fix(atr): highest-severity primary finding, and keep scanning off the event loop

Two of @lan17's review points.

max_severity reported findings[0], i.e. whichever rule happened to come
first in rules-file order. With a high-severity rule ahead of a critical
credential rule it reported 'high', exactly as described in review. It
now picks the primary finding by severity_rank, and the legacy
single-match mirror fields describe that same finding, so a caller
reading only those sees the worst thing detected. Ordering is stable:
max keeps the first of equal ranks, and the findings list stays in match
order.

Rule matching is CPU-bound synchronous regex work that ran inline in an
async evaluate(). Nothing awaited during the scan, so the engine's
asyncio.wait_for could not fire until the scan had already completed --
the timeout was not real. It now runs via asyncio.to_thread.

One consequence worth stating plainly rather than leaving to be
discovered: the per-condition budget is enforced with SIGALRM, which only
works on the main thread. _wall_clock_search already detects this and
falls back to a soft post-hoc check off the main thread, so moving the
scan into a worker converts that hard interrupt into a warning. The event
loop is no longer held, but a pathological pattern is no longer cut off
mid-search either. Raised in the PR thread for a decision rather than
resolved unilaterally.

31 passed.

Author: eeee2345

evaluators/contrib/atr/src/agent_control_evaluator_atr/threat_rules/evaluator.py

@@ -25,6 +25,7 @@
 """
 from __future__ import annotations
 
+import asyncio
 import json
 import logging
 import signal
@@ -316,7 +317,13 @@ async def evaluate(self, data: Any) -> EvaluatorResult:  # noqa: D401
             return EvaluatorResult(matched=False, confidence=1.0, message="Empty event")
 
         try:
-            return self._match_rules(event)
+            # Rule matching is CPU-bound synchronous regex work. Running it
+            # inline would hold the event loop for its whole duration, which is
+            # longer than the evaluator timeout on large inputs -- and because
+            # nothing awaits in between, the engine's asyncio.wait_for could not
+            # fire until the scan had already finished. Handing it to a thread
+            # keeps the loop responsive so that timeout is real.
+            return await asyncio.to_thread(self._match_rules, event)
         except Exception as exc:  # noqa: BLE001
             return self._error_result(f"ATR evaluation error: {exc}")
 
@@ -349,14 +356,21 @@ def _match_rules(self, event: ATREvent) -> EvaluatorResult:
                 message="ATR: No threats detected",
             )
 
-        primary = findings[0]
+        # Highest severity wins, not rules-file order. Ordering the findings by
+        # rank would reorder ``findings`` itself, so pick the primary instead and
+        # leave the list in match order. ``max`` keeps the first of equal ranks,
+        # so ties stay deterministic.
+        primary = max(findings, key=lambda f: severity_rank(f["severity"]))
         return EvaluatorResult(
             matched=bool(self.config.block_on_match),
             confidence=max_confidence,
             message=f"ATR: {len(findings)} threat(s) detected",
             metadata={
                 "findings": findings,
                 "count": len(findings),
+                # The legacy single-match mirrors below describe this same
+                # finding, so a caller reading only those sees the worst thing
+                # detected rather than whichever rule happened to sort first.
                 "max_severity": primary["severity"],
                 # Backwards-compatible single-finding mirrors. NB:
                 # ``matched_text`` from v0.1 is intentionally REMOVED and