Skip to content

Reject boolean timestamps in TRACE finalization - #128

Open
drk-ram wants to merge 1 commit into
agentrust-io:mainfrom
drk-ram:fix-126-boolean-timestamps
Open

drk-ram wants to merge 1 commit into
agentrust-io:mainfrom
drk-ram:fix-126-boolean-timestamps

Conversation

@drk-ram

@drk-ram drk-ram commented Nov 6, 2026

Copy link
Copy Markdown

Summary

Fixes #126. TRACE finalization and approval binding now validate canonical Unix-nanosecond decimal strings instead of coercing booleans or malformed values through int().

Contract impact

  • No wire-contract change
  • Backward-compatible contract change with fixtures
  • Breaking contract change with migration notes

Evidence

  • python tools/sync_schemas.py (not applicable; no schema change)
  • python tools/check_schemas.py (not applicable; no schema change)
  • python conformance/runner/validate.py (not run; no schema change)
  • python -m unittest discover -s tests -v
  • python -m build (not run)
  • pytest -q (164 passed, 2 skipped, 155 subtests passed)
  • mypy --follow-imports=skip src/agentrust_telemetry/trace_adapter.py

Privacy and security

  • No real prompts, source, credentials, personal data, or production identifiers added
  • New fields have capture semantics and privacy classification (N/A; no new fields)
  • Security-sensitive changes received maintainer review (requested through this PR)

Limits

This changes Python adapter validation only. Existing wire schemas are unchanged, and invalid timestamps continue to produce a finalization refusal rather than a signed record.

Signed-off-by: Raghuvar Karthik Durga <177662415+drk-ram@users.noreply.github.com>
@drk-ram
drk-ram requested review from a team and imran-siddique as code owners November 6, 2026 16:25
@github-actions

github-actions Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

🔴 Contributor Check: HIGH

Check Result
Profile HIGH
Credential LOW
Overall HIGH

Automated check by AgenTrust Contributor Check.

@github-actions github-actions Bot added the needs-review:HIGH Contributor check flagged HIGH risk label Nov 6, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-review:HIGH Contributor check flagged HIGH risk

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: trace_adapter binds an approval whose timestamps are booleans

1 participant