v1.4.0 — the advisory linter (P3)

v1.4.0 — the advisory linter (P3)

lintlens surfaces the repo's own linter findings as non-blocking advisory hints during the VERIFIED stage, under a security-locked HYBRID exec model:

• safe-AUTO — pure-parse linters (ruff / shellcheck / gofmt, declarative config) auto-run with the repo's real rules; binaries resolve from PATH only.
• GATED — every code-bearing linter (eslint, rubocop, pylint, php-cs-fixer, …) runs only behind an operator-supplied lint_cmd — the same trusted boundary as verify_cmd.
• Firewalled — the advisory is stored under lintlens_advisory, never in script_defects/gate_results, so it can never false-block a valid repo; and it can never auto-execute untrusted repo code (hermetic launcher: from-scratch env, throwaway HOME, cgroup + unshare -n isolation tiers, never-raise).

Plus C5 (the ATLAS-WEAVE differential is now runner-aware, not pytest-only) and C6 (the SKILL's test_glob default derives from the detected runner).

Why the HYBRID model: an adversarial security threat-model caught, before any code, that auto-running the repo's own linter executes untrusted repo code (.eslintrc.js is JavaScript; .rubocop.yml require: loads Ruby; pylint init-hook runs) — and advisory-only doesn't mitigate it, since the code runs at linter startup. So execution consent moves to the human (GATED) for those ecosystems. Hardened by a 31-finding 6-lens plan-challenge and a converged 6-lens-on-shipped pass.

Backward-compatible — the FROZEN pure gate (verdict.merge/gate), the P1 run-signal floor, the P2 syntax floor, and sast are untouched. Test suite 1151 → 1193.

Install: /plugins install https://github.com/null0xxx/kimi-atlas