[drk-ram]

What this changes

Closes #645.

Hardens prototype/gate_store.py:

• Adds _finite_float (parse_float) to _recv so overflowed JSON float literals (1e309, -1e309) raise ValueError.
• Bounds _int to 0 <= value <= 9007199254740991 so negative or >= 2**63 integers raise ValueError and return {"error": "malformed"} instead of crashing _Handler.handle with an uncaught sqlite3 OverflowError.
• Rejects empty string identifiers "" in _str.
• Validates that RemoteGateStore(..., timeout=...) is a positive finite int or float (excluding bool).

Validation commands and results:

• PYTHONPATH=src python -m pytest tests/test_gate_store_and_cmcp_gate_hardening.py -q -> passed (85 passed)
• python -m ruff check prototype/gate_store.py tests/test_gate_store_and_cmcp_gate_hardening.py -> passed (All checks passed!)
• python tools/check_dashes.py -> passed (no dashes outside examples/, spec/trace-v0.1.md)
• PYTHONPATH=src python tools/review_bar.py --base origin/main --head HEAD -> passed (13 changed test cases fail on behaviour at origin/main)

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

prototype/gate_store.py (experimental cMCP replay-state store prototype; no normative change to spec/trace-v0.2.md)

Tests for a fix

• parse_float=_finite_float in _recv: tests/test_gate_store_and_cmcp_gate_hardening.py::test_recv_rejects_float_exponent_overflow
• 0 <= value <= 9007199254740991 in _int: tests/test_gate_store_and_cmcp_gate_hardening.py::test_int_and_server_reject_out_of_range_integers_without_crashing
• Non-empty string check in _str: tests/test_gate_store_and_cmcp_gate_hardening.py::test_str_and_server_reject_empty_string_identifiers
• Positive finite timeout validation in RemoteGateStore.__init__: tests/test_gate_store_and_cmcp_gate_hardening.py::test_remote_gate_store_rejects_invalid_timeout

Changelog entry

• Fixed (prototype(gate_store): reject float overflow, out-of-range integers, empty identifiers, and invalid RemoteGateStore timeout #645). prototype.gate_store now rejects overflowed JSON floats in _recv, bounds _int to [0, 9007199254740991] so 64-bit integer overflows return malformed instead of raising an uncaught OverflowError, rejects empty string identifiers in _str, and validates RemoteGateStore timeout.

Checklist

• DCO sign-off on all commits (git commit -s)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[rajnisht7]

Batch response for this cluster is here: #653 (comment)