v1.5.1 — close the sys.path hijack of the pure gate

Security release — upgrade immediately

A target repository could replace any module atlas imports, including the FROZEN pure gate scripts/verdict.py.

During an atlas run the working directory is the target project — untrusted by design — and CPython puts that directory at sys.path[0] ahead of every PYTHONPATH entry, for both -c and heredoc invocations. Reproduced end-to-end by two independent reviewers, running the SKILL's Step-4+5 block as literally written against a hostile target on a genuinely RED build:

	provisional_status	module actually imported
v1.5.0	"OK", blocking: []	the target's verdict.py
v1.5.1	"UNVERIFIED", 6 blocking	the plugin's

v1.5.0 printed ✅ VERIFIED on a build with three CRITICAL defects. That defeated invariant 2 (the pure gate) and THE ONE GUARANTEE.

Why it survived testing: the target's scripts/ must contain __init__.py. Without it the directory is only a namespace portion, the path scan continues, and the plugin's package still wins. The blast radius is wider than from scripts import — nine heredocs import stdlib by name, and a bare json.py at the target's root shadows those with no package at all.

The fix, in three layers

1. Containment first. PYTHONSAFEPATH is inherited, and runcheck.run launches the target's verify_cmd. Applying the fix naively turned python3 -m unittest discover RED on essentially every Python project — including kimi-atlas itself. A new proccap.target_env() strips the switch at the four launch seams that run target code, so the fix cannot manufacture a RED. Placed at the seam rather than in a heredoc, so no future caller can reopen it.
2. The fix. PYTHONSAFEPATH=1 on all 17 invocations in skills/atlas/SKILL.md, plus a fail-closed runtime guard asserting the isolation itself (sys.flags.safe_path) rather than a version proxy — one condition covering a sub-3.11 interpreter, a prefix the model dropped while retyping, and -E/-I.
3. The sweep. Six convention documents, both hooks, the scout role file, the installer and the probes. atlas-resume had no invocation convention at all.

⚠️ Requires Python 3.11+

Below 3.11 the isolation does not exist, and the guard refuses to run rather than report a green it cannot substantiate. Symptom: ATLAS-PRECONDITION-FAILED on every run. Ubuntu 22.04 ships python3 = 3.10.

What the adversarial process caught that code review would not have

11 findings on the plan before a line was written — including the false-RED leak and the plan's own guard tripping its own pin — then findings across three task reviews and a whole-branch review: three mutants of the new guard that passed all 1324 tests while silently reopening the hole, a continuation-line -E evasion using the SKILL's own style, and release notes that overstated the hook exposure (hooks run with cwd=pluginRoot on Kimi CLI v0.28.1, so the hook change is hardening, not a reachable ACE).

All nine invariants hold; 1, 2 and 3 strengthened. scripts/verdict.py was never opened. make ci EXIT 0, 1284 → 1327 tests.

Install: /plugins install https://github.com/null0xxx/kimi-atlas