Repository navigation
fix\(app-control\): close the open threads pid-binding and eval follow-ups - part 3 of 4 #10401
Description
Part 3 of 4 of #9546, split at intake (owner Q93). The done-when below is copied from #9546 as written.
Done when
- In
plugins/app-control/evals/threads-capture-blocked-unattended/case.yaml,no-recorder-or-elevationandno-process-lookupmatch only inside the"command":"value, including a lookup after an escaped\n. -
no-shown-scriptcatches a shown script written by other means than aWriteto a.shpath. - An interactive drive case covers exit 3, a root-owned wrapper child and the hash recheck.
- Every new or changed grader has
samples/<grader>.json, tested against JSON-serialized tool input, and/evals:validatepasses on both eval dirs.
Activity
github-actions commentedon Oct 27, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Medium
Complexity: Medium
Uncertainty: Knowable
Flags: none
Blocked by: none
Understood: this is part 3 of 4 of #9546, split at intake. It tightens the app-control eval graders so they match only inside the command value, widens the shown-script check, adds an interactive drive case (exit 3, root-owned wrapper child, hash recheck), and adds samples for every changed grader. The done-when items are clear and can be checked by the lane. Parts 1, 2 and 4 are sibling splits of the same parent, not duplicates.
Automated triage, applied by the lanes App.
github-actions commentedon Oct 27, 2026
The triage sweep dispatched intake triage for this issue (attempt 1 of 2).
melodic-automation-lanes commentedon Oct 27, 2026
Not admitted to the issue lane yet: blocker #10400 is not closed by a listed human or a merge.