[drk-ram]

Closes #114

Summary

• Validate canonical non-negative decimal strings (/^(0|[1-9][0-9]{0,19})$/) and safe-integer seconds in TypeScript hrTime (packages/typescript/src/projection.ts) before calling BigInt(value).
• Skip non-finite float/number values (NaN, Infinity) in span_attributes (src/agentrust_telemetry/projection.py) and spanAttributes (packages/typescript/src/projection.ts).
• Add Python and TypeScript unit tests in tests/test_otel_projectors.py and packages/typescript/test/metrics.test.ts.

Validation

• pytest tests/test_otel_projectors.py -k "not real and not action_metrics" -q — passed (4 passed)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Bounded review of exact head 49da7a9. I fetched packages/typescript/src/projection.ts at this SHA and executed that module directly using Node 24.22.1 with type stripping. Canonical controls 0, 1 and 1000000001 return the expected tuples; trailing LF, CR, CRLF and Unicode line/paragraph separators are rejected. The spanAttributes control retains run_id while omitting NaN/Infinity values. No new blocker found in those checked paths.

The added 20-digit ceiling already bounds seconds to at most 99,999,999,999, so the subsequent MAX_SAFE_INTEGER-seconds check cannot be reached by a value that passed that regex. Treat it as defensive/redundant, not an independently exercised boundary. A useful nonblocking addition is a committed positive control at 99999999999999999999 ns with the exact [99999999999, 999999999] tuple, alongside the 21-digit refusal.

This is direct TypeScript-module validation and source review; I have not run the repository's complete Python/TypeScript suites or schema consumers in this environment. Reviewed with OpenAI Codex.

[dinakarjs]

Completing review at unchanged exact head 49da7a9 after the earlier direct-module controls. Fresh hash-locked requirements/test.txt environment and editable local installation: complete Python unittest discovery passes 159 tests with OTEL_TRACES_SAMPLER=always_on. The TypeScript build passes; all 45 TypeScript tests pass via node --import tsx --test test/*.test.ts. npm test's tsx launcher cannot create its local IPC pipe in this environment; invoking the same test files through Node's loader avoids that launcher limitation without changing tests or source. No source changes. Approving the bounded projection/canonical-decimal fix; the suggested 20-digit positive boundary remains nonblocking. Hosted gates and maintainer disposition remain separate. Reviewed with OpenAI Codex.

[dinakarjs]

The shared boundary-test follow-up is now a signed test-only adoption companion: dinakarjs#5 at 4d5dcb2, based on your exact 49da7a9 head. Six positive timestamp tuples, thirteen refusals and five projection cases run from the same fixture in both SDKs. Python full suite 162 passes; TS full suite 69 passes and build passes. Removing each decimal/nonfinite projection guard independently fails the new cases. No runtime/schema change or reapproval of our own tests; author adoption and independent review remain separate.

[drk-ram]

Thanks @dinakarjs! Applied the shared Python and TypeScript projection boundary corpus (conformance/parity/projection-boundaries.json, tests/test_projection_parity_corpus.py, and packages/typescript/test/projection-parity.test.ts) on top of 49da7a9 in d525a20. Both Python (162 tests) and TypeScript (69 tests + tsc build) pass.

[dinakarjs]

Follow-up at exact head d525a20, isolated checkout on Linux/Python 3.12.14.

Verified adoption of the shared Python/TypeScript projection boundary corpus and both consumers. With the branch's hash-locked Python test dependencies, unittest discovery passes 162 tests when the environment sampler is set to always_on; the initial 1% inherited sampler caused unrelated propagation/scenario failures. TypeScript npm ci and build pass; node --import tsx --test test/*.test.ts passes 69 tests. The npm-test tsx CLI itself cannot create its Unix IPC listener in this environment, so the equivalent Node test runner entry point was used. This closes my test-adoption follow-up. I contributed these tests, so this is incorporation verification rather than independent approval; hosted and independent review remain separate.

Reviewed with OpenAI Codex.