v1.5.3.1 — the v1.5.3 tarball did not pass its own gate

No runtime code changes — the plugin behaves identically to v1.5.3. What changed is that the artifact you install now verifies itself.

Why this exists

make ci run against git archive v1.5.3 — the tarball users actually install — failed four tests. All four were environment artifacts, not defects: every cited file was present in the tarball, and the checks were asking git questions of a tree that is not a git repository.

This project treats a red that carries no information about the thing it claims to check as a defect in its own right — the same rank it gives a false green. So it is fixed rather than explained away.

• A citation check built its file set from git ls-files, which returns empty outside a work tree. Three cited files were reported "not in the repository" while all three shipped. Now derived from git when the tree is a work tree and from the filesystem otherwise — in a clone the git answer is stronger (tracked implies present) and is preferred; in an export there is nothing to be tracked by, and "the file shipped" is exactly the right question of a release artifact.
• A skip guard named the wrong precondition. It gated on the git binary, but scripts/install.sh deploys the committed HEAD via git archive and refuses without a work tree and a commit. In the export the binary check passed, the installer correctly refused, and the test reported a failure about backup behaviour it had never reached.

And the gap that had no test at all

Nothing pinned the version. make ci passed identically before and after the v1.5.3 manifest bump, so the four places stating the current version were kept in step entirely by hand. A release shipping with README.md still telling users to pin the previous tag would have been green all the way through the gate.

tests/test_version_consistency.py pins the manifest against plugin_meta, the CHANGELOG entry and that it is the newest, README's pinned-install example, AGENTS.md's project line and open-items heading, and references/system-map.md.

It also pins the other half of the rule: historical version prose must survive. Without that, every check above could be satisfied tomorrow by scrubbing older releases out of the record — and this repo treats rewriting history to match today as a defect.

The pin proved itself on its own release: bumping the manifest alone failed five ways until all four sites were brought into step.

Verified

make ci EXIT 0 in a clone and against git archive of the tagged commit — 1706 tests both ways, 41 tracked docs, no drift. scripts/verdict.py still blob 57062e71; floorsynth still exactly 10 blocking emitters.

Everything in v1.5.3 applies unchanged — the live false GREEN it closed, and the two claims it withdrew.

v1.5.3 — a live false GREEN closed, and two of our own claims withdrawn

This release ships more retractions than features, and that is the point. Every number below was executed; the ones that did not survive are struck out rather than defended.

The defect that mattered — a green over unreviewed work

An unresolvable baseline_sha could ship a substantiated-looking green. No attacker required: a deleted branch or a pruned worktree is enough.

difftool.capture never raises and degrades silently — every _tracked_at probe fails, so the whole tracked-modification channel is dropped and diff.patch contains none of the coder's edits to tracked files. It is not empty, though, if the coder also created one new file, so empty_diff_defect stays silent. git_tree_has_baseline fails at the same moment, so out_of_scope_defects is fed [] and the S3(a) control switches off too — while runcheck still executes the modified tree. Six lenses then review a diff holding none of the work.

honest baseline        -> 321 B, contains the coder's edit
unresolvable baseline  -> 146 B, contains none of it, and empty_diff_defect stays silent

This violated THE ONE GUARANTEE and was pre-existing — recorded nowhere until now.

The fix uses information the program already had: git_tree_has_baseline was already computed downstream, purely to gate out_of_scope_defects. It is now consulted where the evidence is taken. No new blocking predicate, no new gate condition, no new terminal, no new function, and scripts/verdict.py untouched — blob 57062e71, byte-identical across six releases.

The guard's condition is narrow on purpose: a two-clause version aborted the documented non-git sandbox lane, where capture produces complete evidence — it manufactured a RED on honest work, which this project ranks as worse than the bug it closes.

Two of our own claims, withdrawn

• Phase 0 — packet by reference, −14.3% cost-weighted. FALSIFIED. Built, run 12× across three targets with same-plugin control pairs, measured +4.0%. The dispatch change ships and works; it simply does not buy what it was built to buy. The whole −24%…−29% resident-bytes cost programme is withdrawn with it: 95.17% of input is cache-read, so removing resident bytes removes the cheapest token class while adding full-price turns.
• The blocking-predicate diagnosis. FALSIFIED by its own committed test — observed 2 of 10, both fires declared as priors before the corpus existed. The second, independent measure points the other way: code diff bytes rank-order the injections exactly (32,139→0 < 39,130→1 < 62,667→7) while predicate delta is anti-ranked.

Reviewed adversarially — and the review caught the fixes too

Two blind judges, three rounds. Terminal state APPROVED, zero CRITICAL from either final judge. The two scoped re-judgments found three real defects in the fixes above, each also closed here — including a pin that passed on its own explanatory prose three separate times.

Rule adopted: pin the call site, or pin nothing.

Open, and named rather than implied

H2 (pre-existing user dirt fires the out-of-scope lens) is designed but deferred, with a 1,276-line six-lens-challenged plan in the repo. R1 (the run's own build output) is real but narrower than we first claimed — --exclude-standard honours .gitignore, so re-measured end to end it is 2 defects, not 7. No ordering between H2 and R1 is claimed. S3: the run mode is undefined. Audit items S1/S2/S6/S8/S11–S13 and S15–S17 remain open.

Full record: docs/superpowers/plans/2026-07-27-honest-red-workstream.md

v1.5.2.1 — six defects that were live in v1.5.2, one CRITICAL

Security hotfix — upgrade immediately

Seven defects were live in the shipped v1.5.2, one CRITICAL. Three of the seven were introduced by v1.5.2's own fixes. Six are closed here; the seventh ships known-open with a workaround and a recorded decision.

⛔ C1 (CRITICAL, self-inflicted) — model-supplied text was executed as Python source

v1.5.2's new validate-and-persist block interpolated a critic's returned text into a source literal:

RAW = r'''<the critic's returned JSON text>'''

A response containing ''' closed the literal and the remainder executed — arbitrary code in the orchestrator's shell, all three critic artifacts forgeable with correct pass stamps, and the exact success token printed. The injection landed before json.loads and before enforce_critic_schema, so v1.5.2's own new validation was bypassed, not defeated.

Pointed the honest way it was a false RED: a critic quoting a ''' docstring — which the critic role files instruct it to do — broke the block on a green tree.

The adversarial challenge found four such sinks, not the three first specified — including the scout digest, which carries bytes copied verbatim out of the target repo and so needs no agent's judgment to trigger. All four now take a path in argv, written verbatim by the native Write tool and read with utf-8-sig inside the block's try:. Heredocs are explicitly forbidden as writers: a body containing a line equal to the sentinel closes it early (verified — rc=0, a marker executed, and a silently truncated file).

Also closed

• H1 — a target-controlled filename reached the coder's trusted instruction raw. Git tracks newline filenames, and the target's own build can create one during VERIFIED. Now json.dumps-quoted: reversible, collision-free, and the human can still find the file.
• H3 — the checkpoint prose invited a standalone advance("CODED") after VERIFIED — the exact trajectory v1.5.2's own new fold fires on. An honest 2-pass run that fixed everything ended ⚠️ UNVERIFIED for bookkeeping.
• H4 — a critic could take an orchestrator id and delete its own CRITICAL from the refine loop.
• H6 — an honest crash after advance(REFINE) resumed at OUTPUT and printed a green with the V7-forced refine never run.

⚠️ Two bounded interims — stated, not overclaimed

• H2: the dirty-tree RED is NOT fixed. Only the coder is no longer told to revert files it did not author. Three HIGH defects still emit and both refine passes still burn on an interactive run over a tree where nobody did anything wrong.
• H5 ships KNOWN-OPEN. A second review in one session inherits the first's frozen packet. Workaround: start a new session per review. Its RED is warranted — review #2 genuinely runs review #1's intent and baseline_sha — so what is wrong is the remedy text, never the verdict. Its two pins ship skipped, not deleted, unweakened, as v1.5.3's acceptance gate.

How this was found

Two independent adversarial sources found the seven. Two challengers then attacked the fix plan by execution before any code was written and returned five CRITICALs against the plan itself — including a would-be fourth manufactured RED, and two findings that would have shipped a believed-closed defect. A whole-branch review then mutation-hunted the branch's own new code and reproduced two working evasions after the per-task reviews had passed; both were closed and independently re-proven.

The governing rule — a fix that manufactures a RED on an honest repository is worse than the bug it closes — is why two of the six ship as interims. Verified by execution: every honest ledger shape (CLARIFY present/absent × 0/1/2 refine passes × a crash-resume duplicate of every stage at every position × a ROLLBACK marker at every position) keeps its green.

scripts/verdict.py was never opened — blob 57062e71 identical at both ends. Test suite 1460 → 1578.

Requires Python 3.11+. Install: /plugins install https://github.com/null0xxx/kimi-atlas

v1.5.2 — eight audit findings closed, the ordinary run hardened

Eight confirmed security findings of the nineteen-finding v1.5.1 audit are closed — everything that damages an ordinary, non-attacked run:

• S7 — the semgrep SECURITY floor had silently never fired (--config auto × --metrics off are mutually exclusive). Now p/default, with a real-binary integration test and a hard-asserting sast-floor CI lane. Requires network per scan; offline degrades silently to judgment-only; vendored ruleset open.
• S3 — the reviewed tree equals the executed tree: the ["."] headless default dropped every tracked modification; and changes outside scope_paths (e.g. deleting the covering test) were invisible to all six lenses. Pathspec normalization + capture_full/change_paths + one blocking HIGH per out-of-scope file (gated, residue-excluded, no-delete fix text).
• S4 — a critic's judgment is validated where it is produced: raw-critic schema validation before persistence (never persist a failure) + dimension_dissent_defects, so a dissent without a blocking defect can never merge as a clean lens.
• S5 — critic artifacts are pass-stamped; a stale CLEAN artifact can no longer read as a fresh lens.
• S10 — stage order is folded at OUTPUT before final_status; a tree mutated after verification cannot print a stale green.
• S9 + S18 — timeout_s is a real bound (grace-bounded drain + named-unit cgroup teardown) and a timed-out suite is never green.
• S14 + E3 — revert_red (a constant with no producer) is out of the critic packet; V7 un-narrowed to name the deterministic floor.

Honestly NOT closed here: S1/S2/S8/S11/S12/S13 land in v1.5.3; S15/S16/S17 in v1.5.4. The new pass-stamps are a currency marker, not authenticity (attacked S5/S10 halves close with v1.5.3 R1/R2). S6 is not fully closed by this program — python3 -S (v1.5.3) closes only the auto-exec half; full closure needs a plugin-integrity mechanism (a design problem, not a patch). See the CHANGELOG for the full honest list.

make ci EXIT 0 · 1327 → 1460 tests · scripts/verdict.py never opened.

v1.5.1 — close the sys.path hijack of the pure gate

Security release — upgrade immediately

A target repository could replace any module atlas imports, including the FROZEN pure gate scripts/verdict.py.

During an atlas run the working directory is the target project — untrusted by design — and CPython puts that directory at sys.path[0] ahead of every PYTHONPATH entry, for both -c and heredoc invocations. Reproduced end-to-end by two independent reviewers, running the SKILL's Step-4+5 block as literally written against a hostile target on a genuinely RED build:

	provisional_status	module actually imported
v1.5.0	"OK", blocking: []	the target's verdict.py
v1.5.1	"UNVERIFIED", 6 blocking	the plugin's

v1.5.0 printed ✅ VERIFIED on a build with three CRITICAL defects. That defeated invariant 2 (the pure gate) and THE ONE GUARANTEE.

Why it survived testing: the target's scripts/ must contain __init__.py. Without it the directory is only a namespace portion, the path scan continues, and the plugin's package still wins. The blast radius is wider than from scripts import — nine heredocs import stdlib by name, and a bare json.py at the target's root shadows those with no package at all.

The fix, in three layers

1. Containment first. PYTHONSAFEPATH is inherited, and runcheck.run launches the target's verify_cmd. Applying the fix naively turned python3 -m unittest discover RED on essentially every Python project — including kimi-atlas itself. A new proccap.target_env() strips the switch at the four launch seams that run target code, so the fix cannot manufacture a RED. Placed at the seam rather than in a heredoc, so no future caller can reopen it.
2. The fix. PYTHONSAFEPATH=1 on all 17 invocations in skills/atlas/SKILL.md, plus a fail-closed runtime guard asserting the isolation itself (sys.flags.safe_path) rather than a version proxy — one condition covering a sub-3.11 interpreter, a prefix the model dropped while retyping, and -E/-I.
3. The sweep. Six convention documents, both hooks, the scout role file, the installer and the probes. atlas-resume had no invocation convention at all.

⚠️ Requires Python 3.11+

Below 3.11 the isolation does not exist, and the guard refuses to run rather than report a green it cannot substantiate. Symptom: ATLAS-PRECONDITION-FAILED on every run. Ubuntu 22.04 ships python3 = 3.10.

What the adversarial process caught that code review would not have

11 findings on the plan before a line was written — including the false-RED leak and the plan's own guard tripping its own pin — then findings across three task reviews and a whole-branch review: three mutants of the new guard that passed all 1324 tests while silently reopening the hole, a continuation-line -E evasion using the SKILL's own style, and release notes that overstated the hook exposure (hooks run with cwd=pluginRoot on Kimi CLI v0.28.1, so the hook change is hardening, not a reachable ACE).

All nine invariants hold; 1, 2 and 3 strengthened. scripts/verdict.py was never opened. make ci EXIT 0, 1284 → 1327 tests.

Install: /plugins install https://github.com/null0xxx/kimi-atlas

v1.5.0 — three false-green holes closed

Three false-green holes, found by measurement and closed. A runtime-cost investigation instrumented
ten real atlas runs from Kimi's own per-call usage.record accounting, and in the process reproduced a
defect in shipped v1.4.0: an empty captured diff plus an already-green suite returned
verdict.gate == "OK" — so a run whose coder wrote nothing shipped ✅ VERIFIED. runsignal.count
derives new_tests_collected purely from the runner's output and never sees the diff, and
reqcoverage's "no diff token overlaps criterion" signal is MEDIUM/REQUIREMENTS-COVERAGE, which blocks
neither gate (CRITICAL/HIGH only) nor the V7 refine rule (CORRECTNESS/SECURITY only). Two siblings fell
out of the same audit: a critic_*.json that fails to load was substituted with an empty OK critic and
verdict.merge then synthesised all six dimensions as "yes" — an undispatched lens was
indistinguishable from a clean one; and a dropped docs_clean key failed open on the docs floor.

The fix is scripts/floorsynth.py, a pure module that now owns the Step-4/5 gate marshalling the
orchestrating model used to retype on every run — a transcription lottery in which one dropped +=
line silently deleted a whole floor lens with nothing detecting it. Floor completeness is now a make ci
invariant, pinned by a twelve-condition matrix asserting verdict.gate and verdict.final_status
agree on every deterministic failure condition. The FROZEN pure gate (verdict.merge/gate) is not
opened; the P3 advisory firewall holds by construction (lintlens_advisory is never merged); and a
1536-case old-vs-new differential over well-formed evidence found zero divergence, including a
byte-identical merged_critic.json.

Also: the two long-standing SKILL contradictions are resolved — the advisory skill list now goes to
the coder only (critic isolation, F6 anti-anchoring), and the REFINE re-dispatch is documented as
re-entering CODED in full (safewrap.coder_redispatch_packet assembles the fix-feedback fields, it
was never an equivalent packet). Orchestrator-only defects are fenced out of the coder re-dispatch, so a
fix naming a critic artifact can never invite the LLM under review to author gate input. The instruction
to Read the 80,597-byte references/skill-registry.json into context is gone. Three pure cores ship
unwired for the phases that follow: rubric.lens_section (byte-exact per-lens slicing),
contextgraph.render_for_injection (a byte-bounded injection view — the graph had no cap of any kind),
and ctxstore.valid_run_id + write_artifact_confined (a symlink-refusing, base-anchored write hand).

No token saving is delivered by this release, deliberately — the levers land in later phases, and
none of them may weaken the floor this release just strengthened. Test suite 1193 → 1284.

Hardened by the project's own process: a 6-lens design panel (63 findings), a 6-lens plan-challenge
(42 raw → 21 folded, 4 CRITICAL), seven opus-reviewed SDD tasks, and a final whole-branch review that
caught two mutants of this very code which passed all 1280 tests while reopening the exact false greens
it exists to close — re-seeding loaded_critics, and an unpinned synth_docs argument that yielded
gate=UNVERIFIED with final_status=OK on dirty docs. Pinning that a call happens is not pinning what
it is called with.

v1.4.0 — the advisory linter (P3)

v1.4.0 — the advisory linter (P3)

lintlens surfaces the repo's own linter findings as non-blocking advisory hints during the VERIFIED stage, under a security-locked HYBRID exec model:

• safe-AUTO — pure-parse linters (ruff / shellcheck / gofmt, declarative config) auto-run with the repo's real rules; binaries resolve from PATH only.
• GATED — every code-bearing linter (eslint, rubocop, pylint, php-cs-fixer, …) runs only behind an operator-supplied lint_cmd — the same trusted boundary as verify_cmd.
• Firewalled — the advisory is stored under lintlens_advisory, never in script_defects/gate_results, so it can never false-block a valid repo; and it can never auto-execute untrusted repo code (hermetic launcher: from-scratch env, throwaway HOME, cgroup + unshare -n isolation tiers, never-raise).

Plus C5 (the ATLAS-WEAVE differential is now runner-aware, not pytest-only) and C6 (the SKILL's test_glob default derives from the detected runner).

Why the HYBRID model: an adversarial security threat-model caught, before any code, that auto-running the repo's own linter executes untrusted repo code (.eslintrc.js is JavaScript; .rubocop.yml require: loads Ruby; pylint init-hook runs) — and advisory-only doesn't mitigate it, since the code runs at linter startup. So execution consent moves to the human (GATED) for those ecosystems. Hardened by a 31-finding 6-lens plan-challenge and a converged 6-lens-on-shipped pass.

Backward-compatible — the FROZEN pure gate (verdict.merge/gate), the P1 run-signal floor, the P2 syntax floor, and sast are untouched. Test suite 1151 → 1193.

Install: /plugins install https://github.com/null0xxx/kimi-atlas

v1.3.0 — the syntax floor (P2)

The syntax floor (P2). A hermetic, argv-only, parse-only deterministic lens (Lens 5c) folded into the VERIFIED gate exactly like astlens: before running your tests, it checks each changed file is grammatically valid in its language — Ruby, PHP, Go, shell — plus in-process JSON/TOML config validation.

It is parse-only by construction — it can never execute untrusted repo code (argv-only, never sh -c; ruby -cw not ruby -w; a child environment built from scratch = {PATH,HOME,LANG,TMPDIR} only; a fresh-tempdir cwd) — and it never false-blocks a valid repo (fail-open unless the tool's error names our own materialized file).

The one hard call: JavaScript syntax is NOT covered

Six rounds of the plugin's own 6-lens — running adversarial code against its own new floor — proved node --check cannot distinguish valid JSX/Flow (which ships pervasively inside .js files) from invalid JS, so checking it would false-block the entire React/Flow ecosystem. So JS syntax-checking was dropped. JS is still verified via the P1 run-signal floor (its tests must run and pass); only the unreliable syntax check is gone. Disclosed like the blueprint's other residuals.

Added

• scripts/nativefloor.py — hermetic argv-only parse runner (from-scratch env, fresh-tempdir cwd, signature-gated defects, cgroup-or-uncapped + wall-clock bounded, monkeypatchable tool_path seam).
• scripts/syntaxlens.py — the sole consumer: Ruby/PHP/Go/shell dispatch + an explicit _STRICT_CONFIG basename→parser map (tsconfig.json JSONC, opaque lockfiles, and arbitrary data files are never blocking). Folded into VERIFIED as Lens 5c.
• Optional CI lane (.github/workflows/native-floor.yml) running the non-execution red-team against real node/ruby/php/go.

Changed

• proccap._launch_and_wait gained an optional hermetic env (byte-equivalent when None). The FROZEN verdict.merge/gate, the P1 run-signal floor, and sast are all untouched.

Verification

Plan-challenge (17 findings folded) → subagent-driven build (4 tasks, per-task review) → whole-branch review → 6 rounds of the plugin's own empirical 6-lens that caught a /dev/zero DoS, three false-block classes, and two of its own vacuous security tests. Test suite 1073 → 1151.

Full detail in CHANGELOG.md.

Install: /plugins install https://github.com/null0xxx/kimi-atlas

v1.2.0 — universal run-signal floor (P1) + bench harness

The universal run-signal floor (P1). The DOES-IT-RUN gate now recognizes a genuine test run in any positively-identified runner — pytest, unittest, go test -json, cargo, jest, vitest, mocha, rspec, phpunit — not just Python. A green Go/Rust/JS/Ruby/PHP repo now verifies where before it degraded to UNVERIFIED.

The recognizer is PASS-only and fail-closed: a || true-masked failure, an errors-outside-examples run, or a package-level failure event can no longer fabricate a pass, and an unrecognized runner degrades to UNVERIFIED rather than guessing. Python output stays byte-identical, and the FROZEN pure gate (verdict.merge/gate) is untouched.

Hardening

Design hardened through 7 rounds of the plugin's own 6-lens harness before code, then the shipped code was put through 4 more rounds of that same harness (7 → 2 → 3 → 0 defects) — catching six fabricated-pass/false-red vectors and five ReDoS in the new code, including two regressions introduced by earlier fixes — before the pure gate returned OK. Test suite 1040 → 1073.

Added

• scripts/runsignal.py — pure PASS-only recognizer (structural corroboration, AND-fold across polyglot tags, universal untrusted-input bound closing the ReDoS class).
• scripts/langfloor.py — single runner registry + wrapper-expanding resolver (make/npm/bundle/poetry/uv); recursive collectable_pytest.
• scripts/proccap.py — cap/subprocess backend extracted byte-equivalent + broad ran_the_build recall.
• Benchmark harness (bench/, make bench-validate) — measures gate trustworthiness (false-pass rate), not just correctness.

Changed

• scripts/runcheck.py rewired: parse_* retired; discover order make → npm → pytest(iff collectable) → language markers → ''.

Full detail in CHANGELOG.md.

Install: /plugins install https://github.com/null0xxx/kimi-atlas

v1.1.1 — rubric read-path fix (live-caught)

Patch release — a fix found by running it for real

kimi-atlas v1.1.1 ships a single, genuine runtime fix surfaced by a live end-to-end run on a real repo — the kind of integration bug no static review can catch. Backward-compatible; no interface change.

Install / upgrade

/plugins install https://github.com/null0xxx/kimi-atlas

then /plugins reload. Pin this version:

/plugins install https://github.com/null0xxx/kimi-atlas/releases/tag/v1.1.1

Fixed

• Rubric read path — at the VERIFIED stage, the critic dispatch read the rubric via a bare references/rubric.md. From the target-repo working directory that resolves to the nonexistent skills/atlas/references/rubric.md — a visible "1 failed" read. It now carries the plugin-root prefix ${KIMI_SKILL_DIR}/../../references/rubric.md, matching the agents/ reads. Non-fatal — the critics still ran from their role files — but it dropped each critic's rubric-lens text. A new guard (tests/test_skill_ref_paths.py) pins the class so it cannot recur.

Added

• docs/overview.md — a plain-language overview of what kimi-atlas offers: the pipeline, the orchestration model, the 6-lens gate, the on-disk JSON records, and the four capabilities.

Full changelog: v1.1.0...v1.1.1 · CHANGELOG.md