v1.5.2.1 — six defects that were live in v1.5.2, one CRITICAL

Security hotfix — upgrade immediately

Seven defects were live in the shipped v1.5.2, one CRITICAL. Three of the seven were introduced by v1.5.2's own fixes. Six are closed here; the seventh ships known-open with a workaround and a recorded decision.

⛔ C1 (CRITICAL, self-inflicted) — model-supplied text was executed as Python source

v1.5.2's new validate-and-persist block interpolated a critic's returned text into a source literal:

RAW = r'''<the critic's returned JSON text>'''

A response containing ''' closed the literal and the remainder executed — arbitrary code in the orchestrator's shell, all three critic artifacts forgeable with correct pass stamps, and the exact success token printed. The injection landed before json.loads and before enforce_critic_schema, so v1.5.2's own new validation was bypassed, not defeated.

Pointed the honest way it was a false RED: a critic quoting a ''' docstring — which the critic role files instruct it to do — broke the block on a green tree.

The adversarial challenge found four such sinks, not the three first specified — including the scout digest, which carries bytes copied verbatim out of the target repo and so needs no agent's judgment to trigger. All four now take a path in argv, written verbatim by the native Write tool and read with utf-8-sig inside the block's try:. Heredocs are explicitly forbidden as writers: a body containing a line equal to the sentinel closes it early (verified — rc=0, a marker executed, and a silently truncated file).

Also closed

• H1 — a target-controlled filename reached the coder's trusted instruction raw. Git tracks newline filenames, and the target's own build can create one during VERIFIED. Now json.dumps-quoted: reversible, collision-free, and the human can still find the file.
• H3 — the checkpoint prose invited a standalone advance("CODED") after VERIFIED — the exact trajectory v1.5.2's own new fold fires on. An honest 2-pass run that fixed everything ended ⚠️ UNVERIFIED for bookkeeping.
• H4 — a critic could take an orchestrator id and delete its own CRITICAL from the refine loop.
• H6 — an honest crash after advance(REFINE) resumed at OUTPUT and printed a green with the V7-forced refine never run.

⚠️ Two bounded interims — stated, not overclaimed

• H2: the dirty-tree RED is NOT fixed. Only the coder is no longer told to revert files it did not author. Three HIGH defects still emit and both refine passes still burn on an interactive run over a tree where nobody did anything wrong.
• H5 ships KNOWN-OPEN. A second review in one session inherits the first's frozen packet. Workaround: start a new session per review. Its RED is warranted — review #2 genuinely runs review #1's intent and baseline_sha — so what is wrong is the remedy text, never the verdict. Its two pins ship skipped, not deleted, unweakened, as v1.5.3's acceptance gate.

How this was found

Two independent adversarial sources found the seven. Two challengers then attacked the fix plan by execution before any code was written and returned five CRITICALs against the plan itself — including a would-be fourth manufactured RED, and two findings that would have shipped a believed-closed defect. A whole-branch review then mutation-hunted the branch's own new code and reproduced two working evasions after the per-task reviews had passed; both were closed and independently re-proven.

The governing rule — a fix that manufactures a RED on an honest repository is worse than the bug it closes — is why two of the six ship as interims. Verified by execution: every honest ledger shape (CLARIFY present/absent × 0/1/2 refine passes × a crash-resume duplicate of every stage at every position × a ROLLBACK marker at every position) keeps its green.

scripts/verdict.py was never opened — blob 57062e71 identical at both ends. Test suite 1460 → 1578.

Requires Python 3.11+. Install: /plugins install https://github.com/null0xxx/kimi-atlas