Skip to content

fix(testing): match the live API's DNS types and process orig flags - #15

Merged
gormaniac merged 1 commit into
mainfrom
claude/modest-newton-y1lex4
Nov 2, 2026
Merged

gormaniac merged 1 commit into
mainfrom
claude/modest-newton-y1lex4

Conversation

@gormaniac

Copy link
Copy Markdown
Owner

pyhatching.testing's fake task report (TASK_REPORT, served by FakeTriage) didn't match what the live Triage API returns in two ways. So code tested against it passed, then dropped data on real reports. This came up when testing the slib.hatching Storm service (gormaniac/stormsvcs#14) against tria.ge.

  • DNS record types include their class. Live reports use "IN A", "IN CNAME", and "IN AAAA" in dns_request.questions[].type and dns_response.answers[].type. The fake used bare "A".
  • orig is set on the whole process tree. Live reports set orig on every process in the sample's tree, or sometimes on none of them, including the sample's own process. The fake set it only on the sample's process, which suggested it marks the process that ran the sample.

Changes

  • src/pyhatching/testing.py: the fake report's DNS types are now "IN A", and both processes have orig: true. Comments explain both.
  • src/pyhatching/base.py: comments on Process.orig and DNSEntry.type describe what the live API sends.
  • CHANGELOG.md: added under Unreleased → Fixes. Downstream tests that assert on the fixture's DNS types or orig flags will see the change.

Testing

  • pytest tests: 42 passed and 4 skipped, with HATCHING_TOKEN set so the live read tests ran. The skips are the opt-in write and submit tests, and org stats, which this account can't read.
  • The stormsvcs hatching tests pass against this branch: 37 passed, 3 skipped.
  • These shapes were checked against real public sample reports on tria.ge, e.g. 261101-r15ybav1f1 (orig on no processes) and 261101-ww6q9sxthw (orig on all 8).

Generated by Claude Code

Live Triage task reports give DNS record types with their class ("IN A",
"IN CNAME"), and set orig on every process in the sample's tree (or on none of
them). The fake report used bare types and set orig only on the sample's process,
so code tested against FakeTriage passed and then dropped data on real reports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KBLBzjbytiAYwrB3fErDUR
@gormaniac
gormaniac merged commit 9ec40d6 into main Nov 2, 2026
1 check passed
@gormaniac
gormaniac deleted the claude/modest-newton-y1lex4 branch November 2, 2026 00:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants