[hivecommons-hive]

Fixes the red Linux capture tests job on main since the ubuntu-latest → ubuntu-26.04 image roll (main run 40374497855: 12 failures).

Root cause (from the job logs, not the original premise)

The failing 12 are exactly the cases whose tree is built by spawn_tree, i.e. from cp $(command -v sleep) $FAKEBIN/<name>: the five classify_cli: * grandchild cases, descendants: walks children (>=2 pids), and the e2e cases that need a non-claude classification (e2e claude passes only because unknown falls back to the bracketed form). Every case that execs the system sleep under another argv[0] (exec -a gemini sleep 300) and every PATH stub under $TMP/stubs passes, so /tmp is not noexec and the /proc walk is fine. On the 26.04 image (Rust coreutils) the renamed copy of sleep does not run as sleep, the grandchild exits, wait returns, the root exits, and descendants sees only a dead root pid.

The earlier revision of this PR added a /proc/<pid>/stat fallback to descendants(); its own CI (run 40391187714) showed the same 12 failures because the fallback only ran once the root was already gone. That change is dropped — the script is untouched.

Change

linux/tests/hotshot-capture.test.sh: the fake CLI binaries are #!/bin/bash wrappers around sleep. The kernel names a shebang-run script after the script file, so /proc/<pid>/comm still reads claude/copilot/… on any distro, and the fixture no longer depends on the host's coreutils implementation. Test-only; no CHANGELOG entry.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed a fix for the cancelled Linux capture tests run (FIX_DIFF — the stat fallback read pgrp instead of ppid, so a setsid root enqueued itself and the walk never ended). CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 3532b19

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: this does not fix the failure it targets. The PR's own "Linux capture tests" job on ubuntu-26.04 (job 121812279709) ends 257 passed, 12 failed with exactly the same 12 tests as main's run 40374497855 — descendants: walks children (>=2 pids), the five classify_cli: * grandchild cases, and the e2e cases that depend on them.

Why, from the diff: the fallback at linux/hotshot-capture.sh:240-241 is taken only when compgen -G "/proc/$pid/task/*/children" matches no file. Since the job still fails after this change, the children files exist on that runner and the fast path is still what runs; the /proc/*/stat scan at :243-256 is never reached. That contradicts the body's root cause ("kernels without CONFIG_PROC_CHILDREN expose no children files") — the premise was not verified, and the body's "CI on this PR is the verification" is now a red result.

What I could not determine (open questions for the next attempt), in order of likelihood from the test shape (linux/tests/hotshot-capture.test.sh:206-213: setsid bash -c "bash -c '…' & wait" … &; root=$!):

1. Is $root still alive by the time descendants runs on 26.04? If the image's setsid forks (e.g. newer util-linux behaviour when the caller is a group leader), $! is a parent that has already exited, and descendants on a dead pid legitimately yields one line — matching the exact failure pattern ("includes root" passes because the root is echoed unconditionally at :238, ">=2 pids" fails).
2. If the root is alive, do /proc/$root/task/*/children read as empty while /proc/<child>/stat ppid points at $root? Only in that case would a fallback-on-empty-kids (rather than fallback-on-missing-file) help.

Suggest: push one diagnostic commit to the test (print [ -d /proc/$root ], cat /proc/$root/task/*/children, and ps -o pid,ppid,sid,comm --ppid $root) and read the 26.04 log before choosing a fix. If (1) is the cause the bug is in the test harness, not in descendants(), and this change should be dropped rather than extended.

Secondary, only if the stat fallback is kept: read -r _ ppid _ <<<"${stat##*) }" at :252 is correct for comms containing )/spaces, and local -A needs bash ≥4 which the script already assumes — no issues there.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: the fallback is implemented correctly but never engages on the runner this PR targets, so the change does not accomplish its stated goal. The PR's own CI shows it.

What I verified:

• Fallback logic is sound. I extracted descendants() from this head (linux/hotshot-capture.sh:230-261), stubbed compgen to fail, and walked a real spawned tree whose comm was literally x) (y S 1. Native and fallback walks returned identical pid sets; the ${stat##*) } / read -r _ ppid _ parse at :252 is correct. The full suite also passes here (269/269) on a kernel that has children files.
• But the gate is wrong for the symptom. :240 falls back only when compgen -G "/proc/$pid/task/*/children" matches no file. The body describes a different rule — "when it yields nothing for a pid, fall back" — and the diff does not implement that. If the files exist but read empty (which is what "yields nothing" means), :241 runs, kids is empty, and the map is never built.
• The PR's own Linux capture tests job (run 40391187714, job 121812279709) finished failure with 257 passed, 12 failed, and the 12 are the same 12 that fail on main (run 40374497855): descendants: walks children (>=2 pids), the five classify_cli: * grandchild cases, and the six e2e cases that depend on them. So on ubuntu-26.04 the walk still returns only the root pid with this change applied. The body says "CI on this PR is the verification" — that verification failed.

What would close the gap: trigger the fallback when the children-file read yields an empty kids for the root ([ -z "$kids" ]), not on file absence — that is the rule the body already describes — and add a test that forces the fallback path (e.g. a HOTSHOT_NO_PROC_CHILDREN=1 switch or a stubbed compgen) so it is exercised on kernels where the fast path works. I have not confirmed why the files yield nothing on that runner (empty vs. unreadable); that is an open question worth a cat /proc/$$/task/*/children; echo rc=$? in the job.

I have not closed or changed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

⏸️ CI is red on the base branch (Linux capture tests); holding until it recovers — this is not a failure in this PR, so no fix attempt is counted and no one needs to act here.

[hivecommons-hive]

hive/awaiting-ci: replaced the branch content (68a9ba1, force-pushed with lease on this hive-owned branch) after re-reading job 121812279709: the 12 failures are exactly the spawn_tree cases, whose fixtures are renamed copies of sleep; the exec -a NAME sleep sibling cases and the $TMP PATH stubs pass, so the walk and /tmp exec are fine and the renamed coreutils copy is what dies on ubuntu-26.04. The script change is dropped; the fixtures are now shebang wrappers. This PR is the fix for the red base, so CI here is the verdict — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 68a9ba1

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#31568a9ba1` sha256:74589087d8ad75bfea89fec001036e4ad038d7407f1195e360d6ad4a0f713430 — download from the dashboard or `hivectl review evidence #315`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback