed here.

The ledger records who asked for a read — and the measurement says not to believe it

Matched triples measured, offline, that the taint gate escalates a write whose value came from a tool result you asked for exactly as it escalates the attack: 10/10 against 10/10, byte-identical. It reacts to provenance while claiming to judge authority, and the false-positive rate on legitimate flows is 100%.

So CapabilityEvent now records requested_by, and CHIMERA_TAINT_AUTHORITY=authority lets the narrowing overlook a read you asked for. It takes the false-positive rate from 100% to 10% — and lets six of seven attacks through when you ask the agent to summarise the poisoned page, because the flow matcher only sees verbatim references and whole snippets, and send_* has no rule at all.

The mode ships off. The pre-registered prediction held on every line, bench/injection/RESULTS.md says what would make it adoptable — authority by value, not by read — and default behaviour is byte-identical, proved by diffing three verdict dumps.

A number this project had already retracted was still published in nine languages

docs/benchmarks.md dropped the 69% vs 57% precision claim in August, because run 4 contradicted it. The nine translations kept it, along with an n=19 warning scoped to a single run and, in Chinese, four runs described as one frozen 19-instance slice.

All 99 translated pages are now current — and the reason they were not is worth stating: earlier commits had translated all nine languages and never refreshed the source_sha256 each file declares. The mechanism to catch that existed since the translations were written; nothing read it. Now something does, and the allowlist it was born with is already empty. Sixty-three relative links that pointed at nothing — copied verbatim from English pages two directories up — are fixed, with a guard that resolves every link from the file that carries it.

The test suite was running with your own .env loaded

Importing litellm runs load_dotenv(), whose search walks up to the .env beside pyproject.toml. A real API key entered the environment of every test process, while tests/conftest.py asserted in prose that the developer's .env never leaks into the suite. Closed, with a control proving the leak was real.

Alongside it: 352 tests left os.environ dirty, and an autouse guard now fails any test that does. The count only came out right after the probe was fixed — without restoring the environment between tests it masked all but 23 of them.

Also in this release

• A single run is a sample, not a measurement. chimera.eval.replicated reports pass^k, the per-task flip rate, ICC(1), and scores only the trials where the mechanism under test actually fired. It says beside the confidence interval whether the difference is inside the arms' own noise floor — the shape one survey found in seven of ten published multi-agent architectures.
• A failure has a class before it has a retry. Eight classes, each with the evidence it fired on, recorded on every attempt receipt. chimera solve --recovery targeted briefs the retry on the class; the default is byte-identical to before, proved by two frozen strings.
• A run can be told to stop at a number (--max-usd), says how it ended, and reports what it paid per unit of delivered work.
• ollama_chat/ is the local default. ollama/ goes through Ollama's generate endpoint, which cannot call tools — measured offline across every provider route, along with the round-trip fidelity of tool calls on each.
• A retry is not an independent draw, measured on this install's own receipts: the second attempt recovers 4 of 21 where independence predicts 12.5.

Full detail, including what each measurement cannot show, is in CHANGELOG.md.