[dinakarjs]

Summary

Fixes #126. A self-consistent imported evidence snapshot could contain boolean or otherwise noncanonical timestamps that Python's int() coerced into an approval window or TRACE issuance time. The adapter now accepts only the existing ASCII decimal-string timestamp format before appraisal/signing, and applies the same parser in request/resolution and executed-action binding.

The regression tests rehash malformed snapshots so chain-integrity validation cannot mask the timestamp defect. They exercise each timestamp position, booleans/numbers/noncanonical strings, canonical boundaries, expiry, a valid signed appraisal, and refusal before signing.

Contract impact

• No wire-contract change: enforces common.schema.json's existing timestamp representation.
• Valid streams retain their appraisal and issuance time.
• Malformed approval/action times cannot establish binding; public finalization raises TraceFinalizationError.

Evidence

Python 3.12, fresh environment installed with --require-hashes -r requirements/test.txt:

• Full Python suite: 170 tests passed. This workspace injects OTEL_TRACES_SAMPLER=parentbased_traceidratio and OTEL_TRACES_SAMPLER_ARG=0.01; removing those two process-local overrides restores the default sampler. The first run with those overrides had three unrelated tracing failures; they are not concealed as a passing run.
• The new six-test selection fails on unmodified main (negative subtests expose the defect); all six methods pass with the repair. Final focused TRACE suite after import/style cleanup: 31 passed.
• sync_schemas.py, schema/version/OTel compatibility/TypeScript schema/OIDC checks, conformance runner, compileall, pip check, touched-file Ruff, and whitespace checks pass.
• Wheel and sdist build and installed-artifact smoke checks pass.

Hosted checks on 658eca654f4f05e8904fca19f193d6ae871b0556 are now complete: Python 3.10–3.13, TypeScript, fuzzing, CodeQL analysis and contributor check all pass; the inapplicable auto-merge job is skipped. Imran is already a requested reviewer. Independent maintainer review remains pending.

Privacy and security

• Synthetic fixtures only; no production data or credentials added.
• Security-sensitive change received maintainer review.

Limits

This is a Python TRACE-adapter timestamp repair, not a full event-schema revalidation or proof of approval authority. TypeScript, dependency locks, wire schemas and policy semantics are unchanged. Hosted CI and independent maintainer review remain required.

Prepared and validated with OpenAI Codex; DCO signed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.