fix(testing): match the live API's DNS types and process orig flags

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Unreleased
 ### Features
 ### Fixes
+- Match the live API in `pyhatching.testing`'s task report: DNS record types include their class (`"IN A"`), and `orig` is set on every process in the sample's tree.
 
 ## v1.0.0 - 2026-11-01
 ### Features

src/pyhatching/base.py

@@ -597,6 +597,8 @@ class Process(TriageModel):
     ppid: Optional[int] = None
     cmd: Any = None
     image: Optional[str] = None
+    # Whether the process is in the sample's process tree. It's set on the sample's children
+    # too, and sometimes on none of the processes, so it doesn't find the process that ran it.
     orig: Optional[bool] = None
     started: Optional[int] = None
     terminated: Optional[int] = None
@@ -628,6 +630,7 @@ class DNSEntry(TriageModel):
     """A DNS question or answer."""
 
     name: Optional[str] = None
+    # The record class and type, ex. "IN A" or "IN CNAME".
     type: Optional[str] = None
     value: Optional[str] = None
 

src/pyhatching/testing.py

@@ -291,6 +291,8 @@
         "resource": "win10v2004-20260901-en",
         "platform": "windows10-2004_x64",
     },
+    # Like the live API, orig is set on every process in the sample's process tree, not
+    # only on the process that ran the sample.
     "processes": [
         {
             "procid": 1,
@@ -309,7 +311,7 @@
             "ppid": 2044,
             "cmd": ["C:\\Windows\\System32\\cmd.exe", "/c", "whoami"],
             "image": "C:\\Windows\\System32\\cmd.exe",
-            "orig": False,
+            "orig": True,
             "started": 3400,
             "terminated": 3900,
         },
@@ -349,7 +351,8 @@
                 "at": 4900,
                 "dns_request": {
                     "domains": ["evil.example.com"],
-                    "questions": [{"name": "evil.example.com", "type": "A"}],
+                    # Like the live API, record types include the class ("IN A").
+                    "questions": [{"name": "evil.example.com", "type": "IN A"}],
                 },
             },
             {
@@ -359,7 +362,7 @@
                 "dns_response": {
                     "domains": ["evil.example.com"],
                     "ip": ["198.51.100.7"],
-                    "answers": [{"name": "evil.example.com", "type": "A", "value": "198.51.100.7"}],
+                    "answers": [{"name": "evil.example.com", "type": "IN A", "value": "198.51.100.7"}],
                 },
             },
             {