[drk-ram]

Summary

• Enforce 0 <= value <= 9007199254740991 (2**53 - 1) on token counts and rollup totals in src/agentrust_telemetry/usage.py, and guard non-string currency and pricing_version in CostObservation.as_event_value.
• Reject non-number/non-string or empty/whitespace amount values in TypeScript CostObservation.asEventValue (packages/typescript/src/usage.ts).

Closes #103

Validation

• python -m pytest tests/test_usage.py -q
• python -m ruff check src/agentrust_telemetry/usage.py tests/test_usage.py

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Reviewed source at e8eedb8. Python unittest discovery passed with inherited OTEL_* variables removed; the initial three OTel failures were environment configuration. TypeScript build and all 44 existing tests passed using node --import tsx --test test/*.test.ts; the npm check launcher itself encountered an IPC-listen EPERM here, so I do not claim that wrapper passed. Local results only, not hosted CI. Python: 158 tests pass.

The TypeScript change needs a committed behavioral regression. I prepared a test-only adoption companion at dinakarjs#2, based exactly on this head. Its two tests pass on this branch; restoring the previous TypeScript implementation makes the refusal assertion fail. Please adopt the signed commit and retain attribution, then obtain independent review of the combined change. This is a COMMENT because I am contributing those tests.

Metadata correction: the description currently closes #104, but this cost validation work belongs to #103; please correct that closing reference.

Prepared with OpenAI Codex.

[drk-ram]

Thanks @dinakarjs! Fast-forward merged your signed TypeScript boundary test commit (f958f56, packages/typescript/test/cost-boundaries.test.ts) with full authorship and sign-off preserved, and updated the PR title/description to reference Closes #103.