From 5f21f30f4c75d32d318eb01b7a1ff4c791f39e41 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 23:41:28 +0000
Subject: [PATCH] fix(testing): match the live API's DNS types and process orig
 flags

Live Triage task reports give DNS record types with their class ("IN A",
"IN CNAME"), and set orig on every process in the sample's tree (or on none of
them). The fake report used bare types and set orig only on the sample's process,
so code tested against FakeTriage passed and then dropped data on real reports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KBLBzjbytiAYwrB3fErDUR
---
 CHANGELOG.md              | 1 +
 src/pyhatching/base.py    | 3 +++
 src/pyhatching/testing.py | 9 ++++++---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c37e78..cb4befc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## Unreleased
 ### Features
 ### Fixes
+- Match the live API in `pyhatching.testing`'s task report: DNS record types include their class (`"IN A"`), and `orig` is set on every process in the sample's tree.
 
 ## v1.0.0 - 2026-11-01
 ### Features
diff --git a/src/pyhatching/base.py b/src/pyhatching/base.py
index e2c2c0b..0e3a7af 100644
--- a/src/pyhatching/base.py
+++ b/src/pyhatching/base.py
@@ -597,6 +597,8 @@ class Process(TriageModel):
     ppid: Optional[int] = None
     cmd: Any = None
     image: Optional[str] = None
+    # Whether the process is in the sample's process tree. It's set on the sample's children
+    # too, and sometimes on none of the processes, so it doesn't find the process that ran it.
     orig: Optional[bool] = None
     started: Optional[int] = None
     terminated: Optional[int] = None
@@ -628,6 +630,7 @@ class DNSEntry(TriageModel):
     """A DNS question or answer."""
 
     name: Optional[str] = None
+    # The record class and type, ex. "IN A" or "IN CNAME".
     type: Optional[str] = None
     value: Optional[str] = None
 
diff --git a/src/pyhatching/testing.py b/src/pyhatching/testing.py
index 3d6d90d..6bdc196 100644
--- a/src/pyhatching/testing.py
+++ b/src/pyhatching/testing.py
@@ -291,6 +291,8 @@
         "resource": "win10v2004-20260901-en",
         "platform": "windows10-2004_x64",
     },
+    # Like the live API, orig is set on every process in the sample's process tree, not
+    # only on the process that ran the sample.
     "processes": [
         {
             "procid": 1,
@@ -309,7 +311,7 @@
             "ppid": 2044,
             "cmd": ["C:\\Windows\\System32\\cmd.exe", "/c", "whoami"],
             "image": "C:\\Windows\\System32\\cmd.exe",
-            "orig": False,
+            "orig": True,
             "started": 3400,
             "terminated": 3900,
         },
@@ -349,7 +351,8 @@
                 "at": 4900,
                 "dns_request": {
                     "domains": ["evil.example.com"],
-                    "questions": [{"name": "evil.example.com", "type": "A"}],
+                    # Like the live API, record types include the class ("IN A").
+                    "questions": [{"name": "evil.example.com", "type": "IN A"}],
                 },
             },
             {
@@ -359,7 +362,7 @@
                 "dns_response": {
                     "domains": ["evil.example.com"],
                     "ip": ["198.51.100.7"],
-                    "answers": [{"name": "evil.example.com", "type": "A", "value": "198.51.100.7"}],
+                    "answers": [{"name": "evil.example.com", "type": "IN A", "value": "198.51.100.7"}],
                 },
             },
             {