[drk-ram]

Summary

• Reject duplicate JSON object keys and NaN/Infinity constants in agentrust_capture_core.state.load_state (returning None) and pass allow_nan=False in agentrust_capture_core.hashing.sha_mapping.
• Verify seal.get("alg") == "SHA-256" when "alg" is present in agentrust_capture_core.seal.check_seal (returning INTEGRITY_BROKEN on algorithm mismatch).

Closes #366

Validation

• python -m pytest packages/agentrust-capture-core/tests/test_core.py -q

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head e8ff9802582d6738ac8e713c58ff0f5581ca928d in an isolated checkout.

The capture-core changes reject non-finite values before hashing, refuse duplicate/non-finite persisted JSON, and check a present seal algorithm while retaining the established legacy behavior when that field is absent. Existing valid seal/state controls and the new malformed-input cases pass. No blocking finding in the changed package.

Validation: all 56 package tests passed, scoped Ruff and diff whitespace checks passed, and all PR commits carry sign-offs. This approval does not establish completion of hosted CI or the maintainer policy gate.

Reviewed with OpenAI Codex.

[carloshvp]

Hosted CI follow-up at head e8ff9802582d6738ac8e713c58ff0f5581ca928d: after I approved the held capture-core run, its Python 3.9 job failed in actions/setup-python before dependency installation or tests: "The version '3.9' with architecture 'x64' was not found for Ubuntu 26.04." Job: https://github.com/agentrust-io/integrations/actions/runs/40037909203/job/120848920852.

The current actions/python-versions manifest publishes Python 3.9.25 x64 builds for Ubuntu 22.04 and 24.04, so pinning this compatibility job to ubuntu-24.04 is a concrete way to retain the declared 3.9 coverage: https://github.com/actions/python-versions/blob/9834b4e4911ca2950ff6c3b7547f09eacc006848/versions-manifest.json. This runner setup failure is separate from the package source review and its 56 locally passing tests.